diff mbox series

ipc: harden message receive function

Message ID 33816b0f26de3b8328ae49fb6c73ca200acd945b.1556547761.git.anatoly.burakov@intel.com (mailing list archive)
State Accepted, archived
Headers
Series ipc: harden message receive function |

Checks

Context Check Description
ci/checkpatch success coding style OK
ci/Intel-compilation success Compilation OK
ci/intel-Performance-Testing success Performance Testing PASS
ci/mellanox-Performance-Testing success Performance Testing PASS

Commit Message

Anatoly Burakov April 29, 2019, 2:22 p.m. UTC 
  Currently, IPC does not check received messages for invalid data
and passes them to user code unchanged. This may result in buffer
overruns on reading message data. Fix this by checking the message
length and fd number on receive, and discard any messages that
are not valid.

Fixes: bacaa2754017 ("eal: add channel for multi-process communication")
Cc: stable@dpdk.org

Signed-off-by: Anatoly Burakov <anatoly.burakov@intel.com>
---
 lib/librte_eal/common/eal_common_proc.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

Comments

Thomas Monjalon May 3, 2019, 12:31 p.m. UTC | #1 
29/04/2019 16:22, Anatoly Burakov:
> Currently, IPC does not check received messages for invalid data
> and passes them to user code unchanged. This may result in buffer
> overruns on reading message data. Fix this by checking the message
> length and fd number on receive, and discard any messages that
> are not valid.
> 
> Fixes: bacaa2754017 ("eal: add channel for multi-process communication")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Anatoly Burakov <anatoly.burakov@intel.com>

Applied, thanks
diff mbox series

Patch

diff --git a/lib/librte_eal/common/eal_common_proc.c b/lib/librte_eal/common/eal_common_proc.c
index b46d644b3..d4adabc70 100644
--- a/lib/librte_eal/common/eal_common_proc.c
+++ b/lib/librte_eal/common/eal_common_proc.c
@@ -285,7 +285,15 @@  read_msg(struct mp_msg_internal *m, struct sockaddr_un *s)
 			break;
 		}
 	}
-
+	/* sanity-check the response */
+	if (m->msg.num_fds < 0 || m->msg.num_fds > RTE_MP_MAX_FD_NUM) {
+		RTE_LOG(ERR, EAL, "invalid number of fd's received\n");
+		return -1;
+	}
+	if (m->msg.len_param < 0 || m->msg.len_param > RTE_MP_MAX_PARAM_LEN) {
+		RTE_LOG(ERR, EAL, "invalid received data length\n");
+		return -1;
+	}
 	return 0;
 }