From mboxrd@z Thu Jan 1 00:00:00 1970 From: ohad@wizery.com (Ohad Ben-Cohen) Date: Tue, 28 Feb 2012 19:21:11 +0200 Subject: [PATCH 4/5] rpmsg: validate incoming message length before propagating In-Reply-To: <1330449672-18191-1-git-send-email-ohad@wizery.com> References: <1330449672-18191-1-git-send-email-ohad@wizery.com> Message-ID: <1330449672-18191-6-git-send-email-ohad@wizery.com> To: linux-arm-kernel@lists.infradead.org List-Id: linux-arm-kernel.lists.infradead.org When an inbound message arrives, validate its reported length before propagating it, otherwise buggy (or malicious) remote processors might trick us into accessing memory which we really shouldn't. Signed-off-by: Ohad Ben-Cohen Cc: Grant Likely Cc: Arnd Bergmann Cc: Mark Grosen Cc: Suman Anna Cc: Fernando Guzman Lugo Cc: Rob Clark Cc: Ludovic BARRE Cc: Loic PALLARDY Cc: Omar Ramirez Luna --- drivers/rpmsg/virtio_rpmsg_bus.c | 10 ++++++++++ 1 files changed, 10 insertions(+), 0 deletions(-) diff --git a/drivers/rpmsg/virtio_rpmsg_bus.c b/drivers/rpmsg/virtio_rpmsg_bus.c index 4db9cf8..1e8b8b6 100644 --- a/drivers/rpmsg/virtio_rpmsg_bus.c +++ b/drivers/rpmsg/virtio_rpmsg_bus.c @@ -778,6 +778,16 @@ static void rpmsg_recv_done(struct virtqueue *rvq) print_hex_dump(KERN_DEBUG, "rpmsg_virtio RX: ", DUMP_PREFIX_NONE, 16, 1, msg, sizeof(*msg) + msg->len, true); + /* + * We currently use fixed-sized buffers, so trivially sanitize + * the reported payload length. + */ + if (len > RPMSG_BUF_SIZE || + msg->len > (len - sizeof(struct rpmsg_hdr))) { + dev_warn(dev, "inbound msg too big: (%d, %d)\n", len, msg->len); + return; + } + /* use the dst addr to fetch the callback of the appropriate user */ mutex_lock(&vrp->endpoints_lock); ept = idr_find(&vrp->endpoints, msg->dst); -- 1.7.5.4