From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from dpdk.org (dpdk.org [92.243.14.124]) by dpdk.space (Postfix) with ESMTP id E3FD3A0679 for ; Mon, 29 Apr 2019 16:22:56 +0200 (CEST) Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id 7F5DD1B10E; Mon, 29 Apr 2019 16:22:55 +0200 (CEST) Received: from mga11.intel.com (mga11.intel.com [192.55.52.93]) by dpdk.org (Postfix) with ESMTP id 043CE7D05; Mon, 29 Apr 2019 16:22:53 +0200 (CEST) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga004.jf.intel.com ([10.7.209.38]) by fmsmga102.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 29 Apr 2019 07:22:52 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.60,409,1549958400"; d="scan'208";a="295483672" Received: from silpixa00399498.ir.intel.com (HELO silpixa00399498.ger.corp.intel.com) ([10.237.223.125]) by orsmga004.jf.intel.com with ESMTP; 29 Apr 2019 07:22:51 -0700 From: Anatoly Burakov To: dev@dpdk.org Cc: keith.wiles@intel.com, herakliusz.lipiec@intel.com, ferruh.yigit@intel.com, stable@dpdk.org Date: Mon, 29 Apr 2019 15:22:50 +0100 Message-Id: <33816b0f26de3b8328ae49fb6c73ca200acd945b.1556547761.git.anatoly.burakov@intel.com> X-Mailer: git-send-email 2.17.1 Subject: [dpdk-dev] [PATCH] ipc: harden message receive function X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" Content-Type: text/plain; charset="UTF-8" Message-ID: <20190429142250.4xs8MgcFF76Sgm4jlAZ8AqBRaB1MWxSz17Y1ASiqs7o@z> Currently, IPC does not check received messages for invalid data and passes them to user code unchanged. This may result in buffer overruns on reading message data. Fix this by checking the message length and fd number on receive, and discard any messages that are not valid. Fixes: bacaa2754017 ("eal: add channel for multi-process communication") Cc: stable@dpdk.org Signed-off-by: Anatoly Burakov --- lib/librte_eal/common/eal_common_proc.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/lib/librte_eal/common/eal_common_proc.c b/lib/librte_eal/common/eal_common_proc.c index b46d644b3..d4adabc70 100644 --- a/lib/librte_eal/common/eal_common_proc.c +++ b/lib/librte_eal/common/eal_common_proc.c @@ -285,7 +285,15 @@ read_msg(struct mp_msg_internal *m, struct sockaddr_un *s) break; } } - + /* sanity-check the response */ + if (m->msg.num_fds < 0 || m->msg.num_fds > RTE_MP_MAX_FD_NUM) { + RTE_LOG(ERR, EAL, "invalid number of fd's received\n"); + return -1; + } + if (m->msg.len_param < 0 || m->msg.len_param > RTE_MP_MAX_PARAM_LEN) { + RTE_LOG(ERR, EAL, "invalid received data length\n"); + return -1; + } return 0; } -- 2.17.1