[PATCH] um: vector: reject interface specifications with too many arguments

[Pengpeng Hou]

uml_parse_vector_ifspec() stores parsed key/value pairs in the fixed
struct arglist token and value arrays, which are both sized to MAXVARGS.
The parser increments numargs as it discovers pairs, but it never checks
whether another slot is still available before writing into the arrays.

Reject interface specifications that exceed MAXVARGS instead of writing
past the end of the fixed argument arrays.

Fixes: 49da7e64f33e ("High Performance UML Vector Network Driver")

Signed-off-by: Pengpeng Hou <pengpeng@xxxxxxxxxxx>
---
 arch/um/drivers/vector_user.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/um/drivers/vector_user.c b/arch/um/drivers/vector_user.c
index 2ea67e6fd067..3bee634f2102 100644
--- a/arch/um/drivers/vector_user.c
+++ b/arch/um/drivers/vector_user.c
@@ -93,6 +93,9 @@ struct arglist *uml_parse_vector_ifspec(char *arg)
 	len = strlen(arg);
 	for (pos = 0; pos < len; pos++) {
 		if (next_starts) {
+			if (result->numargs >= MAXVARGS)
+				goto cleanup;
+
 			if (parsing_token) {
 				result->tokens[result->numargs] = arg + pos;
 			} else {
-- 
2.50.1 (Apple Git-155)