mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix unsigned integer underflow in fd-trans.c

Browse Source 
In any of these `*_for_each_*` functions, the last entry in the buffer (so the
"remaining length in the buffer" `len` is equal to the length of the
entry `nlmsg_len`/`nla_len`/etc) has size that is not a multiple of the
alignment, the aligned lengths `*_ALIGN(*_len)` will be greater than `len`.
Since `len` is unsigned (`size_t`), it underflows and the loop will read
pass the buffer.

This may manifest as random EINVAL or EOPNOTSUPP error on IO or network
system calls.

Signed-off-by: Shu-Chun Weng <scw@google.com>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20191018001920.178283-1-scw@google.com>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
This commit is contained in:
Shu-Chun Weng 2019-10-17 17:19:20 -07:00 committed by Laurent Vivier
parent 53bdbfdf53
commit 1645fb5a1e
1 changed files with 40 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

51
linux-user/fd-trans.c
View File

@ -279,6 +279,7 @@ static abi_long host_to_target_for_each_nlmsg(struct nlmsghdr *nlh,
(struct nlmsghdr *)) (struct nlmsghdr *))
{ {
uint32_t nlmsg_len; uint32_t nlmsg_len;
uint32_t aligned_nlmsg_len;
abi_long ret; abi_long ret;
while (len > sizeof(struct nlmsghdr)) { while (len > sizeof(struct nlmsghdr)) {
@ -312,8 +313,13 @@ static abi_long host_to_target_for_each_nlmsg(struct nlmsghdr *nlh,
break; break;
} }
tswap_nlmsghdr(nlh); tswap_nlmsghdr(nlh);
len -= NLMSG_ALIGN(nlmsg_len);
nlh = (struct nlmsghdr *)(((char*)nlh) + NLMSG_ALIGN(nlmsg_len)); aligned_nlmsg_len = NLMSG_ALIGN(nlmsg_len);
if (aligned_nlmsg_len >= len) {
break;
}
len -= aligned_nlmsg_len;
nlh = (struct nlmsghdr *)(((char*)nlh) + aligned_nlmsg_len);
} }
return 0; return 0;
} }
@ -323,6 +329,7 @@ static abi_long target_to_host_for_each_nlmsg(struct nlmsghdr *nlh,
abi_long (*target_to_host_nlmsg) abi_long (*target_to_host_nlmsg)
(struct nlmsghdr *)) (struct nlmsghdr *))
{ {
uint32_t aligned_nlmsg_len;
int ret; int ret;
while (len > sizeof(struct nlmsghdr)) { while (len > sizeof(struct nlmsghdr)) {
@ -349,8 +356,13 @@ static abi_long target_to_host_for_each_nlmsg(struct nlmsghdr *nlh,
return ret; return ret;
} }
} }
len -= NLMSG_ALIGN(nlh->nlmsg_len);
nlh = (struct nlmsghdr *)(((char *)nlh) + NLMSG_ALIGN(nlh->nlmsg_len)); aligned_nlmsg_len = NLMSG_ALIGN(nlh->nlmsg_len);
if (aligned_nlmsg_len >= len) {
break;
}
len -= aligned_nlmsg_len;
nlh = (struct nlmsghdr *)(((char *)nlh) + aligned_nlmsg_len);
} }
return 0; return 0;
} }
@ -363,6 +375,7 @@ static abi_long host_to_target_for_each_nlattr(struct nlattr *nlattr,
void *context)) void *context))
{ {
unsigned short nla_len; unsigned short nla_len;
unsigned short aligned_nla_len;
abi_long ret; abi_long ret;
while (len > sizeof(struct nlattr)) { while (len > sizeof(struct nlattr)) {
@ -377,8 +390,13 @@ static abi_long host_to_target_for_each_nlattr(struct nlattr *nlattr,
if (ret < 0) { if (ret < 0) {
return ret; return ret;
} }
len -= NLA_ALIGN(nla_len);
nlattr = (struct nlattr *)(((char *)nlattr) + NLA_ALIGN(nla_len)); aligned_nla_len = NLA_ALIGN(nla_len);
if (aligned_nla_len >= len) {
break;
}
len -= aligned_nla_len;
nlattr = (struct nlattr *)(((char *)nlattr) + aligned_nla_len);
} }
return 0; return 0;
} }
@ -389,6 +407,7 @@ static abi_long host_to_target_for_each_rtattr(struct rtattr *rtattr,
(struct rtattr *)) (struct rtattr *))
{ {
unsigned short rta_len; unsigned short rta_len;
unsigned short aligned_rta_len;
abi_long ret; abi_long ret;
while (len > sizeof(struct rtattr)) { while (len > sizeof(struct rtattr)) {
@ -403,8 +422,13 @@ static abi_long host_to_target_for_each_rtattr(struct rtattr *rtattr,
if (ret < 0) { if (ret < 0) {
return ret; return ret;
} }
len -= RTA_ALIGN(rta_len);
rtattr = (struct rtattr *)(((char *)rtattr) + RTA_ALIGN(rta_len)); aligned_rta_len = RTA_ALIGN(rta_len);
if (aligned_rta_len >= len) {
break;
}
len -= aligned_rta_len;
rtattr = (struct rtattr *)(((char *)rtattr) + aligned_rta_len);
} }
return 0; return 0;
} }
@ -1058,6 +1082,7 @@ static abi_long target_to_host_for_each_rtattr(struct rtattr *rtattr,
abi_long (*target_to_host_rtattr) abi_long (*target_to_host_rtattr)
(struct rtattr *)) (struct rtattr *))
{ {
unsigned short aligned_rta_len;
abi_long ret; abi_long ret;
while (len >= sizeof(struct rtattr)) { while (len >= sizeof(struct rtattr)) {
@ -1071,9 +1096,13 @@ static abi_long target_to_host_for_each_rtattr(struct rtattr *rtattr,
if (ret < 0) { if (ret < 0) {
return ret; return ret;
} }
len -= RTA_ALIGN(rtattr->rta_len);
rtattr = (struct rtattr *)(((char *)rtattr) + aligned_rta_len = RTA_ALIGN(rtattr->rta_len);
RTA_ALIGN(rtattr->rta_len)); if (aligned_rta_len >= len) {
break;
}
len -= aligned_rta_len;
rtattr = (struct rtattr *)(((char *)rtattr) + aligned_rta_len);
} }
return 0; return 0;
} }