Commit 3946688e authored by Andrea Parri (Microsoft)'s avatar Andrea Parri (Microsoft) Committed by David S. Miller
Browse files

hv_netvsc: Fix validation in netvsc_linkstatus_callback() 



Contrary to the RNDIS protocol specification, certain (pre-Fe)
implementations of Hyper-V's vSwitch did not account for the status
buffer field in the length of an RNDIS packet; the bug was fixed in
newer implementations.  Validate the status buffer fields using the
length of the 'vmtransfer_page' packet (all implementations), that
is known/validated to be less than or equal to the receive section
size and not smaller than the length of the RNDIS message.

Reported-by: default avatarDexuan Cui <decui@microsoft.com>
Suggested-by: default avatarHaiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: default avatarAndrea Parri (Microsoft) <parri.andrea@gmail.com>
Fixes: 505e3f00 ("hv_netvsc: Add (more) validation for untrusted Hyper-V values")
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 9200f515

drivers/net/hyperv/hyperv_net.h

+1 −1
Original line number Diff line number Diff line
@@ -229,7 +229,7 @@ int netvsc_send(struct net_device *net, 
		bool xdp_tx);

void netvsc_linkstatus_callback(struct net_device *net,

				struct rndis_message *resp,

				void *data);

				void *data, u32 data_buflen);

int netvsc_recv_callback(struct net_device *net,

			 struct netvsc_device *nvdev,

			 struct netvsc_channel *nvchan);

drivers/net/hyperv/netvsc_drv.c

+9 −4
Original line number Diff line number Diff line
@@ -744,7 +744,7 @@ static netdev_tx_t netvsc_start_xmit(struct sk_buff *skb, 
 */

void netvsc_linkstatus_callback(struct net_device *net,

				struct rndis_message *resp,

				void *data)

				void *data, u32 data_buflen)

{

	struct rndis_indicate_status *indicate = &resp->msg.indicate_status;

	struct net_device_context *ndev_ctx = netdev_priv(net);
@@ -765,11 +765,16 @@ void netvsc_linkstatus_callback(struct net_device *net, 
	if (indicate->status == RNDIS_STATUS_LINK_SPEED_CHANGE) {

		u32 speed;



		/* Validate status_buf_offset */

		/* Validate status_buf_offset and status_buflen.

		 *

		 * Certain (pre-Fe) implementations of Hyper-V's vSwitch didn't account

		 * for the status buffer field in resp->msg_len; perform the validation

		 * using data_buflen (>= resp->msg_len).

		 */

		if (indicate->status_buflen < sizeof(speed) ||

		    indicate->status_buf_offset < sizeof(*indicate) ||

		    resp->msg_len - RNDIS_HEADER_SIZE < indicate->status_buf_offset ||

		    resp->msg_len - RNDIS_HEADER_SIZE - indicate->status_buf_offset

		    data_buflen - RNDIS_HEADER_SIZE < indicate->status_buf_offset ||

		    data_buflen - RNDIS_HEADER_SIZE - indicate->status_buf_offset

				< indicate->status_buflen) {

			netdev_err(net, "invalid rndis_indicate_status packet\n");

			return;

drivers/net/hyperv/rndis_filter.c

+1 −1
Original line number Diff line number Diff line
@@ -620,7 +620,7 @@ int rndis_filter_receive(struct net_device *ndev, 


	case RNDIS_MSG_INDICATE:

		/* notification msgs */

		netvsc_linkstatus_callback(ndev, rndis_msg, data);

		netvsc_linkstatus_callback(ndev, rndis_msg, data, buflen);

		break;

	default:

		netdev_err(ndev,