hv_netvsc: Copy packets sent by Hyper-V out of the receive buffer
authorAndrea Parri (Microsoft) <parri.andrea@gmail.com>
Tue, 26 Jan 2021 16:29:07 +0000 (17:29 +0100)
committerJakub Kicinski <kuba@kernel.org>
Sat, 30 Jan 2021 00:44:07 +0000 (16:44 -0800)
commit0ba35fe91ce34f2d0feff626efd0062dac41781c
treed618cfab0efe234b40342d5d913c60f47a703908
parent46eb3c108fe1744d0a6abfda69ef8c1d4f0e92d4
hv_netvsc: Copy packets sent by Hyper-V out of the receive buffer

Pointers to receive-buffer packets sent by Hyper-V are used within the
guest VM.  Hyper-V can send packets with erroneous values or modify
packet fields after they are processed by the guest.  To defend against
these scenarios, copy (sections of) the incoming packet after validating
their length and offset fields in netvsc_filter_receive().  In this way,
the packet can no longer be modified by the host.

Reported-by: Juan Vazquez <juvazq@microsoft.com>
Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com>
Link: https://lore.kernel.org/r/20210126162907.21056-1-parri.andrea@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
drivers/net/hyperv/hyperv_net.h
drivers/net/hyperv/netvsc.c
drivers/net/hyperv/netvsc_drv.c
drivers/net/hyperv/rndis_filter.c