vhost: check message header size read

[ upstream commit 966f89d ]

This patch adds a check to ensure the read size of
the Vhost-user message header is not smaller than
the expected size.

In case of unexpected read size, report an error
and close file descriptors passed with the message,
if any.

Fixes: 8f97231 ("vhost: support vhost-user")

Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Maxime Coquelin <maxime.coquelin@redhat.com>
Reviewed-by: Tiwei Bie <tiwei.bie@intel.com>

lib/librte_vhost/vhost_user.c

@@ -1997,8 +1997,14 @@ read_vhost_message(int sockfd, struct VhostUserMsg *msg)
 
 	ret = read_fd_message(sockfd, (char *)msg, VHOST_USER_HDR_SIZE,
 		msg->fds, VHOST_MEMORY_MAX_NREGIONS, &msg->fd_num);
-	if (ret <= 0)
+	if (ret <= 0) {
 		return ret;
+	} else if (ret != VHOST_USER_HDR_SIZE) {
+		RTE_LOG(ERR, VHOST_CONFIG,
+			"Unexpected header size read\n");
+		close_msg_fds(msg);
+		return -1;
+	}
 
 	if (msg->size) {
 		if (msg->size > sizeof(msg->payload)) {