• Vitaly Kuznetsov's avatar
    Drivers: hv: check VMBus messages lengths · 52c7803f
    Vitaly Kuznetsov authored
    VMBus message handlers (channel_message_table) receive a pointer to
    'struct vmbus_channel_message_header' and cast it to a structure of their
    choice, which is sometimes longer than the header. We, however, don't check
    that the message is long enough so in case hypervisor screws up we'll be
    accessing memory beyond what was allocated for temporary buffer.
    
    Previously, we used to always allocate and copy 256 bytes from message page
    to temporary buffer but this is hardly better: in case the message is
    shorter than we expect we'll be trying to consume garbage as some real
    data and no memory guarding technique will be able to identify an issue.
    
    Introduce 'min_payload_len' to 'struct vmbus_channel_message_table_entry'
    and check against it in vmbus_on_msg_dpc(). Note, we can't require the
    exact length as new hypervisor versions may add extra fields to messages,
    we only check that the message is not shorter than we expect.
    Signed-off-by: default avatarVitaly Kuznetsov <vkuznets@redhat.com>
    Reviewed-by: default avatarMichael Kelley <mikelley@microsoft.com>
    Link: https://lore.kernel.org/r/20200406104326.45361-1-vkuznets@redhat.comSigned-off-by: default avatarWei Liu <wei.liu@kernel.org>
    52c7803f
hyperv_vmbus.h 11 KB