um: vector: reject interface specifications with too many arguments

[PATCH] um: vector: reject interface specifications with too many arguments

Posted by Pengpeng Hou 1 month, 4 weeks ago

uml_parse_vector_ifspec() stores parsed key/value pairs in the fixed
struct arglist token and value arrays, which are both sized to MAXVARGS.
The parser increments numargs as it discovers pairs, but it never checks
whether another slot is still available before writing into the arrays.

Reject interface specifications that exceed MAXVARGS instead of writing
past the end of the fixed argument arrays.

Fixes: 49da7e64f33e ("High Performance UML Vector Network Driver")

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
 arch/um/drivers/vector_user.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/um/drivers/vector_user.c b/arch/um/drivers/vector_user.c
index 2ea67e6fd067..3bee634f2102 100644
--- a/arch/um/drivers/vector_user.c
+++ b/arch/um/drivers/vector_user.c
@@ -93,6 +93,9 @@ struct arglist *uml_parse_vector_ifspec(char *arg)
 	len = strlen(arg);
 	for (pos = 0; pos < len; pos++) {
 		if (next_starts) {
+			if (result->numargs >= MAXVARGS)
+				goto cleanup;
+
 			if (parsing_token) {
 				result->tokens[result->numargs] = arg + pos;
 			} else {
-- 
2.50.1 (Apple Git-155)

Re: [PATCH] um: vector: reject interface specifications with too many arguments

Posted by Johannes Berg 1 month, 4 weeks ago

On Fri, 2026-04-17 at 15:37 +0800, Pengpeng Hou wrote:
> 
> Fixes: 49da7e64f33e ("High Performance UML Vector Network Driver")
> 
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>

There should be no blank line here.

johannes

[PATCH v2] um: vector: reject too many interface arguments

Posted by Pengpeng Hou 1 month, 3 weeks ago

uml_parse_vector_ifspec() stores parsed key/value pairs in the fixed
struct arglist token and value arrays, which are both sized to MAXVARGS.
The parser increments numargs as it discovers pairs, but it never checks
whether another slot is still available before writing into the arrays.

Reject interface specifications that exceed MAXVARGS instead of writing
past the end of the fixed argument arrays.

Fixes: 49da7e64f33e ("High Performance UML Vector Network Driver")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
Changes since v1:
- remove the blank line between Fixes and Signed-off-by

diff --git a/arch/um/drivers/vector_user.c b/arch/um/drivers/vector_user.c
index 2ea67e6fd067..3bee634f2102 100644
--- a/arch/um/drivers/vector_user.c
+++ b/arch/um/drivers/vector_user.c
@@ -93,6 +93,9 @@ struct arglist *uml_parse_vector_ifspec(char *arg)
 	len = strlen(arg);
 	for (pos = 0; pos < len; pos++) {
 		if (next_starts) {
+			if (result->numargs >= MAXVARGS)
+				goto cleanup;
+
 			if (parsing_token) {
 				result->tokens[result->numargs] = arg + pos;
 			} else {
-- 
2.50.1 (Apple Git-155)