Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S965920Ab2B1RVw (ORCPT ); Tue, 28 Feb 2012 12:21:52 -0500 Received: from mail-ww0-f44.google.com ([74.125.82.44]:52683 "EHLO mail-ww0-f44.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S965899Ab2B1RVs (ORCPT ); Tue, 28 Feb 2012 12:21:48 -0500 Authentication-Results: mr.google.com; spf=pass (google.com: domain of ohad@wizery.com designates 10.216.82.141 as permitted sender) smtp.mail=ohad@wizery.com MIME-Version: 1.0 From: Ohad Ben-Cohen To: Cc: , , Ohad Ben-Cohen , Grant Likely , Arnd Bergmann , Mark Grosen , Suman Anna , Fernando Guzman Lugo , Rob Clark , Ludovic BARRE , Loic PALLARDY , Omar Ramirez Luna Subject: [PATCH 4/5] rpmsg: validate incoming message length before propagating Date: Tue, 28 Feb 2012 19:21:11 +0200 Message-Id: <1330449672-18191-6-git-send-email-ohad@wizery.com> X-Mailer: git-send-email 1.7.5.4 In-Reply-To: <1330449672-18191-1-git-send-email-ohad@wizery.com> References: <1330449672-18191-1-git-send-email-ohad@wizery.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1782 Lines: 47 When an inbound message arrives, validate its reported length before propagating it, otherwise buggy (or malicious) remote processors might trick us into accessing memory which we really shouldn't. Signed-off-by: Ohad Ben-Cohen Cc: Grant Likely Cc: Arnd Bergmann Cc: Mark Grosen Cc: Suman Anna Cc: Fernando Guzman Lugo Cc: Rob Clark Cc: Ludovic BARRE Cc: Loic PALLARDY Cc: Omar Ramirez Luna --- drivers/rpmsg/virtio_rpmsg_bus.c | 10 ++++++++++ 1 files changed, 10 insertions(+), 0 deletions(-) diff --git a/drivers/rpmsg/virtio_rpmsg_bus.c b/drivers/rpmsg/virtio_rpmsg_bus.c index 4db9cf8..1e8b8b6 100644 --- a/drivers/rpmsg/virtio_rpmsg_bus.c +++ b/drivers/rpmsg/virtio_rpmsg_bus.c @@ -778,6 +778,16 @@ static void rpmsg_recv_done(struct virtqueue *rvq) print_hex_dump(KERN_DEBUG, "rpmsg_virtio RX: ", DUMP_PREFIX_NONE, 16, 1, msg, sizeof(*msg) + msg->len, true); + /* + * We currently use fixed-sized buffers, so trivially sanitize + * the reported payload length. + */ + if (len > RPMSG_BUF_SIZE || + msg->len > (len - sizeof(struct rpmsg_hdr))) { + dev_warn(dev, "inbound msg too big: (%d, %d)\n", len, msg->len); + return; + } + /* use the dst addr to fetch the callback of the appropriate user */ mutex_lock(&vrp->endpoints_lock); ept = idr_find(&vrp->endpoints, msg->dst); -- 1.7.5.4 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/