| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <BL0PR2101MB0930659825AD89FF5A8DC2C4CA270@BL0PR2101MB0930.namprd21.prod.outlook.com>
Date: Thu, 10 Sep 2020 21:10:11 +0000
From: Haiyang Zhang <haiyangz@...rosoft.com>
To: "Andrea Parri (Microsoft)" <parri.andrea@...il.com>,
"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
CC: KY Srinivasan <kys@...rosoft.com>,
Stephen Hemminger <sthemmin@...rosoft.com>,
Wei Liu <wei.liu@...nel.org>,
"linux-hyperv@...r.kernel.org" <linux-hyperv@...r.kernel.org>,
Andres Beltran <lkmlabelt@...il.com>,
Michael Kelley <mikelley@...rosoft.com>,
Saruhan Karademir <skarade@...rosoft.com>,
Juan Vazquez <juvazq@...rosoft.com>,
"David S. Miller" <davem@...emloft.net>,
Jakub Kicinski <kuba@...nel.org>,
"netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: RE: [PATCH v2] hv_netvsc: Add validation for untrusted Hyper-V values
> -----Original Message-----
> From: Andrea Parri (Microsoft) <parri.andrea@...il.com>
> Sent: Thursday, September 10, 2020 8:48 AM
> To: linux-kernel@...r.kernel.org
> Cc: KY Srinivasan <kys@...rosoft.com>; Haiyang Zhang
> <haiyangz@...rosoft.com>; Stephen Hemminger
> <sthemmin@...rosoft.com>; Wei Liu <wei.liu@...nel.org>; linux-
> hyperv@...r.kernel.org; Andres Beltran <lkmlabelt@...il.com>; Michael
> Kelley <mikelley@...rosoft.com>; Saruhan Karademir
> <skarade@...rosoft.com>; Juan Vazquez <juvazq@...rosoft.com>; Andrea
> Parri <parri.andrea@...il.com>; David S. Miller <davem@...emloft.net>;
> Jakub Kicinski <kuba@...nel.org>; netdev@...r.kernel.org
> Subject: [PATCH v2] hv_netvsc: Add validation for untrusted Hyper-V values
>
> From: Andres Beltran <lkmlabelt@...il.com>
>
> For additional robustness in the face of Hyper-V errors or malicious
> behavior, validate all values that originate from packets that Hyper-V
> has sent to the guest in the host-to-guest ring buffer. Ensure that
> invalid values cannot cause indexing off the end of an array, or
> subvert an existing validation via integer overflow. Ensure that
> outgoing packets do not have any leftover guest memory that has not
> been zeroed out.
>
> Signed-off-by: Andres Beltran <lkmlabelt@...il.com>
> Co-developed-by: Andrea Parri (Microsoft) <parri.andrea@...il.com>
> Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@...il.com>
> Cc: "David S. Miller" <davem@...emloft.net>
> Cc: Jakub Kicinski <kuba@...nel.org>
> Cc: netdev@...r.kernel.org
> ---
> Changes in v2:
> - Replace size check on struct nvsp_message with sub-checks (Haiyang)
>
> drivers/net/hyperv/hyperv_net.h | 4 +
> drivers/net/hyperv/netvsc.c | 120 ++++++++++++++++++++++++++----
> drivers/net/hyperv/netvsc_drv.c | 7 ++
> drivers/net/hyperv/rndis_filter.c | 73 ++++++++++++++++--
> 4 files changed, 184 insertions(+), 20 deletions(-)
>
> diff --git a/drivers/net/hyperv/hyperv_net.h
> b/drivers/net/hyperv/hyperv_net.h
> index 4d2b2d48ff2a1..da78bd0fb2aa2 100644
> --- a/drivers/net/hyperv/hyperv_net.h
> +++ b/drivers/net/hyperv/hyperv_net.h
> @@ -860,6 +860,10 @@ static inline u32 netvsc_rqstor_size(unsigned long
> ringbytes)
> ringbytes / NETVSC_MIN_IN_MSG_SIZE;
> }
>
> +#define NETVSC_XFER_HEADER_SIZE(rng_cnt) \
> + (offsetof(struct vmtransfer_page_packet_header, ranges) +
> \
> + (rng_cnt) * sizeof(struct vmtransfer_page_range))
> +
> struct multi_send_data {
> struct sk_buff *skb; /* skb containing the pkt */
> struct hv_netvsc_packet *pkt; /* netvsc pkt pending */
> diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
> index 03e93e3ddbad8..90b7a39c2dc78 100644
> --- a/drivers/net/hyperv/netvsc.c
> +++ b/drivers/net/hyperv/netvsc.c
> @@ -388,6 +388,15 @@ static int netvsc_init_buf(struct hv_device *device,
> net_device->recv_section_size = resp->sections[0].sub_alloc_size;
> net_device->recv_section_cnt = resp->sections[0].num_sub_allocs;
>
> + /* Ensure buffer will not overflow */
> + if (net_device->recv_section_size < NETVSC_MTU_MIN ||
> (u64)net_device->recv_section_size *
> + (u64)net_device->recv_section_cnt > (u64)buf_size) {
> + netdev_err(ndev, "invalid recv_section_size %u\n",
> + net_device->recv_section_size);
> + ret = -EINVAL;
> + goto cleanup;
> + }
> +
> /* Setup receive completion ring.
> * Add 1 to the recv_section_cnt because at least one entry in a
> * ring buffer has to be empty.
> @@ -460,6 +469,12 @@ static int netvsc_init_buf(struct hv_device *device,
> /* Parse the response */
> net_device->send_section_size = init_packet->msg.
>
> v1_msg.send_send_buf_complete.section_size;
> + if (net_device->send_section_size < NETVSC_MTU_MIN) {
> + netdev_err(ndev, "invalid send_section_size %u\n",
> + net_device->send_section_size);
> + ret = -EINVAL;
> + goto cleanup;
> + }
>
> /* Section count is simply the size divided by the section size. */
> net_device->send_section_cnt = buf_size / net_device-
> >send_section_size;
> @@ -740,12 +755,45 @@ static void netvsc_send_completion(struct
> net_device *ndev,
> int budget)
> {
> const struct nvsp_message *nvsp_packet = hv_pkt_data(desc);
> + u32 msglen = hv_pkt_datalen(desc);
> +
> + /* Ensure packet is big enough to read header fields */
> + if (msglen < sizeof(struct nvsp_message_header)) {
> + netdev_err(ndev, "nvsp_message length too small: %u\n",
> msglen);
> + return;
> + }
>
> switch (nvsp_packet->hdr.msg_type) {
> case NVSP_MSG_TYPE_INIT_COMPLETE:
> + if (msglen < sizeof(struct nvsp_message_init_complete)) {
This and other similar places should include header size:
if (msglen < sizeof(struct nvsp_message_header) + sizeof(struct nvsp_message_init_complete)) {
Thanks,
- Haiyang
Powered by blists - more mailing lists