]> git.baikalelectronics.ru Git - kernel.git/commit
hv_sock: Copy packets sent by Hyper-V out of the ring buffer
authorAndrea Parri (Microsoft) <parri.andrea@gmail.com>
Thu, 28 Apr 2022 14:51:04 +0000 (16:51 +0200)
committerWei Liu <wei.liu@kernel.org>
Thu, 28 Apr 2022 15:01:14 +0000 (15:01 +0000)
commit14140e5dc6e19e5f5a0c74cff173d7abf822185d
tree4e686b62b8b528cf52c453e3086504f7163d2fce
parent056a5cc9ac9ef11361b99a15d00d13af5ee0ddaa
hv_sock: Copy packets sent by Hyper-V out of the ring buffer

Pointers to VMbus packets sent by Hyper-V are used by the hv_sock driver
within the guest VM.  Hyper-V can send packets with erroneous values or
modify packet fields after they are processed by the guest.  To defend
against these scenarios, copy the incoming packet after validating its
length and offset fields using hv_pkt_iter_{first,next}().  Use
HVS_PKT_LEN(HVS_MTU_SIZE) to initialize the buffer which holds the
copies of the incoming packets.  In this way, the packet can no longer
be modified by the host.

Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com>
Reviewed-by: Michael Kelley <mikelley@microsoft.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Link: https://lore.kernel.org/r/20220428145107.7878-3-parri.andrea@gmail.com
Signed-off-by: Wei Liu <wei.liu@kernel.org>
net/vmw_vsock/hyperv_transport.c