From 7b51d1b162914e37bcc511a11efcfbabb44b2eb3 Mon Sep 17 00:00:00 2001 From: Anatoly Burakov Date: Mon, 29 Apr 2019 15:22:50 +0100 Subject: [PATCH 1/1] ipc: harden message receive Currently, IPC does not check received messages for invalid data and passes them to user code unchanged. This may result in buffer overruns on reading message data. Fix this by checking the message length and fd number on receive, and discard any messages that are not valid. Fixes: bacaa2754017 ("eal: add channel for multi-process communication") Cc: stable@dpdk.org Signed-off-by: Anatoly Burakov --- lib/librte_eal/common/eal_common_proc.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/lib/librte_eal/common/eal_common_proc.c b/lib/librte_eal/common/eal_common_proc.c index 8586474a24..6ffd476861 100644 --- a/lib/librte_eal/common/eal_common_proc.c +++ b/lib/librte_eal/common/eal_common_proc.c @@ -285,7 +285,15 @@ read_msg(struct mp_msg_internal *m, struct sockaddr_un *s) break; } } - + /* sanity-check the response */ + if (m->msg.num_fds < 0 || m->msg.num_fds > RTE_MP_MAX_FD_NUM) { + RTE_LOG(ERR, EAL, "invalid number of fd's received\n"); + return -1; + } + if (m->msg.len_param < 0 || m->msg.len_param > RTE_MP_MAX_PARAM_LEN) { + RTE_LOG(ERR, EAL, "invalid received data length\n"); + return -1; + } return 0; } -- 2.20.1