lkml.org 
[lkml]   [2022]   [Apr]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    SubjectRE: [PATCH 1/5] hv_sock: Check hv_pkt_iter_first_raw()'s return value
    Date
    From: Andrea Parri (Microsoft) <parri.andrea@gmail.com> Sent: Wednesday, April 20, 2022 1:07 PM
    >
    > The function returns NULL if the ring buffer doesn't contain enough
    > readable bytes to constitute a packet descriptor. The ring buffer's
    > write_index is in memory which is shared with the Hyper-V host, an
    > erroneous or malicious host could thus change its value and overturn
    > the result of hvs_stream_has_data().
    >
    > Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com>
    > ---
    > net/vmw_vsock/hyperv_transport.c | 2 ++
    > 1 file changed, 2 insertions(+)
    >
    > diff --git a/net/vmw_vsock/hyperv_transport.c b/net/vmw_vsock/hyperv_transport.c
    > index e111e13b66604..943352530936e 100644
    > --- a/net/vmw_vsock/hyperv_transport.c
    > +++ b/net/vmw_vsock/hyperv_transport.c
    > @@ -603,6 +603,8 @@ static ssize_t hvs_stream_dequeue(struct vsock_sock *vsk,
    > struct msghdr *msg,
    >
    > if (need_refill) {
    > hvs->recv_desc = hv_pkt_iter_first_raw(hvs->chan);
    > + if (!hvs->recv_desc)
    > + return -ENOBUFS;
    > ret = hvs_update_recv_data(hvs);
    > if (ret)
    > return ret;
    > --
    > 2.25.1

    Reviewed-by: Michael Kelley <mikelley@microsoft.com>

    \
     
     \ /
      Last update: 2022-04-21 01:08    [W:2.455 / U:0.112 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site