File Avoids-uncontrolled-active_xfers-allocations.patch of Package spice-vdagent.17026

Overview Repositories Revisions Requests Users Attributes Meta

File Avoids-uncontrolled-active_xfers-allocations.patch of Package spice-vdagent.17026

From cb4a455c6f5cc962f0d9f7b2442b2368e02e5895 Mon Sep 17 00:00:00 2001
From: Frediano Ziglio <freddy77@gmail.com>
Date: Fri, 2 Oct 2020 12:27:59 +0100
Subject: [PATCH 14/20] Avoids uncontrolled "active_xfers" allocations

Git-commit: d5b840fc436a10a1133fee4acf48e00417cc5a59
References: bsc#1173749

Limit the number of active file transfers possibly causing DoSes
consuming memory in "active_xfers".

This issue was reported by SUSE security team.

Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
Acked-by: Uri Lublin <uril@redhat.com>
Signed-off-by: Bruce Rogers <brogers@suse.com>
---
 src/vdagentd/vdagentd.c | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/src/vdagentd/vdagentd.c b/src/vdagentd/vdagentd.c
index 52b7855..add3fab 100644
--- a/src/vdagentd/vdagentd.c
+++ b/src/vdagentd/vdagentd.c
@@ -47,6 +47,14 @@
 
 #define DEFAULT_UINPUT_DEVICE "/dev/uinput"
 
+// Maximum number of transfers active at any time.
+// Avoid DoS from client.
+// As each transfer could likely end up taking a file descriptor
+// it is good to have a limit less than the number of file descriptors
+// in the process (by default 1024). The daemon do not open file
+// descriptors for the transfers but the agents do.
+#define MAX_ACTIVE_TRANSFERS 128
+
 struct agent_data {
     char *session;
     int width;
@@ -358,6 +366,21 @@ static void do_client_file_xfer(struct vdagent_virtio_port *vport,
                "Cancelling client file-xfer request %u",
                s->id, VD_AGENT_FILE_XFER_STATUS_SESSION_LOCKED, NULL, 0);
             return;
+        } else if (g_hash_table_size(active_xfers) >= MAX_ACTIVE_TRANSFERS) {
+            VDAgentFileXferStatusError error = {
+                GUINT32_TO_LE(VD_AGENT_FILE_XFER_STATUS_ERROR_GLIB_IO),
+                GUINT32_TO_LE(G_IO_ERROR_TOO_MANY_OPEN_FILES),
+            };
+            size_t detail_size = sizeof(error);
+            if (!VD_AGENT_HAS_CAPABILITY(capabilities, capabilities_size,
+                                         VD_AGENT_CAP_FILE_XFER_DETAILED_ERRORS)) {
+                detail_size = 0;
+            }
+            send_file_xfer_status(vport,
+               "Too many transfers ongoing. "
+               "Cancelling client file-xfer request %u",
+               s->id, VD_AGENT_FILE_XFER_STATUS_ERROR, (void*) &error, detail_size);
+            return;
         }
         msg_type = VDAGENTD_FILE_XFER_START;
         id = s->id;
-- 
2.29.0

Places

File Avoids-uncontrolled-active_xfers-allocations.patch of Package spice-vdagent.17026

Places