Commit 0102eeed authored by Andrea Parri (Microsoft)'s avatar Andrea Parri (Microsoft) Committed by Jakub Kicinski
Browse files

hv_netvsc: Allocate the recv_buf buffers after NVSP_MSG1_TYPE_SEND_RECV_BUF 



The recv_buf buffers are allocated in netvsc_device_add().  Later in
netvsc_init_buf() the response to NVSP_MSG1_TYPE_SEND_RECV_BUF allows
the host to set up a recv_section_size that could be bigger than the
(default) value used for that allocation.  The host-controlled value
could be used by a malicious host to bypass the check on the packet's
length in netvsc_receive() and hence to overflow the recv_buf buffer.

Move the allocation of the recv_buf buffers into netvsc_init_but().

Reported-by: default avatarJuan Vazquez <juvazq@microsoft.com>
Signed-off-by: default avatarAndrea Parri (Microsoft) <parri.andrea@gmail.com>
Fixes: 0ba35fe9 ("hv_netvsc: Copy packets sent by Hyper-V out of the receive buffer")
Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 6b4950d9

drivers/net/hyperv/netvsc.c

+11 −7
Original line number Diff line number Diff line
@@ -311,7 +311,7 @@ static int netvsc_init_buf(struct hv_device *device, 
	struct nvsp_message *init_packet;

	unsigned int buf_size;

	size_t map_words;

	int ret = 0;

	int i, ret = 0;



	/* Get receive buffer area. */

	buf_size = device_info->recv_sections * device_info->recv_section_size;
@@ -405,6 +405,16 @@ static int netvsc_init_buf(struct hv_device *device, 
		goto cleanup;

	}



	for (i = 0; i < VRSS_CHANNEL_MAX; i++) {

		struct netvsc_channel *nvchan = &net_device->chan_table[i];



		nvchan->recv_buf = kzalloc(net_device->recv_section_size, GFP_KERNEL);

		if (nvchan->recv_buf == NULL) {

			ret = -ENOMEM;

			goto cleanup;

		}

	}



	/* Setup receive completion ring.

	 * Add 1 to the recv_section_cnt because at least one entry in a

	 * ring buffer has to be empty.
@@ -1549,12 +1559,6 @@ struct netvsc_device *netvsc_device_add(struct hv_device *device, 
	for (i = 0; i < VRSS_CHANNEL_MAX; i++) {

		struct netvsc_channel *nvchan = &net_device->chan_table[i];



		nvchan->recv_buf = kzalloc(device_info->recv_section_size, GFP_KERNEL);

		if (nvchan->recv_buf == NULL) {

			ret = -ENOMEM;

			goto cleanup2;

		}



		nvchan->channel = device->channel;

		nvchan->net_device = net_device;

		u64_stats_init(&nvchan->tx_stats.syncp);