vhost: fix total length when packets are too short
authorMichael S. Tsirkin <mst@redhat.com>
Thu, 27 Mar 2014 10:00:26 +0000 (12:00 +0200)
committerDavid S. Miller <davem@davemloft.net>
Fri, 28 Mar 2014 20:07:31 +0000 (16:07 -0400)
commitd8316f3991d207fe32881a9ac20241be8fa2bad0
tree76802d9368e0115d9c53ac7cf0477b53011a4486
parent05efa8c943b1d5d90fa8c8147571837573338bb6
vhost: fix total length when packets are too short

When mergeable buffers are disabled, and the
incoming packet is too large for the rx buffer,
get_rx_bufs returns success.

This was intentional in order for make recvmsg
truncate the packet and then handle_rx would
detect err != sock_len and drop it.

Unfortunately we pass the original sock_len to
recvmsg - which means we use parts of iov not fully
validated.

Fix this up by detecting this overrun and doing packet drop
immediately.

CVE-2014-0077

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/vhost/net.c