Commit 206ad34d authored Nov 18, 2020 by Andrea Parri (Microsoft) Committed by Wei Liu Nov 24, 2020

hv_netvsc: Validate number of allocated sub-channels



Lack of validation could lead to out-of-bound reads and information
leaks (cf. usage of nvdev->chan_table[]).  Check that the number of
allocated sub-channels fits into the expected range.

Suggested-by: Saruhan Karademir <skarade@microsoft.com>
Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com>
Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com>
Acked-by: Jakub Kicinski <kuba@kernel.org>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: netdev@vger.kernel.org
Link: https://lore.kernel.org/r/20201118153310.112404-1-parri.andrea@gmail.com


Signed-off-by: Wei Liu <wei.liu@kernel.org>

parent 14c685d9

drivers/net/hyperv/rndis_filter.c

+5 −0

Original line number	Diff line number	Diff line
		@@ -1224,6 +1224,11 @@ int rndis_set_subchannel(struct net_device *ndev,
		return -EIO;
		}

		/* Check that number of allocated sub channel is within the expected range */
		if (init_packet->msg.v5_msg.subchn_comp.num_subchannels > nvdev->num_chn - 1) {
		netdev_err(ndev, "invalid number of allocated sub channel\n");
		return -EINVAL;
		}
		nvdev->num_chn = 1 +
		init_packet->msg.v5_msg.subchn_comp.num_subchannels;

Admin message