linux-kernel - [PATCH 4/5] rpmsg: validate incoming message length before propagating

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1330449672-18191-6-git-send-email-ohad@wizery.com>
Date:	Tue, 28 Feb 2012 19:21:11 +0200
From:	Ohad Ben-Cohen <ohad@...ery.com>
To:	<linux-kernel@...r.kernel.org>
Cc:	<linux-omap@...r.kernel.org>,
	<linux-arm-kernel@...ts.infradead.org>,
	Ohad Ben-Cohen <ohad@...ery.com>,
	Grant Likely <grant.likely@...retlab.ca>,
	Arnd Bergmann <arnd@...db.de>, Mark Grosen <mgrosen@...com>,
	Suman Anna <s-anna@...com>,
	Fernando Guzman Lugo <fernando.lugo@...com>,
	Rob Clark <rob@...com>,
	Ludovic BARRE <ludovic.barre@...ricsson.com>,
	Loic PALLARDY <loic.pallardy@...ricsson.com>,
	Omar Ramirez Luna <omar.luna@...aro.org>
Subject: [PATCH 4/5] rpmsg: validate incoming message length before propagating

When an inbound message arrives, validate its reported length before
propagating it, otherwise buggy (or malicious) remote processors might
trick us into accessing memory which we really shouldn't.

Signed-off-by: Ohad Ben-Cohen <ohad@...ery.com>
Cc: Grant Likely <grant.likely@...retlab.ca>
Cc: Arnd Bergmann <arnd@...db.de>
Cc: Mark Grosen <mgrosen@...com>
Cc: Suman Anna <s-anna@...com>
Cc: Fernando Guzman Lugo <fernando.lugo@...com>
Cc: Rob Clark <rob@...com>
Cc: Ludovic BARRE <ludovic.barre@...ricsson.com>
Cc: Loic PALLARDY <loic.pallardy@...ricsson.com>
Cc: Omar Ramirez Luna <omar.luna@...aro.org>
---
 drivers/rpmsg/virtio_rpmsg_bus.c |   10 ++++++++++
 1 files changed, 10 insertions(+), 0 deletions(-)

diff --git a/drivers/rpmsg/virtio_rpmsg_bus.c b/drivers/rpmsg/virtio_rpmsg_bus.c
index 4db9cf8..1e8b8b6 100644
--- a/drivers/rpmsg/virtio_rpmsg_bus.c
+++ b/drivers/rpmsg/virtio_rpmsg_bus.c
@@ -778,6 +778,16 @@ static void rpmsg_recv_done(struct virtqueue *rvq)
 	print_hex_dump(KERN_DEBUG, "rpmsg_virtio RX: ", DUMP_PREFIX_NONE, 16, 1,
 					msg, sizeof(*msg) + msg->len, true);
 
+	/*
+	 * We currently use fixed-sized buffers, so trivially sanitize
+	 * the reported payload length.
+	 */
+	if (len > RPMSG_BUF_SIZE ||
+		msg->len > (len - sizeof(struct rpmsg_hdr))) {
+		dev_warn(dev, "inbound msg too big: (%d, %d)\n", len, msg->len);
+		return;
+	}
+
 	/* use the dst addr to fetch the callback of the appropriate user */
 	mutex_lock(&vrp->endpoints_lock);
 	ept = idr_find(&vrp->endpoints, msg->dst);
-- 
1.7.5.4

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/