Commit dbde6d0c authored by Andrea Parri (Microsoft)'s avatar Andrea Parri (Microsoft) Committed by Wei Liu
Browse files

hv_sock: Add validation for untrusted Hyper-V values 



For additional robustness in the face of Hyper-V errors or malicious
behavior, validate all values that originate from packets that Hyper-V
has sent to the guest in the host-to-guest ring buffer.  Ensure that
invalid values cannot cause data being copied out of the bounds of the
source buffer in hvs_stream_dequeue().

Signed-off-by: default avatarAndrea Parri (Microsoft) <parri.andrea@gmail.com>
Reviewed-by: default avatarMichael Kelley <mikelley@microsoft.com>
Reviewed-by: default avatarStefano Garzarella <sgarzare@redhat.com>
Link: https://lore.kernel.org/r/20220428145107.7878-4-parri.andrea@gmail.com


Signed-off-by: default avatarWei Liu <wei.liu@kernel.org>
parent 066f3377

include/linux/hyperv.h

+5 −0
Original line number Diff line number Diff line
@@ -1696,6 +1696,11 @@ static inline u32 hv_pkt_datalen(const struct vmpacket_descriptor *desc) 
	return (desc->len8 << 3) - (desc->offset8 << 3);

}



/* Get packet length associated with descriptor */

static inline u32 hv_pkt_len(const struct vmpacket_descriptor *desc)

{

	return desc->len8 << 3;

}



struct vmpacket_descriptor *

hv_pkt_iter_first_raw(struct vmbus_channel *channel);

net/vmw_vsock/hyperv_transport.c

+8 −2
Original line number Diff line number Diff line
@@ -577,12 +577,18 @@ static bool hvs_dgram_allow(u32 cid, u32 port) 
static int hvs_update_recv_data(struct hvsock *hvs)

{

	struct hvs_recv_buf *recv_buf;

	u32 payload_len;

	u32 pkt_len, payload_len;



	pkt_len = hv_pkt_len(hvs->recv_desc);



	if (pkt_len < HVS_HEADER_LEN)

		return -EIO;



	recv_buf = (struct hvs_recv_buf *)(hvs->recv_desc + 1);

	payload_len = recv_buf->hdr.data_size;



	if (payload_len > HVS_MTU_SIZE)

	if (payload_len > pkt_len - HVS_HEADER_LEN ||

	    payload_len > HVS_MTU_SIZE)

		return -EIO;



	if (payload_len == 0)