Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 74b5c297 authored Feb 19, 2015 by Andy King Committed by Greg Kroah-Hartman Mar 25, 2015

VMCI: Check userland-provided datagram size



Ensure that the size filled in by userland in the datagram header
matches the size of the buffer passed down in the IOCTL. Note that we
account for the size of the header itself in the check.

Acked-by: Jorgen Hansen <jhansen@vmware.com>
Acked-by: Aditya Sarwade <asarwade@vmware.com>
Signed-off-by: Andy King <acking@vmware.com>
Reported-by: David Ramos <daramos@stanford.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent bf136121

drivers/misc/vmw_vmci/vmci_driver.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -113,5 +113,5 @@ module_exit(vmci_drv_exit);

		MODULE_AUTHOR("VMware, Inc.");
		MODULE_DESCRIPTION("VMware Virtual Machine Communication Interface.");
		MODULE_VERSION("1.1.1.0-k");
		MODULE_VERSION("1.1.2.0-k");
		MODULE_LICENSE("GPL v2");

drivers/misc/vmw_vmci/vmci_host.c

+6 −0

Original line number	Diff line number	Diff line
		@@ -395,6 +395,12 @@ static int vmci_host_do_send_datagram(struct vmci_host_dev *vmci_host_dev,
		return -EFAULT;
		}

		if (VMCI_DG_SIZE(dg) != send_info.len) {
		vmci_ioctl_err("datagram size mismatch\n");
		kfree(dg);
		return -EINVAL;
		}

		pr_devel("Datagram dst (handle=0x%x:0x%x) src (handle=0x%x:0x%x), payload (size=%llu bytes)\n",
		dg->dst.context, dg->dst.resource,
		dg->src.context, dg->src.resource,