netdev - [PATCH bpf-next] bpf: fix virtio-net's length calc for XDP

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 22 Apr 2018 21:16:48 -0700
From:   "Nikita V. Shirokov" <tehnerd@...nerd.com>
To:     Alexei Starovoitov <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        "Michael S. Tsirkin" <mst@...hat.com>,
        Jason Wang <jasowang@...hat.com>
Cc:     netdev@...r.kernel.org, David Ahern <dsahern@...il.com>,
        "Nikita V. Shirokov" <tehnerd@...nerd.com>
Subject: [PATCH bpf-next] bpf: fix virtio-net's length calc for XDP_PASS

In commit 6870de435b90 ("bpf: make virtio compatible w/ 
bpf_xdp_adjust_tail") i didn't account for vi->hdr_len during new 
packet's length calculation after bpf_prog_run in receive_mergeable. 
because of this all packets, if they were passed to the kernel, 
were truncated by 12 bytes.

Fixes:6870de435b90 ("bpf: make virtio compatible w/ bpf_xdp_adjust_tail")
Reported-by: David Ahern <dsahern@...il.com>

Signed-off-by: Nikita V. Shirokov <tehnerd@...nerd.com>
---

Notes:
    unfortunately it looks like that xdp_tx is still broken because
    fix by Jason (introduced in "XDP_TX for virtio_net not working in recent kernel?
    " thread) haven't landed yet)

 drivers/net/virtio_net.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 779a4f798522..08ac2cc986aa 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -761,7 +761,7 @@ static struct sk_buff *receive_mergeable(struct net_device *dev,
 			/* recalculate len if xdp.data or xdp.data_end were
 			 * adjusted
 			 */
-			len = xdp.data_end - xdp.data;
+			len = xdp.data_end - xdp.data + vi->hdr_len;
 			/* We can only create skb based on xdp_page. */
 			if (unlikely(xdp_page != page)) {
 				rcu_read_unlock();
-- 
2.15.1