Messages in this thread | | | From | Haiyang Zhang <> | Subject | RE: [PATCH] hv_netvsc: Validate number of allocated sub-channels | Date | Wed, 18 Nov 2020 20:57:31 +0000 |
| |
> -----Original Message----- > From: Andrea Parri (Microsoft) <parri.andrea@gmail.com> > Sent: Wednesday, November 18, 2020 10:33 AM > To: linux-kernel@vger.kernel.org > Cc: KY Srinivasan <kys@microsoft.com>; Haiyang Zhang > <haiyangz@microsoft.com>; Stephen Hemminger > <sthemmin@microsoft.com>; Wei Liu <wei.liu@kernel.org>; linux- > hyperv@vger.kernel.org; Michael Kelley <mikelley@microsoft.com>; Juan > Vazquez <juvazq@microsoft.com>; Saruhan Karademir > <skarade@microsoft.com>; Andrea Parri (Microsoft) > <parri.andrea@gmail.com>; David S. Miller <davem@davemloft.net>; Jakub > Kicinski <kuba@kernel.org>; netdev@vger.kernel.org > Subject: [PATCH] hv_netvsc: Validate number of allocated sub-channels > > Lack of validation could lead to out-of-bound reads and information leaks (cf. > usage of nvdev->chan_table[]). Check that the number of allocated sub- > channels fits into the expected range. > > Suggested-by: Saruhan Karademir <skarade@microsoft.com> > Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com> > Cc: "David S. Miller" <davem@davemloft.net> > Cc: Jakub Kicinski <kuba@kernel.org> > Cc: netdev@vger.kernel.org > --- > Based on hyperv-next. > > drivers/net/hyperv/rndis_filter.c | 5 +++++ > 1 file changed, 5 insertions(+) > > diff --git a/drivers/net/hyperv/rndis_filter.c > b/drivers/net/hyperv/rndis_filter.c > index 3835d9bea1005..c5a709f67870f 100644 > --- a/drivers/net/hyperv/rndis_filter.c > +++ b/drivers/net/hyperv/rndis_filter.c > @@ -1226,6 +1226,11 @@ int rndis_set_subchannel(struct net_device *ndev, > return -EIO; > } > > + /* Check that number of allocated sub channel is within the expected > range */ > + if (init_packet->msg.v5_msg.subchn_comp.num_subchannels > > nvdev->num_chn - 1) { > + netdev_err(ndev, "invalid number of allocated sub > channel\n"); > + return -EINVAL; > + } > nvdev->num_chn = 1 + > init_packet->msg.v5_msg.subchn_comp.num_subchannels;
Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com> Thank you.
| |