VMCI: Check userland-provided datagram size
Ensure that the size filled in by userland in the datagram header matches the size of the buffer passed down in the IOCTL. Note that we account for the size of the header itself in the check. Acked-by: Jorgen Hansen <jhansen@vmware.com> Acked-by: Aditya Sarwade <asarwade@vmware.com> Signed-off-by: Andy King <acking@vmware.com> Reported-by: David Ramos <daramos@stanford.edu> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
bf1361211d
commit
74b5c297f5
|
@ -113,5 +113,5 @@ module_exit(vmci_drv_exit);
|
|||
|
||||
MODULE_AUTHOR("VMware, Inc.");
|
||||
MODULE_DESCRIPTION("VMware Virtual Machine Communication Interface.");
|
||||
MODULE_VERSION("1.1.1.0-k");
|
||||
MODULE_VERSION("1.1.2.0-k");
|
||||
MODULE_LICENSE("GPL v2");
|
||||
|
|
|
@ -395,6 +395,12 @@ static int vmci_host_do_send_datagram(struct vmci_host_dev *vmci_host_dev,
|
|||
return -EFAULT;
|
||||
}
|
||||
|
||||
if (VMCI_DG_SIZE(dg) != send_info.len) {
|
||||
vmci_ioctl_err("datagram size mismatch\n");
|
||||
kfree(dg);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
pr_devel("Datagram dst (handle=0x%x:0x%x) src (handle=0x%x:0x%x), payload (size=%llu bytes)\n",
|
||||
dg->dst.context, dg->dst.resource,
|
||||
dg->src.context, dg->src.resource,
|
||||
|
|
Loading…
Reference in New Issue