averello/linux-stable-mirror
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2026-09-22 09:34:56 +02:00
Code Issues Packages Projects Releases Wiki Activity

virtio-net: fix len check in receive_big()

Browse Source 
[ Upstream commit 9e5ad06ea8 ]

receive_big() bounds the device-announced length by
(big_packets_num_skbfrags + 1) * PAGE_SIZE.  That is still too loose:
add_recvbuf_big() sets sg[1] to start at offset
sizeof(struct padded_vnet_hdr) into the first page, so the chain
actually carries hdr_len + (PAGE_SIZE - sizeof(padded_vnet_hdr)) +
big_packets_num_skbfrags * PAGE_SIZE bytes -- 20 bytes less than the
check allows for the common hdr_len == 12 case.

A malicious virtio backend can announce a len in that gap.  page_to_skb()
then walks one frag past the page chain, storing a NULL page->private
into skb_shinfo()->frags[MAX_SKB_FRAGS], which is both an out-of-bounds
write past the static frag array and a NULL frag handed up the rx path.

Bound len by the size add_recvbuf_big() actually advertised.

Fixes: 0c71670396 ("virtio-net: fix received length check in big packets")
Reported-by: Weiming Shi <bestswngs@gmail.com>
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Reviewed-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Bui Quang Minh <minhquangbui99@gmail.com>
Link: https://patch.msgid.link/20260616042837.2249468-1-xmei5@asu.edu
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Xiang Mei
2026-07-24 16:03:19 +02:00
committed by Greg Kroah-Hartman
parent 154e29d0c6
commit 38e94d63e2
1 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/net/virtio_net.c
+6 -3
View File
@@ -1334,15 +1334,18 @@ static struct sk_buff *receive_big(struct net_device *dev,
struct virtnet_rq_stats *stats)
{
struct page *page = buf;
unsigned long max_len;
struct sk_buff *skb;
max_len = (vi->big_packets_num_skbfrags + 1) * PAGE_SIZE -
sizeof(struct padded_vnet_hdr) + vi->hdr_len;
/* Make sure that len does not exceed the size allocated in
* add_recvbuf_big.
*/
if (unlikely(len > (vi->big_packets_num_skbfrags + 1) * PAGE_SIZE)) {
if (unlikely(len > max_len)) {
pr_debug("%s: rx error: len %u exceeds allocated size %lu\n",
dev->name, len,
(vi->big_packets_num_skbfrags + 1) * PAGE_SIZE);
dev->name, len, max_len);
goto err;
}