* [dpdk-dev] [PATCH] ipc: harden message receive function
@ 2019-04-29 14:22 Anatoly Burakov
2019-04-29 14:22 ` Anatoly Burakov
2019-05-03 12:31 ` Thomas Monjalon
0 siblings, 2 replies; 4+ messages in thread
From: Anatoly Burakov @ 2019-04-29 14:22 UTC (permalink / raw)
To: dev; +Cc: keith.wiles, herakliusz.lipiec, ferruh.yigit, stable
Currently, IPC does not check received messages for invalid data
and passes them to user code unchanged. This may result in buffer
overruns on reading message data. Fix this by checking the message
length and fd number on receive, and discard any messages that
are not valid.
Fixes: bacaa2754017 ("eal: add channel for multi-process communication")
Cc: stable@dpdk.org
Signed-off-by: Anatoly Burakov <anatoly.burakov@intel.com>
---
lib/librte_eal/common/eal_common_proc.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/lib/librte_eal/common/eal_common_proc.c b/lib/librte_eal/common/eal_common_proc.c
index b46d644b3..d4adabc70 100644
--- a/lib/librte_eal/common/eal_common_proc.c
+++ b/lib/librte_eal/common/eal_common_proc.c
@@ -285,7 +285,15 @@ read_msg(struct mp_msg_internal *m, struct sockaddr_un *s)
break;
}
}
-
+ /* sanity-check the response */
+ if (m->msg.num_fds < 0 || m->msg.num_fds > RTE_MP_MAX_FD_NUM) {
+ RTE_LOG(ERR, EAL, "invalid number of fd's received\n");
+ return -1;
+ }
+ if (m->msg.len_param < 0 || m->msg.len_param > RTE_MP_MAX_PARAM_LEN) {
+ RTE_LOG(ERR, EAL, "invalid received data length\n");
+ return -1;
+ }
return 0;
}
--
2.17.1
^ permalink raw reply [flat|nested] 4+ messages in thread* [dpdk-dev] [PATCH] ipc: harden message receive function
2019-04-29 14:22 [dpdk-dev] [PATCH] ipc: harden message receive function Anatoly Burakov
@ 2019-04-29 14:22 ` Anatoly Burakov
2019-05-03 12:31 ` Thomas Monjalon
1 sibling, 0 replies; 4+ messages in thread
From: Anatoly Burakov @ 2019-04-29 14:22 UTC (permalink / raw)
To: dev; +Cc: keith.wiles, herakliusz.lipiec, ferruh.yigit, stable
Currently, IPC does not check received messages for invalid data
and passes them to user code unchanged. This may result in buffer
overruns on reading message data. Fix this by checking the message
length and fd number on receive, and discard any messages that
are not valid.
Fixes: bacaa2754017 ("eal: add channel for multi-process communication")
Cc: stable@dpdk.org
Signed-off-by: Anatoly Burakov <anatoly.burakov@intel.com>
---
lib/librte_eal/common/eal_common_proc.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/lib/librte_eal/common/eal_common_proc.c b/lib/librte_eal/common/eal_common_proc.c
index b46d644b3..d4adabc70 100644
--- a/lib/librte_eal/common/eal_common_proc.c
+++ b/lib/librte_eal/common/eal_common_proc.c
@@ -285,7 +285,15 @@ read_msg(struct mp_msg_internal *m, struct sockaddr_un *s)
break;
}
}
-
+ /* sanity-check the response */
+ if (m->msg.num_fds < 0 || m->msg.num_fds > RTE_MP_MAX_FD_NUM) {
+ RTE_LOG(ERR, EAL, "invalid number of fd's received\n");
+ return -1;
+ }
+ if (m->msg.len_param < 0 || m->msg.len_param > RTE_MP_MAX_PARAM_LEN) {
+ RTE_LOG(ERR, EAL, "invalid received data length\n");
+ return -1;
+ }
return 0;
}
--
2.17.1
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [dpdk-dev] [PATCH] ipc: harden message receive function
2019-04-29 14:22 [dpdk-dev] [PATCH] ipc: harden message receive function Anatoly Burakov
2019-04-29 14:22 ` Anatoly Burakov
@ 2019-05-03 12:31 ` Thomas Monjalon
2019-05-03 12:31 ` Thomas Monjalon
1 sibling, 1 reply; 4+ messages in thread
From: Thomas Monjalon @ 2019-05-03 12:31 UTC (permalink / raw)
To: Anatoly Burakov; +Cc: dev, keith.wiles, herakliusz.lipiec, ferruh.yigit, stable
29/04/2019 16:22, Anatoly Burakov:
> Currently, IPC does not check received messages for invalid data
> and passes them to user code unchanged. This may result in buffer
> overruns on reading message data. Fix this by checking the message
> length and fd number on receive, and discard any messages that
> are not valid.
>
> Fixes: bacaa2754017 ("eal: add channel for multi-process communication")
> Cc: stable@dpdk.org
>
> Signed-off-by: Anatoly Burakov <anatoly.burakov@intel.com>
Applied, thanks
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [dpdk-dev] [PATCH] ipc: harden message receive function
2019-05-03 12:31 ` Thomas Monjalon
@ 2019-05-03 12:31 ` Thomas Monjalon
0 siblings, 0 replies; 4+ messages in thread
From: Thomas Monjalon @ 2019-05-03 12:31 UTC (permalink / raw)
To: Anatoly Burakov; +Cc: dev, keith.wiles, herakliusz.lipiec, ferruh.yigit, stable
29/04/2019 16:22, Anatoly Burakov:
> Currently, IPC does not check received messages for invalid data
> and passes them to user code unchanged. This may result in buffer
> overruns on reading message data. Fix this by checking the message
> length and fd number on receive, and discard any messages that
> are not valid.
>
> Fixes: bacaa2754017 ("eal: add channel for multi-process communication")
> Cc: stable@dpdk.org
>
> Signed-off-by: Anatoly Burakov <anatoly.burakov@intel.com>
Applied, thanks
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2019-05-03 12:31 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-04-29 14:22 [dpdk-dev] [PATCH] ipc: harden message receive function Anatoly Burakov
2019-04-29 14:22 ` Anatoly Burakov
2019-05-03 12:31 ` Thomas Monjalon
2019-05-03 12:31 ` Thomas Monjalon
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).