Stefano Garzarella
2022-Apr-21 13:50 UTC
[PATCH 1/5] hv_sock: Check hv_pkt_iter_first_raw()'s return value
On Wed, Apr 20, 2022 at 10:07:16PM +0200, Andrea Parri (Microsoft) wrote:>The function returns NULL if the ring buffer doesn't contain enough >readable bytes to constitute a packet descriptor. The ring buffer's >write_index is in memory which is shared with the Hyper-V host, an >erroneous or malicious host could thus change its value and overturn >the result of hvs_stream_has_data(). > >Signed-off-by: Andrea Parri (Microsoft) <parri.andrea at gmail.com> >--- > net/vmw_vsock/hyperv_transport.c | 2 ++ > 1 file changed, 2 insertions(+) > >diff --git a/net/vmw_vsock/hyperv_transport.c b/net/vmw_vsock/hyperv_transport.c >index e111e13b66604..943352530936e 100644 >--- a/net/vmw_vsock/hyperv_transport.c >+++ b/net/vmw_vsock/hyperv_transport.c >@@ -603,6 +603,8 @@ static ssize_t hvs_stream_dequeue(struct vsock_sock *vsk, struct msghdr *msg, > > if (need_refill) { > hvs->recv_desc = hv_pkt_iter_first_raw(hvs->chan); >+ if (!hvs->recv_desc) >+ return -ENOBUFS; > ret = hvs_update_recv_data(hvs); > if (ret) > return ret; >-- >2.25.1 >Reviewed-by: Stefano Garzarella <sgarzare at redhat.com>