Skip to content
Commit 3946688e authored by Andrea Parri (Microsoft)'s avatar Andrea Parri (Microsoft) Committed by David S. Miller
Browse files

hv_netvsc: Fix validation in netvsc_linkstatus_callback()



Contrary to the RNDIS protocol specification, certain (pre-Fe)
implementations of Hyper-V's vSwitch did not account for the status
buffer field in the length of an RNDIS packet; the bug was fixed in
newer implementations.  Validate the status buffer fields using the
length of the 'vmtransfer_page' packet (all implementations), that
is known/validated to be less than or equal to the receive section
size and not smaller than the length of the RNDIS message.

Reported-by: default avatarDexuan Cui <decui@microsoft.com>
Suggested-by: default avatarHaiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: default avatarAndrea Parri (Microsoft) <parri.andrea@gmail.com>
Fixes: 505e3f00

 ("hv_netvsc: Add (more) validation for untrusted Hyper-V values")
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 9200f515
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment