netdev - RE: [PATCH net v5] virtio-net: fix received length check in big packets

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID:
 <CY8PR12MB71958D2281DFAB75D5602C9CDCFCA@CY8PR12MB7195.namprd12.prod.outlook.com>
Date: Mon, 27 Oct 2025 15:16:27 +0000
From: Parav Pandit <parav@...dia.com>
To: Bui Quang Minh <minhquangbui99@...il.com>, "netdev@...r.kernel.org"
	<netdev@...r.kernel.org>
CC: "Michael S. Tsirkin" <mst@...hat.com>, Jason Wang <jasowang@...hat.com>,
	Xuan Zhuo <xuanzhuo@...ux.alibaba.com>, Eugenio Pérez
	<eperezma@...hat.com>, Andrew Lunn <andrew+netdev@...n.ch>, "David S. Miller"
	<davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>, Jakub Kicinski
	<kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, "Minggang(Gavin) Li"
	<gavinl@...dia.com>, Gavi Teitz <gavi@...dia.com>,
	"virtualization@...ts.linux.dev" <virtualization@...ts.linux.dev>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"stable@...r.kernel.org" <stable@...r.kernel.org>
Subject: RE: [PATCH net v5] virtio-net: fix received length check in big
 packets


> From: Bui Quang Minh <minhquangbui99@...il.com>
> Sent: 27 October 2025 08:36 PM

[..]
> >>
> >> The check is already there before this commit, but it is not correct
> >> since the changes in commit 4959aebba8c0 ("virtio-net: use mtu size
> >> as buffer length for big packets"). So this patch fixes the check
> >> corresponding to the new change. I think this is a valid use of Fixes tag.
> > I am missing something.
> > If you don’t have the broken device, what part if wrong in the patch which
> needs fixes tag?
> 
> The host can load the own vhost_net driver and sends the incorrect length.
> IMHO, it's good to sanity check the received input.
> 
> The check
> 
>      if (unlikely(len > MAX_SKB_FRAGS * PAGE_SIZE))
>          goto err;
> 
> is wrong because the allocated buffer is (vi->big_packets_num_skbfrags +
> 1) * PAGE_SIZE not MAX_SKB_FRAGS * PAGE_SIZE anymore.
> vi->big_packets_num_skbfrags depends on the negotiated mtu between host
> and guest when guest_gso is off as in function virtnet_set_big_packets.
> 
> Thanks,
> Quang Minh.

Got it. Yes, listed commit missed to consider length check here based on the mtu.
Thanks.