mirror of
https://github.com/torvalds/linux.git
synced 2026-09-25 21:21:09 -04:00
Andrea Parri (Microsoft)
3946688edb
Contrary to the RNDIS protocol specification, certain (pre-Fe)
implementations of Hyper-V's vSwitch did not account for the status
buffer field in the length of an RNDIS packet; the bug was fixed in
newer implementations. Validate the status buffer fields using the
length of the 'vmtransfer_page' packet (all implementations), that
is known/validated to be less than or equal to the receive section
size and not smaller than the length of the RNDIS message.
Reported-by: Dexuan Cui <[email protected]>
Suggested-by: Haiyang Zhang <[email protected]>
Signed-off-by: Andrea Parri (Microsoft) <[email protected]>
Fixes: 505e3f00c3 ("hv_netvsc: Add (more) validation for untrusted Hyper-V values")
Signed-off-by: David S. Miller <[email protected]>