netdev - Re: [PATCH net] virtio_net: fix header access in big

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1760662656.1338146-1-xuanzhuo@linux.alibaba.com>
Date: Fri, 17 Oct 2025 08:57:36 +0800
From: Xuan Zhuo <xuanzhuo@...ux.alibaba.com>
To: Wen Xin <w_xin@...le.com>
Cc: mst@...hat.com,
 jasowang@...hat.com,
 eperezma@...hat.com,
 virtualization@...ts.linux.dev,
 Wen Xin <w_xin@...le.com>,
 netdev@...r.kernel.org
Subject: Re: [PATCH net] virtio_net: fix header access in big_packets mode

http://lore.kernel.org/all/20251013020629.73902-1-xuanzhuo@linux.alibaba.com

do the same thing.


On Thu, 16 Oct 2025 15:33:05 -0700, Wen Xin <w_xin@...le.com> wrote:
> In Linux virtio-net driver's (drivers/net/virtio_net.c) big packets mode (vi->big_packets && vi->mergeable_rx_bufs), the buf
> pointer passed to receive_buf() is a struct page pointer, not a buffer
> pointer. The current code incorrectly casts this page pointer directly as
> a virtio_net_common_hdr, causing it to read flags from the page struct
> memory instead of the actual packet data.
>
> Signed-off-by: Wen Xin <w_xin@...le.com>
> ---
>  drivers/net/virtio_net.c | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
> index 7646ddd9bef7..c10f5585bc88 100644
> --- a/drivers/net/virtio_net.c
> +++ b/drivers/net/virtio_net.c
> @@ -2566,7 +2566,13 @@ static void receive_buf(struct virtnet_info *vi, struct receive_queue *rq,
>  	 * virtnet_xdp_set()), so packets marked as
>  	 * VIRTIO_NET_HDR_F_NEEDS_CSUM get dropped during XDP processing.
>  	 */
> -	flags = ((struct virtio_net_common_hdr *)buf)->hdr.flags;
> +	if (vi->big_packets && !vi->mergeable_rx_bufs) {
> +		struct virtio_net_common_hdr *hdr = page_address((struct page *)buf);
> +
> +		flags = hdr->hdr.flags;
> +	} else {
> +		flags = ((struct virtio_net_common_hdr *)buf)->hdr.flags;
> +	}
>
>  	if (vi->mergeable_rx_bufs)
>  		skb = receive_mergeable(dev, vi, rq, buf, ctx, len, xdp_xmit,
> --
> 2.39.5 (Apple Git-154)
>