From: Haiyang Zhang <haiyangz@microsoft.com>
To: Andres Beltran <lkmlabelt@gmail.com>,
KY Srinivasan <kys@microsoft.com>,
Stephen Hemminger <sthemmin@microsoft.com>,
"wei.liu@kernel.org" <wei.liu@kernel.org>
Cc: "linux-hyperv@vger.kernel.org" <linux-hyperv@vger.kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
Michael Kelley <mikelley@microsoft.com>,
"parri.andrea@gmail.com" <parri.andrea@gmail.com>,
Saruhan Karademir <skarade@microsoft.com>,
"David S . Miller" <davem@davemloft.net>,
Jakub Kicinski <kuba@kernel.org>,
"netdev@vger.kernel.org" <netdev@vger.kernel.org>
Subject: RE: [PATCH] hv_netvsc: Add validation for untrusted Hyper-V values
Date: Sun, 2 Aug 2020 22:26:04 +0000 [thread overview]
Message-ID: <BL0PR2101MB0930BC0130F6AE5775E62604CA4C0@BL0PR2101MB0930.namprd21.prod.outlook.com> (raw)
In-Reply-To: <20200728225321.26570-1-lkmlabelt@gmail.com>
> -----Original Message-----
> From: Andres Beltran <lkmlabelt@gmail.com>
> Sent: Tuesday, July 28, 2020 6:53 PM
> To: KY Srinivasan <kys@microsoft.com>; Haiyang Zhang
> <haiyangz@microsoft.com>; Stephen Hemminger <sthemmin@microsoft.com>;
> wei.liu@kernel.org
> Cc: linux-hyperv@vger.kernel.org; linux-kernel@vger.kernel.org; Michael
> Kelley <mikelley@microsoft.com>; parri.andrea@gmail.com; Saruhan
> Karademir <skarade@microsoft.com>; Andres Beltran <lkmlabelt@gmail.com>;
> David S . Miller <davem@davemloft.net>; Jakub Kicinski <kuba@kernel.org>;
> netdev@vger.kernel.org
> Subject: [PATCH] hv_netvsc: Add validation for untrusted Hyper-V values
>
> For additional robustness in the face of Hyper-V errors or malicious
> behavior, validate all values that originate from packets that Hyper-V
> has sent to the guest in the host-to-guest ring buffer. Ensure that
> invalid values cannot cause indexing off the end of an array, or
> subvert an existing validation via integer overflow. Ensure that
> outgoing packets do not have any leftover guest memory that has not
> been zeroed out.
>
> Cc: David S. Miller <davem@davemloft.net>
> Cc: Jakub Kicinski <kuba@kernel.org>
> Cc: netdev@vger.kernel.org
> Signed-off-by: Andres Beltran <lkmlabelt@gmail.com>
> ---
> drivers/net/hyperv/hyperv_net.h | 4 ++
> drivers/net/hyperv/netvsc.c | 99 +++++++++++++++++++++++++++----
> drivers/net/hyperv/netvsc_drv.c | 7 +++
> drivers/net/hyperv/rndis_filter.c | 73 ++++++++++++++++++++---
> 4 files changed, 163 insertions(+), 20 deletions(-)
>
> diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h
> index f43b614f2345..7df5943fa46f 100644
> --- a/drivers/net/hyperv/hyperv_net.h
> +++ b/drivers/net/hyperv/hyperv_net.h
> @@ -860,6 +860,10 @@ static inline u32 netvsc_rqstor_size(unsigned long
> ringbytes)
> ringbytes / NETVSC_MIN_IN_MSG_SIZE;
> }
>
> +#define NETVSC_XFER_HEADER_SIZE(rng_cnt) \
> + (offsetof(struct vmtransfer_page_packet_header, ranges) + \
> + (rng_cnt) * sizeof(struct vmtransfer_page_range))
> +
> struct multi_send_data {
> struct sk_buff *skb; /* skb containing the pkt */
> struct hv_netvsc_packet *pkt; /* netvsc pkt pending */
> diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
> index 79b907a29433..7aa5276a1f36 100644
> --- a/drivers/net/hyperv/netvsc.c
> +++ b/drivers/net/hyperv/netvsc.c
> @@ -398,6 +398,15 @@ static int netvsc_init_buf(struct hv_device *device,
> net_device->recv_section_size = resp->sections[0].sub_alloc_size;
> net_device->recv_section_cnt = resp->sections[0].num_sub_allocs;
>
> + /* Ensure buffer will not overflow */
> + if (net_device->recv_section_size < NETVSC_MTU_MIN ||
> (u64)net_device->recv_section_size *
> + (u64)net_device->recv_section_cnt > (u64)buf_size) {
> + netdev_err(ndev, "invalid recv_section_size %u\n",
> + net_device->recv_section_size);
> + ret = -EINVAL;
> + goto cleanup;
> + }
> +
> /* Setup receive completion ring.
> * Add 1 to the recv_section_cnt because at least one entry in a
> * ring buffer has to be empty.
> @@ -479,6 +488,12 @@ static int netvsc_init_buf(struct hv_device *device,
> /* Parse the response */
> net_device->send_section_size = init_packet->msg.
> v1_msg.send_send_buf_complete.section_size;
> + if (net_device->send_section_size < NETVSC_MTU_MIN) {
> + netdev_err(ndev, "invalid send_section_size %u\n",
> + net_device->send_section_size);
> + ret = -EINVAL;
> + goto cleanup;
> + }
>
> /* Section count is simply the size divided by the section size. */
> net_device->send_section_cnt = buf_size / net_device-
> >send_section_size;
> @@ -770,12 +785,24 @@ static void netvsc_send_completion(struct
> net_device *ndev,
> int budget)
> {
> const struct nvsp_message *nvsp_packet = hv_pkt_data(desc);
> + u32 msglen = hv_pkt_datalen(desc);
> +
> + /* Ensure packet is big enough to read header fields */
> + if (msglen < sizeof(struct nvsp_message_header)) {
> + netdev_err(ndev, "nvsp_message length too small: %u\n",
> msglen);
> + return;
> + }
>
> switch (nvsp_packet->hdr.msg_type) {
> case NVSP_MSG_TYPE_INIT_COMPLETE:
> case NVSP_MSG1_TYPE_SEND_RECV_BUF_COMPLETE:
> case NVSP_MSG1_TYPE_SEND_SEND_BUF_COMPLETE:
> case NVSP_MSG5_TYPE_SUBCHANNEL:
> + if (msglen < sizeof(struct nvsp_message)) {
> + netdev_err(ndev, "nvsp_msg5 length too small: %u\n",
> + msglen);
> + return;
> + }
struct nvsp_message includes all message types, so its length is the longest type,
The messages from older host version are not necessarily reaching the
sizeof(struct nvsp_message).
Testing on both new and older hosts are recommended, in case I didn't find out all issues
like this one.
Thanks,
- Haiyang
next prev parent reply other threads:[~2020-08-02 22:26 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-07-28 22:53 [PATCH] hv_netvsc: Add validation for untrusted Hyper-V values Andres Beltran
2020-07-30 23:49 ` David Miller
2020-08-02 22:26 ` Haiyang Zhang [this message]
2020-08-14 10:39 ` Andrea Parri
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=BL0PR2101MB0930BC0130F6AE5775E62604CA4C0@BL0PR2101MB0930.namprd21.prod.outlook.com \
--to=haiyangz@microsoft.com \
--cc=davem@davemloft.net \
--cc=kuba@kernel.org \
--cc=kys@microsoft.com \
--cc=linux-hyperv@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=lkmlabelt@gmail.com \
--cc=mikelley@microsoft.com \
--cc=netdev@vger.kernel.org \
--cc=parri.andrea@gmail.com \
--cc=skarade@microsoft.com \
--cc=sthemmin@microsoft.com \
--cc=wei.liu@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).