From d1cc80b94858666cc48467e8e166ccf389551b5d Mon Sep 17 00:00:00 2001 From: Jason Wang Date: Tue, 19 Mar 2013 12:36:56 +0100 Subject: [PATCH] macvtap: zerocopy: validate vectors before building skb commit b92946e2919134ebe2a4083e4302236295ea2a73 upstream. There're several reasons that the vectors need to be validated: - Return error when caller provides vectors whose num is greater than UIO_MAXIOV. - Linearize part of skb when userspace provides vectors grater than MAX_SKB_FRAGS. - Return error when userspace provides vectors whose total length may exceed - MAX_SKB_FRAGS * PAGE_SIZE. Signed-off-by: Jason Wang Signed-off-by: Michael S. Tsirkin Signed-off-by: Benjamin Poirier [patch reduced to the 3rd reason only for 3.0] Signed-off-by: Jiri Slaby Signed-off-by: Greg Kroah-Hartman --- drivers/net/macvtap.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c index 6696e56e6320..023b57e2f76b 100644 --- a/drivers/net/macvtap.c +++ b/drivers/net/macvtap.c @@ -552,6 +552,10 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, if (unlikely(len < ETH_HLEN)) goto err; + err = -EMSGSIZE; + if (unlikely(count > UIO_MAXIOV)) + goto err; + skb = macvtap_alloc_skb(&q->sk, NET_IP_ALIGN, len, vnet_hdr.hdr_len, noblock, &err); if (!skb) -- 2.39.5