netdev - [PATCH net] virtio_net: fix header access in big

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-id: <20251016223305.51435-1-w_xin@apple.com>
Date: Thu, 16 Oct 2025 15:33:05 -0700
From: Wen Xin <w_xin@...le.com>
To: netdev@...r.kernel.org
Cc: mst@...hat.com, jasowang@...hat.com, xuanzhuo@...ux.alibaba.com,
 eperezma@...hat.com, virtualization@...ts.linux.dev, Wen Xin <w_xin@...le.com>
Subject: [PATCH net] virtio_net: fix header access in big_packets mode

In Linux virtio-net driver's (drivers/net/virtio_net.c) big packets mode (vi->big_packets && vi->mergeable_rx_bufs), the buf
pointer passed to receive_buf() is a struct page pointer, not a buffer
pointer. The current code incorrectly casts this page pointer directly as
a virtio_net_common_hdr, causing it to read flags from the page struct
memory instead of the actual packet data.

Signed-off-by: Wen Xin <w_xin@...le.com>
---
 drivers/net/virtio_net.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 7646ddd9bef7..c10f5585bc88 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -2566,7 +2566,13 @@ static void receive_buf(struct virtnet_info *vi, struct receive_queue *rq,
 	 * virtnet_xdp_set()), so packets marked as
 	 * VIRTIO_NET_HDR_F_NEEDS_CSUM get dropped during XDP processing.
 	 */
-	flags = ((struct virtio_net_common_hdr *)buf)->hdr.flags;
+	if (vi->big_packets && !vi->mergeable_rx_bufs) {
+		struct virtio_net_common_hdr *hdr = page_address((struct page *)buf);
+
+		flags = hdr->hdr.flags;
+	} else {
+		flags = ((struct virtio_net_common_hdr *)buf)->hdr.flags;
+	}
 
 	if (vi->mergeable_rx_bufs)
 		skb = receive_mergeable(dev, vi, rq, buf, ctx, len, xdp_xmit,
-- 
2.39.5 (Apple Git-154)