Vulnerability: Buffer overflow in the macvtap device driver in the Linux kernel before 3.4.5, when running in certain configurations, allows privileged KVM guest users to cause a denial of service (crash) via a long descriptor with a long vector length.
Vulnerability ID: CVE-2012-2119
CWE: CWE-119
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2013-01-22
File: drivers/net/macvtap.c
Commit message: macvtap: zerocopy: validate vectors before building skb

There're several reasons that the vectors need to be validated:

- Return error when caller provides vectors whose num is greater than UIO_MAXIOV.
- Linearize part of skb when userspace provides vectors grater than MAX_SKB_FRAGS.
- Return error when userspace provides vectors whose total length may exceed
- MAX_SKB_FRAGS * PAGE_SIZE.

Signed-off-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Commit author: Jason Wang

Vulnerable version (before fix):
 static int zerocopy_sg_from_iovec(struct sk_buff *skb, const struct iovec *from, 		} 		base = (unsigned long)from->iov_base + offset; 		size = ((base & ~PAGE_MASK) + len + ~PAGE_MASK) >> PAGE_SHIFT; 		num_pages = get_user_pages_fast(base, size, 0, &page[i]); 		if ((num_pages != size) || 		    (num_pages > MAX_SKB_FRAGS - skb_shinfo(skb)->nr_frags)) { 			for (i = 0; i < num_pages; i++) 				put_page(page[i]); 			return -EFAULT; static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m, 	int err; 	struct virtio_net_hdr vnet_hdr = { 0 }; 	int vnet_hdr_len = 0; 	int copylen; 	bool zerocopy = false;  	if (q->flags & IFF_VNET_HDR) { static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m, 	if (unlikely(len < ETH_HLEN)) 		goto err;  	if (m && m->msg_control && sock_flag(&q->sk, SOCK_ZEROCOPY)) 		zerocopy = true;  	if (zerocopy) { 		/* There are 256 bytes to be copied in skb, so there is enough 		 * room for skb expand head in case it is used. 		 * The rest buffer is mapped from userspace. 		 */ 		copylen = vnet_hdr.hdr_len; 		if (!copylen) 			copylen = GOODCOPY_LEN; 	} else

Fixed version (after fix):
 static int zerocopy_sg_from_iovec(struct sk_buff *skb, const struct iovec *from, 		} 		base = (unsigned long)from->iov_base + offset; 		size = ((base & ~PAGE_MASK) + len + ~PAGE_MASK) >> PAGE_SHIFT; 		if (i + size > MAX_SKB_FRAGS) 			return -EMSGSIZE; 		num_pages = get_user_pages_fast(base, size, 0, &page[i]); 		if (num_pages != size) { 			for (i = 0; i < num_pages; i++) 				put_page(page[i]); 			return -EFAULT; static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m, 	int err; 	struct virtio_net_hdr vnet_hdr = { 0 }; 	int vnet_hdr_len = 0; 	int copylen = 0; 	bool zerocopy = false;  	if (q->flags & IFF_VNET_HDR) { static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m, 	if (unlikely(len < ETH_HLEN)) 		goto err;  	err = -EMSGSIZE; 	if (unlikely(count > UIO_MAXIOV)) 		goto err;  	if (m && m->msg_control && sock_flag(&q->sk, SOCK_ZEROCOPY)) 		zerocopy = true;  	if (zerocopy) { 		/* Userspace may produce vectors with count greater than 		 * MAX_SKB_FRAGS, so we need to linearize parts of the skb 		 * to let the rest of data to be fit in the frags. 		 */ 		if (count > MAX_SKB_FRAGS) { 			copylen = iov_length(iv, count - MAX_SKB_FRAGS); 			if (copylen < vnet_hdr_len) 				copylen = 0; 			else 				copylen -= vnet_hdr_len; 		} 		/* There are 256 bytes to be copied in skb, so there is enough 		 * room for skb expand head in case it is used. 		 * The rest buffer is mapped from userspace. 		 */ 		if (copylen < vnet_hdr.hdr_len) 			copylen = vnet_hdr.hdr_len; 		if (!copylen) 			copylen = GOODCOPY_LEN; 	} else

Patch:
patch: @@ -529,9 +529,10 @@ static int zerocopy_sg_from_iovec(struct sk_buff *skb, const struct iovec *from,
 		}
 		base = (unsigned long)from->iov_base + offset;
 		size = ((base & ~PAGE_MASK) + len + ~PAGE_MASK) >> PAGE_SHIFT;
+		if (i + size > MAX_SKB_FRAGS)
+			return -EMSGSIZE;
 		num_pages = get_user_pages_fast(base, size, 0, &page[i]);
-		if ((num_pages != size) ||
-		    (num_pages > MAX_SKB_FRAGS - skb_shinfo(skb)->nr_frags)) {
+		if (num_pages != size) {
 			for (i = 0; i < num_pages; i++)
 				put_page(page[i]);
 			return -EFAULT;
@@ -651,7 +652,7 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
 	int err;
 	struct virtio_net_hdr vnet_hdr = { 0 };
 	int vnet_hdr_len = 0;
-	int copylen;
+	int copylen = 0;
 	bool zerocopy = false;
 
 	if (q->flags & IFF_VNET_HDR) {
@@ -680,15 +681,31 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
 	if (unlikely(len < ETH_HLEN))
 		goto err;
 
+	err = -EMSGSIZE;
+	if (unlikely(count > UIO_MAXIOV))
+		goto err;
+
 	if (m && m->msg_control && sock_flag(&q->sk, SOCK_ZEROCOPY))
 		zerocopy = true;
 
 	if (zerocopy) {
+		/* Userspace may produce vectors with count greater than
+		 * MAX_SKB_FRAGS, so we need to linearize parts of the skb
+		 * to let the rest of data to be fit in the frags.
+		 */
+		if (count > MAX_SKB_FRAGS) {
+			copylen = iov_length(iv, count - MAX_SKB_FRAGS);
+			if (copylen < vnet_hdr_len)
+				copylen = 0;
+			else
+				copylen -= vnet_hdr_len;
+		}
 		/* There are 256 bytes to be copied in skb, so there is enough
 		 * room for skb expand head in case it is used.
 		 * The rest buffer is mapped from userspace.
 		 */
-		copylen = vnet_hdr.hdr_len;
+		if (copylen < vnet_hdr.hdr_len)
+			copylen = vnet_hdr.hdr_len;
 		if (!copylen)
 			copylen = GOODCOPY_LEN;
 	} else
path: drivers/net/macvtap.c