Page MenuHomeFreeBSD
Differential D60092

virtio: Clamp host-supplied used lengths
Needs ReviewPublic
Actions

Authored by kfv on Mon, Sep 28, 11:27 AM.
Tags
None
Referenced Files
F173962405: D60092.id187872.diff
Tue, Sep 29, 4:17 PM
F173960269: D60092.diff
Tue, Sep 29, 4:02 PM
F173874529: D60092.id187872.diff
Tue, Sep 29, 1:18 AM
Unknown Object (File)
Tue, Sep 29, 1:05 AM
Unknown Object (File)
Mon, Sep 28, 10:54 PM
Unknown Object (File)
Mon, Sep 28, 9:15 PM
Subscribers
None

Details

Reviewers
dteske
fuz
adrian
bryanv
imp
markj
Summary

Do not trust host-supplied used lengths; host could report
a used length larger than the buffer, causing the receive
and control paths to read past the buffer.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Tests Skipped
Build Status
Buildable 77412
Build 74295: arc lint + arc unit

Event Timeline

kfv requested review of this revision.Mon, Sep 28, 11:27 AM
kfv created this revision.
Harbormaster completed remote builds in B77412: Diff 187872.Mon, Sep 28, 11:27 AM
markj added a comment.Mon, Sep 28, 8:26 PM

This patch only updates virtio_console, but virtio_net has the same problem. Will you fix it too?

kfv added a comment.Tue, Sep 29, 10:31 PM

Sure thing. I actually wanted to keep this separate since this one is basically just a clamp while the other one in vtnet is IMHO more of a logical and policy change (and I needed to test that even further, to be honest). But since both are addressing the same concern (namely, not trusting the host to stay within the buffer) it could indeed make sense to have them both done here. I’ll take care of it tomorrow.

Revision Contents
Changeset List

PathSize
sys/
dev/
virtio/
console/
2 lines

Diff 187872

View Options

sys/dev/virtio/console/virtio_console.c

Loading...