* [PATCH] hv_netvsc: Validate number of allocated sub-channels
@ 2020-11-18 15:33 Andrea Parri (Microsoft)
2020-11-18 20:57 ` Haiyang Zhang
` (2 more replies)
0 siblings, 3 replies; 5+ messages in thread
From: Andrea Parri (Microsoft) @ 2020-11-18 15:33 UTC (permalink / raw)
To: linux-kernel
Cc: K . Y . Srinivasan, Haiyang Zhang, Stephen Hemminger, Wei Liu,
linux-hyperv, Michael Kelley, Juan Vazquez, Saruhan Karademir,
Andrea Parri (Microsoft),
David S. Miller, Jakub Kicinski, netdev
Lack of validation could lead to out-of-bound reads and information
leaks (cf. usage of nvdev->chan_table[]). Check that the number of
allocated sub-channels fits into the expected range.
Suggested-by: Saruhan Karademir <skarade@microsoft.com>
Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: netdev@vger.kernel.org
---
Based on hyperv-next.
drivers/net/hyperv/rndis_filter.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c
index 3835d9bea1005..c5a709f67870f 100644
--- a/drivers/net/hyperv/rndis_filter.c
+++ b/drivers/net/hyperv/rndis_filter.c
@@ -1226,6 +1226,11 @@ int rndis_set_subchannel(struct net_device *ndev,
return -EIO;
}
+ /* Check that number of allocated sub channel is within the expected range */
+ if (init_packet->msg.v5_msg.subchn_comp.num_subchannels > nvdev->num_chn - 1) {
+ netdev_err(ndev, "invalid number of allocated sub channel\n");
+ return -EINVAL;
+ }
nvdev->num_chn = 1 +
init_packet->msg.v5_msg.subchn_comp.num_subchannels;
--
2.25.1
^ permalink raw reply related [flat|nested] 5+ messages in thread* RE: [PATCH] hv_netvsc: Validate number of allocated sub-channels
2020-11-18 15:33 [PATCH] hv_netvsc: Validate number of allocated sub-channels Andrea Parri (Microsoft)
@ 2020-11-18 20:57 ` Haiyang Zhang
2020-11-19 1:37 ` Jakub Kicinski
2020-12-13 21:31 ` Michael Kelley
2 siblings, 0 replies; 5+ messages in thread
From: Haiyang Zhang @ 2020-11-18 20:57 UTC (permalink / raw)
To: Andrea Parri (Microsoft), linux-kernel
Cc: KY Srinivasan, Stephen Hemminger, Wei Liu, linux-hyperv,
Michael Kelley, Juan Vazquez, Saruhan Karademir, David S. Miller,
Jakub Kicinski, netdev
> -----Original Message-----
> From: Andrea Parri (Microsoft) <parri.andrea@gmail.com>
> Sent: Wednesday, November 18, 2020 10:33 AM
> To: linux-kernel@vger.kernel.org
> Cc: KY Srinivasan <kys@microsoft.com>; Haiyang Zhang
> <haiyangz@microsoft.com>; Stephen Hemminger
> <sthemmin@microsoft.com>; Wei Liu <wei.liu@kernel.org>; linux-
> hyperv@vger.kernel.org; Michael Kelley <mikelley@microsoft.com>; Juan
> Vazquez <juvazq@microsoft.com>; Saruhan Karademir
> <skarade@microsoft.com>; Andrea Parri (Microsoft)
> <parri.andrea@gmail.com>; David S. Miller <davem@davemloft.net>; Jakub
> Kicinski <kuba@kernel.org>; netdev@vger.kernel.org
> Subject: [PATCH] hv_netvsc: Validate number of allocated sub-channels
>
> Lack of validation could lead to out-of-bound reads and information leaks (cf.
> usage of nvdev->chan_table[]). Check that the number of allocated sub-
> channels fits into the expected range.
>
> Suggested-by: Saruhan Karademir <skarade@microsoft.com>
> Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com>
> Cc: "David S. Miller" <davem@davemloft.net>
> Cc: Jakub Kicinski <kuba@kernel.org>
> Cc: netdev@vger.kernel.org
> ---
> Based on hyperv-next.
>
> drivers/net/hyperv/rndis_filter.c | 5 +++++
> 1 file changed, 5 insertions(+)
>
> diff --git a/drivers/net/hyperv/rndis_filter.c
> b/drivers/net/hyperv/rndis_filter.c
> index 3835d9bea1005..c5a709f67870f 100644
> --- a/drivers/net/hyperv/rndis_filter.c
> +++ b/drivers/net/hyperv/rndis_filter.c
> @@ -1226,6 +1226,11 @@ int rndis_set_subchannel(struct net_device *ndev,
> return -EIO;
> }
>
> + /* Check that number of allocated sub channel is within the expected
> range */
> + if (init_packet->msg.v5_msg.subchn_comp.num_subchannels >
> nvdev->num_chn - 1) {
> + netdev_err(ndev, "invalid number of allocated sub
> channel\n");
> + return -EINVAL;
> + }
> nvdev->num_chn = 1 +
> init_packet->msg.v5_msg.subchn_comp.num_subchannels;
Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com>
Thank you.
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] hv_netvsc: Validate number of allocated sub-channels
2020-11-18 15:33 [PATCH] hv_netvsc: Validate number of allocated sub-channels Andrea Parri (Microsoft)
2020-11-18 20:57 ` Haiyang Zhang
@ 2020-11-19 1:37 ` Jakub Kicinski
2020-11-24 16:22 ` Wei Liu
2020-12-13 21:31 ` Michael Kelley
2 siblings, 1 reply; 5+ messages in thread
From: Jakub Kicinski @ 2020-11-19 1:37 UTC (permalink / raw)
To: Andrea Parri (Microsoft)
Cc: linux-kernel, K . Y . Srinivasan, Haiyang Zhang,
Stephen Hemminger, Wei Liu, linux-hyperv, Michael Kelley,
Juan Vazquez, Saruhan Karademir, David S. Miller, netdev
On Wed, 18 Nov 2020 16:33:10 +0100 Andrea Parri (Microsoft) wrote:
> Lack of validation could lead to out-of-bound reads and information
> leaks (cf. usage of nvdev->chan_table[]). Check that the number of
> allocated sub-channels fits into the expected range.
>
> Suggested-by: Saruhan Karademir <skarade@microsoft.com>
> Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com>
> Cc: "David S. Miller" <davem@davemloft.net>
> Cc: Jakub Kicinski <kuba@kernel.org>
> Cc: netdev@vger.kernel.org
Acked-by: Jakub Kicinski <kuba@kernel.org>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] hv_netvsc: Validate number of allocated sub-channels
2020-11-19 1:37 ` Jakub Kicinski
@ 2020-11-24 16:22 ` Wei Liu
0 siblings, 0 replies; 5+ messages in thread
From: Wei Liu @ 2020-11-24 16:22 UTC (permalink / raw)
To: Jakub Kicinski
Cc: Andrea Parri (Microsoft),
linux-kernel, K . Y . Srinivasan, Haiyang Zhang,
Stephen Hemminger, Wei Liu, linux-hyperv, Michael Kelley,
Juan Vazquez, Saruhan Karademir, David S. Miller, netdev
On Wed, Nov 18, 2020 at 05:37:15PM -0800, Jakub Kicinski wrote:
> On Wed, 18 Nov 2020 16:33:10 +0100 Andrea Parri (Microsoft) wrote:
> > Lack of validation could lead to out-of-bound reads and information
> > leaks (cf. usage of nvdev->chan_table[]). Check that the number of
> > allocated sub-channels fits into the expected range.
> >
> > Suggested-by: Saruhan Karademir <skarade@microsoft.com>
> > Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com>
> > Cc: "David S. Miller" <davem@davemloft.net>
> > Cc: Jakub Kicinski <kuba@kernel.org>
> > Cc: netdev@vger.kernel.org
>
> Acked-by: Jakub Kicinski <kuba@kernel.org>
Applied to hyperv-next.
^ permalink raw reply [flat|nested] 5+ messages in thread
* RE: [PATCH] hv_netvsc: Validate number of allocated sub-channels
2020-11-18 15:33 [PATCH] hv_netvsc: Validate number of allocated sub-channels Andrea Parri (Microsoft)
2020-11-18 20:57 ` Haiyang Zhang
2020-11-19 1:37 ` Jakub Kicinski
@ 2020-12-13 21:31 ` Michael Kelley
2 siblings, 0 replies; 5+ messages in thread
From: Michael Kelley @ 2020-12-13 21:31 UTC (permalink / raw)
To: Andrea Parri (Microsoft), linux-kernel
Cc: KY Srinivasan, Haiyang Zhang, Stephen Hemminger, Wei Liu,
linux-hyperv, Juan Vazquez, Saruhan Karademir, David S. Miller,
Jakub Kicinski, netdev
From: Andrea Parri (Microsoft) <parri.andrea@gmail.com> Sent: Wednesday, November 18, 2020 7:33 AM
>
> Lack of validation could lead to out-of-bound reads and information
> leaks (cf. usage of nvdev->chan_table[]). Check that the number of
> allocated sub-channels fits into the expected range.
>
> Suggested-by: Saruhan Karademir <skarade@microsoft.com>
> Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com>
> Cc: "David S. Miller" <davem@davemloft.net>
> Cc: Jakub Kicinski <kuba@kernel.org>
> Cc: netdev@vger.kernel.org
> ---
> Based on hyperv-next.
>
> drivers/net/hyperv/rndis_filter.c | 5 +++++
> 1 file changed, 5 insertions(+)
>
> diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c
> index 3835d9bea1005..c5a709f67870f 100644
> --- a/drivers/net/hyperv/rndis_filter.c
> +++ b/drivers/net/hyperv/rndis_filter.c
> @@ -1226,6 +1226,11 @@ int rndis_set_subchannel(struct net_device *ndev,
> return -EIO;
> }
>
> + /* Check that number of allocated sub channel is within the expected range */
> + if (init_packet->msg.v5_msg.subchn_comp.num_subchannels > nvdev->num_chn - 1) {
> + netdev_err(ndev, "invalid number of allocated sub channel\n");
> + return -EINVAL;
> + }
> nvdev->num_chn = 1 +
> init_packet->msg.v5_msg.subchn_comp.num_subchannels;
>
> --
> 2.25.1
Reviewed-by: Michael Kelley <mikelley@microsoft.com>
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2020-12-13 21:32 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-11-18 15:33 [PATCH] hv_netvsc: Validate number of allocated sub-channels Andrea Parri (Microsoft)
2020-11-18 20:57 ` Haiyang Zhang
2020-11-19 1:37 ` Jakub Kicinski
2020-11-24 16:22 ` Wei Liu
2020-12-13 21:31 ` Michael Kelley
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).