Commit b92946e2 authored by Jason Wang's avatar Jason Wang Committed by Michael S. Tsirkin
Browse files

macvtap: zerocopy: validate vectors before building skb 



There're several reasons that the vectors need to be validated:

- Return error when caller provides vectors whose num is greater than UIO_MAXIOV.
- Linearize part of skb when userspace provides vectors grater than MAX_SKB_FRAGS.
- Return error when userspace provides vectors whose total length may exceed
- MAX_SKB_FRAGS * PAGE_SIZE.

Signed-off-by: default avatarJason Wang <jasowang@redhat.com>
Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
parent 01d6657b

drivers/net/macvtap.c

+21 −4
Original line number Diff line number Diff line
@@ -529,9 +529,10 @@ static int zerocopy_sg_from_iovec(struct sk_buff *skb, const struct iovec *from, 
		}

		base = (unsigned long)from->iov_base + offset;

		size = ((base & ~PAGE_MASK) + len + ~PAGE_MASK) >> PAGE_SHIFT;

		if (i + size > MAX_SKB_FRAGS)

			return -EMSGSIZE;

		num_pages = get_user_pages_fast(base, size, 0, &page[i]);

		if ((num_pages != size) ||

		    (num_pages > MAX_SKB_FRAGS - skb_shinfo(skb)->nr_frags)) {

		if (num_pages != size) {

			for (i = 0; i < num_pages; i++)

				put_page(page[i]);

			return -EFAULT;
@@ -651,7 +652,7 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m, 
	int err;

	struct virtio_net_hdr vnet_hdr = { 0 };

	int vnet_hdr_len = 0;

	int copylen;

	int copylen = 0;

	bool zerocopy = false;



	if (q->flags & IFF_VNET_HDR) {
@@ -680,14 +681,30 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m, 
	if (unlikely(len < ETH_HLEN))

		goto err;



	err = -EMSGSIZE;

	if (unlikely(count > UIO_MAXIOV))

		goto err;



	if (m && m->msg_control && sock_flag(&q->sk, SOCK_ZEROCOPY))

		zerocopy = true;



	if (zerocopy) {

		/* Userspace may produce vectors with count greater than

		 * MAX_SKB_FRAGS, so we need to linearize parts of the skb

		 * to let the rest of data to be fit in the frags.

		 */

		if (count > MAX_SKB_FRAGS) {

			copylen = iov_length(iv, count - MAX_SKB_FRAGS);

			if (copylen < vnet_hdr_len)

				copylen = 0;

			else

				copylen -= vnet_hdr_len;

		}

		/* There are 256 bytes to be copied in skb, so there is enough

		 * room for skb expand head in case it is used.

		 * The rest buffer is mapped from userspace.

		 */

		if (copylen < vnet_hdr.hdr_len)

			copylen = vnet_hdr.hdr_len;

		if (!copylen)

			copylen = GOODCOPY_LEN;

CRA Git | Maintained and supported by SUSTech CRA and CCSE