Messages in this thread | | | From | Haiyang Zhang <> | Subject | RE: [PATCH v3] hv_netvsc: Add validation for untrusted Hyper-V values | Date | Wed, 16 Sep 2020 22:31:38 +0000 |
| |
> -----Original Message----- > From: Andrea Parri (Microsoft) <parri.andrea@gmail.com> > Sent: Wednesday, September 16, 2020 5:47 AM > To: linux-kernel@vger.kernel.org > Cc: KY Srinivasan <kys@microsoft.com>; Haiyang Zhang > <haiyangz@microsoft.com>; Stephen Hemminger > <sthemmin@microsoft.com>; Wei Liu <wei.liu@kernel.org>; linux- > hyperv@vger.kernel.org; Andres Beltran <lkmlabelt@gmail.com>; Michael > Kelley <mikelley@microsoft.com>; Saruhan Karademir > <skarade@microsoft.com>; Juan Vazquez <juvazq@microsoft.com>; Andrea > Parri <parri.andrea@gmail.com>; David S. Miller <davem@davemloft.net>; > Jakub Kicinski <kuba@kernel.org>; netdev@vger.kernel.org > Subject: [PATCH v3] hv_netvsc: Add validation for untrusted Hyper-V values > > From: Andres Beltran <lkmlabelt@gmail.com> > > For additional robustness in the face of Hyper-V errors or malicious > behavior, validate all values that originate from packets that Hyper-V > has sent to the guest in the host-to-guest ring buffer. Ensure that > invalid values cannot cause indexing off the end of an array, or > subvert an existing validation via integer overflow. Ensure that > outgoing packets do not have any leftover guest memory that has not > been zeroed out. > > Signed-off-by: Andres Beltran <lkmlabelt@gmail.com> > Co-developed-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com> > Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com> > Cc: "David S. Miller" <davem@davemloft.net> > Cc: Jakub Kicinski <kuba@kernel.org> > Cc: netdev@vger.kernel.org > --- > Changes in v3: > - Include header size in the estimate for hv_pkt_datalen (Haiyang) > Changes in v2: > - Replace size check on struct nvsp_message with sub-checks (Haiyang) > > drivers/net/hyperv/hyperv_net.h | 4 + > drivers/net/hyperv/netvsc.c | 124 ++++++++++++++++++++++++++---- > drivers/net/hyperv/netvsc_drv.c | 7 ++ > drivers/net/hyperv/rndis_filter.c | 73 ++++++++++++++++-- > 4 files changed, 188 insertions(+), 20 deletions(-)
Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com>
| |