Commit b92946e2 authored by Jason Wang's avatar Jason Wang Committed by Michael S. Tsirkin

macvtap: zerocopy: validate vectors before building skb

There're several reasons that the vectors need to be validated:

- Return error when caller provides vectors whose num is greater than UIO_MAXIOV.
- Linearize part of skb when userspace provides vectors grater than MAX_SKB_FRAGS.
- Return error when userspace provides vectors whose total length may exceed
- MAX_SKB_FRAGS * PAGE_SIZE.
Signed-off-by: default avatarJason Wang <jasowang@redhat.com>
Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
parent 01d6657b
...@@ -529,9 +529,10 @@ static int zerocopy_sg_from_iovec(struct sk_buff *skb, const struct iovec *from, ...@@ -529,9 +529,10 @@ static int zerocopy_sg_from_iovec(struct sk_buff *skb, const struct iovec *from,
} }
base = (unsigned long)from->iov_base + offset; base = (unsigned long)from->iov_base + offset;
size = ((base & ~PAGE_MASK) + len + ~PAGE_MASK) >> PAGE_SHIFT; size = ((base & ~PAGE_MASK) + len + ~PAGE_MASK) >> PAGE_SHIFT;
if (i + size > MAX_SKB_FRAGS)
return -EMSGSIZE;
num_pages = get_user_pages_fast(base, size, 0, &page[i]); num_pages = get_user_pages_fast(base, size, 0, &page[i]);
if ((num_pages != size) || if (num_pages != size) {
(num_pages > MAX_SKB_FRAGS - skb_shinfo(skb)->nr_frags)) {
for (i = 0; i < num_pages; i++) for (i = 0; i < num_pages; i++)
put_page(page[i]); put_page(page[i]);
return -EFAULT; return -EFAULT;
...@@ -651,7 +652,7 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m, ...@@ -651,7 +652,7 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
int err; int err;
struct virtio_net_hdr vnet_hdr = { 0 }; struct virtio_net_hdr vnet_hdr = { 0 };
int vnet_hdr_len = 0; int vnet_hdr_len = 0;
int copylen; int copylen = 0;
bool zerocopy = false; bool zerocopy = false;
if (q->flags & IFF_VNET_HDR) { if (q->flags & IFF_VNET_HDR) {
...@@ -680,14 +681,30 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m, ...@@ -680,14 +681,30 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
if (unlikely(len < ETH_HLEN)) if (unlikely(len < ETH_HLEN))
goto err; goto err;
err = -EMSGSIZE;
if (unlikely(count > UIO_MAXIOV))
goto err;
if (m && m->msg_control && sock_flag(&q->sk, SOCK_ZEROCOPY)) if (m && m->msg_control && sock_flag(&q->sk, SOCK_ZEROCOPY))
zerocopy = true; zerocopy = true;
if (zerocopy) { if (zerocopy) {
/* Userspace may produce vectors with count greater than
* MAX_SKB_FRAGS, so we need to linearize parts of the skb
* to let the rest of data to be fit in the frags.
*/
if (count > MAX_SKB_FRAGS) {
copylen = iov_length(iv, count - MAX_SKB_FRAGS);
if (copylen < vnet_hdr_len)
copylen = 0;
else
copylen -= vnet_hdr_len;
}
/* There are 256 bytes to be copied in skb, so there is enough /* There are 256 bytes to be copied in skb, so there is enough
* room for skb expand head in case it is used. * room for skb expand head in case it is used.
* The rest buffer is mapped from userspace. * The rest buffer is mapped from userspace.
*/ */
if (copylen < vnet_hdr.hdr_len)
copylen = vnet_hdr.hdr_len; copylen = vnet_hdr.hdr_len;
if (!copylen) if (!copylen)
copylen = GOODCOPY_LEN; copylen = GOODCOPY_LEN;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment