* [PATCH net-next 0/2] Amend "hv_netvsc: Copy packets sent by Hyper-V out of the receive buffer"
@ 2021-02-03 11:35 Andrea Parri (Microsoft)
2021-02-03 11:35 ` [PATCH net-next 1/2] hv_netvsc: Allocate the recv_buf buffers after NVSP_MSG1_TYPE_SEND_RECV_BUF Andrea Parri (Microsoft)
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Andrea Parri (Microsoft) @ 2021-02-03 11:35 UTC (permalink / raw)
To: linux-kernel
Cc: K . Y . Srinivasan, Haiyang Zhang, Stephen Hemminger, Wei Liu,
Michael Kelley, linux-hyperv, Saruhan Karademir, Juan Vazquez,
Andrea Parri (Microsoft),
David S. Miller, Jakub Kicinski, netdev
Patch #2 also addresses the Smatch complaint reported here:
https://lkml.kernel.org/r/YBp2oVIdMe+G%2FliJ@mwanda/
Thanks,
Andrea
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: netdev@vger.kernel.org
Andrea Parri (Microsoft) (2):
hv_netvsc: Allocate the recv_buf buffers after
NVSP_MSG1_TYPE_SEND_RECV_BUF
hv_netvsc: Load and store the proper (NBL_HASH_INFO) per-packet info
drivers/net/hyperv/netvsc.c | 18 +++++++++++-------
drivers/net/hyperv/rndis_filter.c | 2 +-
2 files changed, 12 insertions(+), 8 deletions(-)
--
2.25.1
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH net-next 1/2] hv_netvsc: Allocate the recv_buf buffers after NVSP_MSG1_TYPE_SEND_RECV_BUF
2021-02-03 11:35 [PATCH net-next 0/2] Amend "hv_netvsc: Copy packets sent by Hyper-V out of the receive buffer" Andrea Parri (Microsoft)
@ 2021-02-03 11:35 ` Andrea Parri (Microsoft)
2021-02-03 11:35 ` [PATCH net-next 2/2] hv_netvsc: Load and store the proper (NBL_HASH_INFO) per-packet info Andrea Parri (Microsoft)
2021-02-05 5:00 ` [PATCH net-next 0/2] Amend "hv_netvsc: Copy packets sent by Hyper-V out of the receive buffer" patchwork-bot+netdevbpf
2 siblings, 0 replies; 4+ messages in thread
From: Andrea Parri (Microsoft) @ 2021-02-03 11:35 UTC (permalink / raw)
To: linux-kernel
Cc: K . Y . Srinivasan, Haiyang Zhang, Stephen Hemminger, Wei Liu,
Michael Kelley, linux-hyperv, Saruhan Karademir, Juan Vazquez,
Andrea Parri (Microsoft),
David S. Miller, Jakub Kicinski, netdev
The recv_buf buffers are allocated in netvsc_device_add(). Later in
netvsc_init_buf() the response to NVSP_MSG1_TYPE_SEND_RECV_BUF allows
the host to set up a recv_section_size that could be bigger than the
(default) value used for that allocation. The host-controlled value
could be used by a malicious host to bypass the check on the packet's
length in netvsc_receive() and hence to overflow the recv_buf buffer.
Move the allocation of the recv_buf buffers into netvsc_init_but().
Reported-by: Juan Vazquez <juvazq@microsoft.com>
Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: netdev@vger.kernel.org
Fixes: 0ba35fe91ce34f ("hv_netvsc: Copy packets sent by Hyper-V out of the receive buffer")
---
drivers/net/hyperv/netvsc.c | 18 +++++++++++-------
1 file changed, 11 insertions(+), 7 deletions(-)
diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
index 0fba8257fc119..9db1ea3affbb3 100644
--- a/drivers/net/hyperv/netvsc.c
+++ b/drivers/net/hyperv/netvsc.c
@@ -311,7 +311,7 @@ static int netvsc_init_buf(struct hv_device *device,
struct nvsp_message *init_packet;
unsigned int buf_size;
size_t map_words;
- int ret = 0;
+ int i, ret = 0;
/* Get receive buffer area. */
buf_size = device_info->recv_sections * device_info->recv_section_size;
@@ -405,6 +405,16 @@ static int netvsc_init_buf(struct hv_device *device,
goto cleanup;
}
+ for (i = 0; i < VRSS_CHANNEL_MAX; i++) {
+ struct netvsc_channel *nvchan = &net_device->chan_table[i];
+
+ nvchan->recv_buf = kzalloc(net_device->recv_section_size, GFP_KERNEL);
+ if (nvchan->recv_buf == NULL) {
+ ret = -ENOMEM;
+ goto cleanup;
+ }
+ }
+
/* Setup receive completion ring.
* Add 1 to the recv_section_cnt because at least one entry in a
* ring buffer has to be empty.
@@ -1549,12 +1559,6 @@ struct netvsc_device *netvsc_device_add(struct hv_device *device,
for (i = 0; i < VRSS_CHANNEL_MAX; i++) {
struct netvsc_channel *nvchan = &net_device->chan_table[i];
- nvchan->recv_buf = kzalloc(device_info->recv_section_size, GFP_KERNEL);
- if (nvchan->recv_buf == NULL) {
- ret = -ENOMEM;
- goto cleanup2;
- }
-
nvchan->channel = device->channel;
nvchan->net_device = net_device;
u64_stats_init(&nvchan->tx_stats.syncp);
--
2.25.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH net-next 2/2] hv_netvsc: Load and store the proper (NBL_HASH_INFO) per-packet info
2021-02-03 11:35 [PATCH net-next 0/2] Amend "hv_netvsc: Copy packets sent by Hyper-V out of the receive buffer" Andrea Parri (Microsoft)
2021-02-03 11:35 ` [PATCH net-next 1/2] hv_netvsc: Allocate the recv_buf buffers after NVSP_MSG1_TYPE_SEND_RECV_BUF Andrea Parri (Microsoft)
@ 2021-02-03 11:35 ` Andrea Parri (Microsoft)
2021-02-05 5:00 ` [PATCH net-next 0/2] Amend "hv_netvsc: Copy packets sent by Hyper-V out of the receive buffer" patchwork-bot+netdevbpf
2 siblings, 0 replies; 4+ messages in thread
From: Andrea Parri (Microsoft) @ 2021-02-03 11:35 UTC (permalink / raw)
To: linux-kernel
Cc: K . Y . Srinivasan, Haiyang Zhang, Stephen Hemminger, Wei Liu,
Michael Kelley, linux-hyperv, Saruhan Karademir, Juan Vazquez,
Andrea Parri (Microsoft),
David S. Miller, Jakub Kicinski, netdev
Fix the typo.
Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: netdev@vger.kernel.org
Fixes: 0ba35fe91ce34f ("hv_netvsc: Copy packets sent by Hyper-V out of the receive buffer")
---
drivers/net/hyperv/rndis_filter.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c
index 6c48a4d627368..0c2ebe7ac6554 100644
--- a/drivers/net/hyperv/rndis_filter.c
+++ b/drivers/net/hyperv/rndis_filter.c
@@ -465,7 +465,7 @@ void rsc_add_data(struct netvsc_channel *nvchan,
}
nvchan->rsc.pktlen = len;
if (hash_info != NULL) {
- nvchan->rsc.csum_info = *csum_info;
+ nvchan->rsc.hash_info = *hash_info;
nvchan->rsc.ppi_flags |= NVSC_RSC_HASH_INFO;
} else {
nvchan->rsc.ppi_flags &= ~NVSC_RSC_HASH_INFO;
--
2.25.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH net-next 0/2] Amend "hv_netvsc: Copy packets sent by Hyper-V out of the receive buffer"
2021-02-03 11:35 [PATCH net-next 0/2] Amend "hv_netvsc: Copy packets sent by Hyper-V out of the receive buffer" Andrea Parri (Microsoft)
2021-02-03 11:35 ` [PATCH net-next 1/2] hv_netvsc: Allocate the recv_buf buffers after NVSP_MSG1_TYPE_SEND_RECV_BUF Andrea Parri (Microsoft)
2021-02-03 11:35 ` [PATCH net-next 2/2] hv_netvsc: Load and store the proper (NBL_HASH_INFO) per-packet info Andrea Parri (Microsoft)
@ 2021-02-05 5:00 ` patchwork-bot+netdevbpf
2 siblings, 0 replies; 4+ messages in thread
From: patchwork-bot+netdevbpf @ 2021-02-05 5:00 UTC (permalink / raw)
To: Andrea Parri
Cc: linux-kernel, kys, haiyangz, sthemmin, wei.liu, mikelley,
linux-hyperv, skarade, juvazq, davem, kuba, netdev
Hello:
This series was applied to netdev/net-next.git (refs/heads/master):
On Wed, 3 Feb 2021 12:35:11 +0100 you wrote:
> Patch #2 also addresses the Smatch complaint reported here:
>
> https://lkml.kernel.org/r/YBp2oVIdMe+G%2FliJ@mwanda/
>
> Thanks,
> Andrea
>
> [...]
Here is the summary with links:
- [net-next,1/2] hv_netvsc: Allocate the recv_buf buffers after NVSP_MSG1_TYPE_SEND_RECV_BUF
https://git.kernel.org/netdev/net-next/c/0102eeedb717
- [net-next,2/2] hv_netvsc: Load and store the proper (NBL_HASH_INFO) per-packet info
https://git.kernel.org/netdev/net-next/c/8dff9808e973
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2021-02-05 5:00 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-02-03 11:35 [PATCH net-next 0/2] Amend "hv_netvsc: Copy packets sent by Hyper-V out of the receive buffer" Andrea Parri (Microsoft)
2021-02-03 11:35 ` [PATCH net-next 1/2] hv_netvsc: Allocate the recv_buf buffers after NVSP_MSG1_TYPE_SEND_RECV_BUF Andrea Parri (Microsoft)
2021-02-03 11:35 ` [PATCH net-next 2/2] hv_netvsc: Load and store the proper (NBL_HASH_INFO) per-packet info Andrea Parri (Microsoft)
2021-02-05 5:00 ` [PATCH net-next 0/2] Amend "hv_netvsc: Copy packets sent by Hyper-V out of the receive buffer" patchwork-bot+netdevbpf
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).