netdev - Re: [PATCH net 4/7] virtio_net: Fix out of bounds access of sq

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 17 Jan 2019 20:42:16 +0800
From:   Jason Wang <jasowang@...hat.com>
To:     Toshiaki Makita <makita.toshiaki@....ntt.co.jp>,
        "David S. Miller" <davem@...emloft.net>,
        "Michael S. Tsirkin" <mst@...hat.com>
Cc:     netdev@...r.kernel.org, virtualization@...ts.linux-foundation.org
Subject: Re: [PATCH net 4/7] virtio_net: Fix out of bounds access of sq


On 2019/1/17 下午7:20, Toshiaki Makita wrote:
> When XDP is disabled, curr_queue_pairs + smp_processor_id() can be
> larger than max_queue_pairs.
> There is no guarantee that we have enough XDP send queues dedicated for
> each cpu when XDP is disabled, so do not count drops on sq in that case.
>
> Fixes: 5b8f3c8d30a6 ("virtio_net: Add XDP related stats")
> Signed-off-by: Toshiaki Makita <makita.toshiaki@....ntt.co.jp>
> ---
>   drivers/net/virtio_net.c | 17 +++++++----------
>   1 file changed, 7 insertions(+), 10 deletions(-)
>
> diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
> index 670cc15..204eedf 100644
> --- a/drivers/net/virtio_net.c
> +++ b/drivers/net/virtio_net.c
> @@ -491,20 +491,17 @@ static int virtnet_xdp_xmit(struct net_device *dev,
>   	int ret, err;
>   	int i;
>   
> -	sq = virtnet_xdp_sq(vi);
> -
> -	if (unlikely(flags & ~XDP_XMIT_FLAGS_MASK)) {
> -		ret = -EINVAL;
> -		drops = n;
> -		goto out;
> -	}
> -
>   	/* Only allow ndo_xdp_xmit if XDP is loaded on dev, as this
>   	 * indicate XDP resources have been successfully allocated.
>   	 */
>   	xdp_prog = rcu_dereference(rq->xdp_prog);
> -	if (!xdp_prog) {
> -		ret = -ENXIO;
> +	if (!xdp_prog)
> +		return -ENXIO;
> +
> +	sq = virtnet_xdp_sq(vi);
> +
> +	if (unlikely(flags & ~XDP_XMIT_FLAGS_MASK)) {
> +		ret = -EINVAL;
>   		drops = n;
>   		goto out;
>   	}


Acked-by: Jason Wang <jasowang@...hat.com>