diff options
| author | Andrea Parri (Microsoft) <parri.andrea@gmail.com> | 2021-03-01 19:25:30 +0100 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2021-03-02 00:30:52 +0100 |
| commit | 3946688edbc5b629110c339b3babf10aa9e7adad (patch) | |
| tree | b72e021c1b857c4407f941010280e78d6296b573 /drivers/net/hyperv/hyperv_net.h | |
| parent | net: dsa: tag_mtk: fix 802.1ad VLAN egress (diff) | |
| download | linux-3946688edbc5b629110c339b3babf10aa9e7adad.tar.xz linux-3946688edbc5b629110c339b3babf10aa9e7adad.zip | |
hv_netvsc: Fix validation in netvsc_linkstatus_callback()
Contrary to the RNDIS protocol specification, certain (pre-Fe)
implementations of Hyper-V's vSwitch did not account for the status
buffer field in the length of an RNDIS packet; the bug was fixed in
newer implementations. Validate the status buffer fields using the
length of the 'vmtransfer_page' packet (all implementations), that
is known/validated to be less than or equal to the receive section
size and not smaller than the length of the RNDIS message.
Reported-by: Dexuan Cui <decui@microsoft.com>
Suggested-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com>
Fixes: 505e3f00c3f36 ("hv_netvsc: Add (more) validation for untrusted Hyper-V values")
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/hyperv/hyperv_net.h')
| -rw-r--r-- | drivers/net/hyperv/hyperv_net.h | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h index e1a497d3c9ba..59ac04a610ad 100644 --- a/drivers/net/hyperv/hyperv_net.h +++ b/drivers/net/hyperv/hyperv_net.h @@ -229,7 +229,7 @@ int netvsc_send(struct net_device *net, bool xdp_tx); void netvsc_linkstatus_callback(struct net_device *net, struct rndis_message *resp, - void *data); + void *data, u32 data_buflen); int netvsc_recv_callback(struct net_device *net, struct netvsc_device *nvdev, struct netvsc_channel *nvchan); |