diff options
| author |   Andrea Parri (Microsoft) <parri.andrea@gmail.com> | 2021-02-03 12:35:12 +0100 |
|---|---|---|
| committer |   Jakub Kicinski <kuba@kernel.org> | 2021-02-04 20:37:04 -0800 |
| commit | 0102eeedb71757d6589144cf019424f69b3ab289 (patch) | |
| tree | e23732006cef5b76202b670aaf5887b0b9a29e71 /drivers/net/ethernet/intel/ice/ice_fw_update.c | |
| parent | Merge branch 'r8152-adjust-flow-for-power-cut' (diff) | |
| download | linux-dev-0102eeedb71757d6589144cf019424f69b3ab289.tar.xz linux-dev-0102eeedb71757d6589144cf019424f69b3ab289.zip | |
hv_netvsc: Allocate the recv_buf buffers after NVSP_MSG1_TYPE_SEND_RECV_BUF
The recv_buf buffers are allocated in netvsc_device_add(). Later in
netvsc_init_buf() the response to NVSP_MSG1_TYPE_SEND_RECV_BUF allows
the host to set up a recv_section_size that could be bigger than the
(default) value used for that allocation. The host-controlled value
could be used by a malicious host to bypass the check on the packet's
length in netvsc_receive() and hence to overflow the recv_buf buffer.
Move the allocation of the recv_buf buffers into netvsc_init_but().
Reported-by: Juan Vazquez <juvazq@microsoft.com>
Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com>
Fixes: 0ba35fe91ce34f ("hv_netvsc: Copy packets sent by Hyper-V out of the receive buffer")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'drivers/net/ethernet/intel/ice/ice_fw_update.c')
0 files changed, 0 insertions, 0 deletions