RE: [RFC PATCH] scsi: storvsc: Fix validation for unsolicited incoming packets
From: Haiyang Zhang <haiyangz@microsoft.com>
Date: 2021-09-28 22:05:53
Also in:
linux-scsi, lkml
quoted hunk ↗ jump to hunk
-----Original Message----- From: Andrea Parri (Microsoft) <parri.andrea@gmail.com> Sent: Tuesday, September 28, 2021 12:38 PM To: linux-kernel@vger.kernel.org; linux-hyperv@vger.kernel.org; linux- scsi@vger.kernel.org Cc: KY Srinivasan <kys@microsoft.com>; Haiyang Zhang [off-list ref]; Stephen Hemminger [off-list ref]; Wei Liu [off-list ref]; James E . J . Bottomley [off-list ref]; Martin K . Petersen [off-list ref]; Michael Kelley [off-list ref]; Andrea Parri (Microsoft) [off-list ref]; Dexuan Cui [off-list ref] Subject: [RFC PATCH] scsi: storvsc: Fix validation for unsolicited incoming packets The validation on the length of incoming packets performed in storvsc_on_channel_callback() does not apply to "unsolicited" packets with ID of 0 sent by Hyper-V. Adjust the validation by handling such unsolicited packets separately. Fixes: 91b1b640b834b2 ("scsi: storvsc: Validate length of incoming packet in storvsc_on_channel_callback()") Reported-by: Dexuan Cui <decui@microsoft.com> Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com> --- The (new) bound, VSTOR_MIN_UNSOL_PKT_SIZE, was "empirically derived" based on testing and code auditing. This explains the RFC tag... drivers/scsi/storvsc_drv.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-)diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c index ebbbc1299c625..a9bbcbbfb54ee 100644 --- a/drivers/scsi/storvsc_drv.c +++ b/drivers/scsi/storvsc_drv.c@@ -292,6 +292,9 @@ struct vmstorage_protocol_version { #define STORAGE_CHANNEL_REMOVABLE_FLAG 0x1 #define STORAGE_CHANNEL_EMULATED_IDE_FLAG 0x2 +/* Lower bound on the size of unsolicited packets with ID of 0 */ +#define VSTOR_MIN_UNSOL_PKT_SIZE 48 + struct vstor_packet { /* Requested operation type */ enum vstor_packet_operation operation;@@ -1285,11 +1288,13 @@ static void storvsc_on_channel_callback(void*context) foreach_vmbus_pkt(desc, channel) { struct vstor_packet *packet = hv_pkt_data(desc); struct storvsc_cmd_request *request = NULL; + u32 pktlen = hv_pkt_datalen(desc); u64 rqst_id = desc->trans_id; - if (hv_pkt_datalen(desc) < sizeof(struct vstor_packet) - + /* Unsolicited packets with ID of 0 are validated separately below */ + if (rqst_id != 0 && pktlen < sizeof(struct vstor_packet) - stor_device->vmscsi_size_delta) { - dev_err(&device->device, "Invalid packet len\n"); + dev_err(&device->device, "Invalid packet: length=%u\n", pktlen); continue; }@@ -1298,8 +1303,14 @@ static void storvsc_on_channel_callback(void*context) } else if (rqst_id == VMBUS_RQST_RESET) { request = &stor_device->reset_request; } else { - /* Hyper-V can send an unsolicited message with ID of 0 */ if (rqst_id == 0) { + if (pktlen < VSTOR_MIN_UNSOL_PKT_SIZE) { + dev_err(&device->device, + "Invalid packet with ID of 0: length=%u\n", + pktlen); + continue; + } + /* * storvsc_on_receive() looks at the vstor_packet in the message * from the ring buffer. If the operation in the vstor_packet is
The patch looks good. But for readability, I'd suggested put the length
checks together like this:
u32 minlen = rqst_id ? sizeof(struct vstor_packet) -
stor_device->vmscsi_size_delta : VSTOR_MIN_UNSOL_PKT_SIZE;
if (pktlen < minlen) {
dev_err(&device->device,
"Invalid pkt: id=%llu, len=%u, minlen=%u\n",
rqst_id, pktlen, minlen);
continue;
}
Thanks.
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>