netdev - [PATCH] hv_netvsc: Fix potentionally overflow in netvsc_xdp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <1634094275-1773464-1-git-send-email-jiasheng@iscas.ac.cn>
Date:   Wed, 13 Oct 2021 03:04:35 +0000
From:   Jiasheng Jiang <jiasheng@...as.ac.cn>
To:     kys@...rosoft.com, haiyangz@...rosoft.com, sthemmin@...rosoft.com,
        wei.liu@...nel.org, decui@...rosoft.com, davem@...emloft.net,
        kuba@...nel.org, ast@...nel.org, daniel@...earbox.net,
        hawk@...nel.org, john.fastabend@...il.com, andrii@...nel.org,
        kafai@...com, songliubraving@...com, yhs@...com, kpsingh@...nel.org
Cc:     linux-hyperv@...r.kernel.org, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org, bpf@...r.kernel.org,
        Jiasheng Jiang <jiasheng@...as.ac.cn>
Subject: [PATCH] hv_netvsc: Fix potentionally overflow in netvsc_xdp_xmit()

Adding skb_rx_queue_recorded() to avoid the value of skb->queue_mapping
to be 0. Otherwise the return value of skb_get_rx_queue() could be MAX_U16
cause by overflow.

Fixes: 351e158 ("hv_netvsc: Add XDP support")
Signed-off-by: Jiasheng Jiang <jiasheng@...as.ac.cn>
---
 drivers/net/hyperv/netvsc_drv.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index f682a55..e51201e 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -807,7 +807,7 @@ static void netvsc_xdp_xmit(struct sk_buff *skb, struct net_device *ndev)
 {
 	int rc;
 
-	skb->queue_mapping = skb_get_rx_queue(skb);
+	skb->queue_mapping = skb_rx_queue_recorded(skb) ? skb_get_rx_queue(skb) : 0;
 	__skb_push(skb, ETH_HLEN);
 
 	rc = netvsc_xmit(skb, ndev, true);
-- 
2.7.4