linux-kernel - [PATCH] virtio-net: make copy len check in xdp_linearize

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 13 Dec 2021 12:50:12 +0800
From:   mengensun8801@...il.com
To:     jasowang@...hat.com
Cc:     davem@...emloft.net, kuba@...nel.org, ast@...nel.org,
        daniel@...earbox.net, hawk@...nel.org, john.fastabend@...il.com,
        virtualization@...ts.linux-foundation.org, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org, bpf@...r.kernel.org,
        mengensun <mengensun@...cent.com>,
        MengLong Dong <imagedong@...cent.com>,
        ZhengXiong Jiang <mungerjiang@...cent.com>
Subject: [PATCH] virtio-net: make copy len check in xdp_linearize_page

From: mengensun <mengensun@...cent.com>

xdp_linearize_page asume ring elem size is smaller then page size
when copy the first ring elem, but, there may be a elem size bigger
then page size.

add_recvbuf_mergeable may add a hole to ring elem, the hole size is
not sure, according EWMA.

so, fix it by check copy len,if checked failed, just dropped the
whole frame, not make the memory dirty after the page.

Signed-off-by: mengensun <mengensun@...cent.com>
Reviewed-by: MengLong Dong <imagedong@...cent.com>
Reviewed-by: ZhengXiong Jiang <mungerjiang@...cent.com>
---
 drivers/net/virtio_net.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 36a4b7c195d5..844bdbd67ff7 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -662,8 +662,12 @@ static struct page *xdp_linearize_page(struct receive_queue *rq,
 				       int page_off,
 				       unsigned int *len)
 {
-	struct page *page = alloc_page(GFP_ATOMIC);
+	struct page *page;
 
+	if (*len > PAGE_SIZE - page_off)
+		return NULL;
+
+	page = alloc_page(GFP_ATOMIC);
 	if (!page)
 		return NULL;
 
-- 
2.27.0