From 9648224e564aa0d6e3a803bd0e056802cc97297c Mon Sep 17 00:00:00 2001 From: Ohad Ben-Cohen Date: Tue, 28 Feb 2012 16:16:48 +0200 Subject: rpmsg: validate incoming message length before propagating When an inbound message arrives, validate its reported length before propagating it, otherwise buggy (or malicious) remote processors might trick us into accessing memory which we really shouldn't. Signed-off-by: Ohad Ben-Cohen Cc: Grant Likely Cc: Arnd Bergmann Cc: Mark Grosen Cc: Suman Anna Cc: Fernando Guzman Lugo Cc: Rob Clark Cc: Ludovic BARRE Cc: Loic PALLARDY Cc: Omar Ramirez Luna --- drivers/rpmsg/virtio_rpmsg_bus.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/rpmsg/virtio_rpmsg_bus.c b/drivers/rpmsg/virtio_rpmsg_bus.c index 4db9cf8754a0..1e8b8b618674 100644 --- a/drivers/rpmsg/virtio_rpmsg_bus.c +++ b/drivers/rpmsg/virtio_rpmsg_bus.c @@ -778,6 +778,16 @@ static void rpmsg_recv_done(struct virtqueue *rvq) print_hex_dump(KERN_DEBUG, "rpmsg_virtio RX: ", DUMP_PREFIX_NONE, 16, 1, msg, sizeof(*msg) + msg->len, true); + /* + * We currently use fixed-sized buffers, so trivially sanitize + * the reported payload length. + */ + if (len > RPMSG_BUF_SIZE || + msg->len > (len - sizeof(struct rpmsg_hdr))) { + dev_warn(dev, "inbound msg too big: (%d, %d)\n", len, msg->len); + return; + } + /* use the dst addr to fetch the callback of the appropriate user */ mutex_lock(&vrp->endpoints_lock); ept = idr_find(&vrp->endpoints, msg->dst); -- cgit v1.2.3