[PATCH] net/virtio: fix Rx checksum calculation

[PATCH] net/virtio: fix Rx checksum calculation

[Maxime Coquelin]

From: Olivier Matz <olivier.matz@6wind.com>

If hdr->csum_start is larger than packet length, the len argument passed
to rte_raw_cksum_mbuf() overflows and causes a segmentation fault.

Ignore checksum computation in this case.

CVE-2024-11614

Fixes: ca7036b4af3a ("vhost: fix offload flags in Rx path")

Signed-off-by: Maxime Gouin <maxime.gouin@6wind.com>
Signed-off-by: Olivier Matz <olivier.matz@6wind.com>
Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com>
---
 lib/vhost/virtio_net.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/vhost/virtio_net.c b/lib/vhost/virtio_net.c
index d764d4bc6a..69901ab3b5 100644
--- a/lib/vhost/virtio_net.c
+++ b/lib/vhost/virtio_net.c
@@ -2823,6 +2823,9 @@ vhost_dequeue_offload(struct virtio_net *dev, struct virtio_net_hdr *hdr,
 			 */
 			uint16_t csum = 0, off;
 
+			if (hdr->csum_start >= rte_pktmbuf_pkt_len(m))
+				return;
+
 			if (rte_raw_cksum_mbuf(m, hdr->csum_start,
 					rte_pktmbuf_pkt_len(m) - hdr->csum_start, &csum) < 0)
 				return;
-- 
2.47.0

RE: [PATCH] net/virtio: fix Rx checksum calculation

[Wangyunjian(wangyunjian,TongTu)]

> -----Original Message-----
> From: Maxime Coquelin [mailto:maxime.coquelin@redhat.com]
> Sent: Tuesday, December 17, 2024 11:33 PM
> To: dev@dpdk.org
> Cc: Olivier Matz <olivier.matz@6wind.com>; Maxime Gouin
> <maxime.gouin@6wind.com>; Maxime Coquelin
> <maxime.coquelin@redhat.com>
> Subject: [PATCH] net/virtio: fix Rx checksum calculation
> 
> From: Olivier Matz <olivier.matz@6wind.com>
> 
> If hdr->csum_start is larger than packet length, the len argument passed
> to rte_raw_cksum_mbuf() overflows and causes a segmentation fault.
> 
> Ignore checksum computation in this case.
> 
> CVE-2024-11614
> 
> Fixes: ca7036b4af3a ("vhost: fix offload flags in Rx path")
> 
> Signed-off-by: Maxime Gouin <maxime.gouin@6wind.com>
> Signed-off-by: Olivier Matz <olivier.matz@6wind.com>
> Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com>
> ---
>  lib/vhost/virtio_net.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/lib/vhost/virtio_net.c b/lib/vhost/virtio_net.c
> index d764d4bc6a..69901ab3b5 100644
> --- a/lib/vhost/virtio_net.c
> +++ b/lib/vhost/virtio_net.c
> @@ -2823,6 +2823,9 @@ vhost_dequeue_offload(struct virtio_net *dev,
> struct virtio_net_hdr *hdr,
>  			 */
>  			uint16_t csum = 0, off;
> 
> +			if (hdr->csum_start >= rte_pktmbuf_pkt_len(m))
> +				return;
> +

The hdr->csum_start does two successive reads from user space to read
a variable length data structure. The result overflow if the data structure
changes between the two reads.

We can prevent double fetch issue by using the temporary variable csum_start.

Thanks,
Yunjian

>  			if (rte_raw_cksum_mbuf(m, hdr->csum_start,
>  					rte_pktmbuf_pkt_len(m) - hdr->csum_start, &csum) <
> 0)
>  				return;
> --
> 2.47.0

Re: [PATCH] net/virtio: fix Rx checksum calculation

[Maxime Coquelin]

Hi,

On 12/18/24 08:34, Wangyunjian(wangyunjian,TongTu) wrote:
>> -----Original Message-----
>> From: Maxime Coquelin [mailto:maxime.coquelin@redhat.com]
>> Sent: Tuesday, December 17, 2024 11:33 PM
>> To: dev@dpdk.org
>> Cc: Olivier Matz <olivier.matz@6wind.com>; Maxime Gouin
>> <maxime.gouin@6wind.com>; Maxime Coquelin
>> <maxime.coquelin@redhat.com>
>> Subject: [PATCH] net/virtio: fix Rx checksum calculation
>>
>> From: Olivier Matz <olivier.matz@6wind.com>
>>
>> If hdr->csum_start is larger than packet length, the len argument passed
>> to rte_raw_cksum_mbuf() overflows and causes a segmentation fault.
>>
>> Ignore checksum computation in this case.
>>
>> CVE-2024-11614
>>
>> Fixes: ca7036b4af3a ("vhost: fix offload flags in Rx path")
>>
>> Signed-off-by: Maxime Gouin <maxime.gouin@6wind.com>
>> Signed-off-by: Olivier Matz <olivier.matz@6wind.com>
>> Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com>
>> ---
>>   lib/vhost/virtio_net.c | 3 +++
>>   1 file changed, 3 insertions(+)
>>
>> diff --git a/lib/vhost/virtio_net.c b/lib/vhost/virtio_net.c
>> index d764d4bc6a..69901ab3b5 100644
>> --- a/lib/vhost/virtio_net.c
>> +++ b/lib/vhost/virtio_net.c
>> @@ -2823,6 +2823,9 @@ vhost_dequeue_offload(struct virtio_net *dev,
>> struct virtio_net_hdr *hdr,
>>   			 */
>>   			uint16_t csum = 0, off;
>>
>> +			if (hdr->csum_start >= rte_pktmbuf_pkt_len(m))
>> +				return;
>> +
> 
> The hdr->csum_start does two successive reads from user space to read
> a variable length data structure. The result overflow if the data structure
> changes between the two reads.
> 
> We can prevent double fetch issue by using the temporary variable csum_start.

Right, that's a good catch! The exploitation od this issue seem
difficult though.

We may systematically copy the full header, as we only do it for ones
not contiguous in host VA space.

What do you think? Are you willing to contribute a fix?

Thanks,
Maxime
> 
> Thanks,
> Yunjian
> 
>>   			if (rte_raw_cksum_mbuf(m, hdr->csum_start,
>>   					rte_pktmbuf_pkt_len(m) - hdr->csum_start, &csum) <
>> 0)
>>   				return;
>> --
>> 2.47.0
> 

Re: [PATCH] net/virtio: fix Rx checksum calculation

[Olivier Matz]

Hi,

On Wed, Dec 18, 2024 at 09:59:05AM +0100, Maxime Coquelin wrote:
> Hi,
> 
> On 12/18/24 08:34, Wangyunjian(wangyunjian,TongTu) wrote:
> > > -----Original Message-----
> > > From: Maxime Coquelin [mailto:maxime.coquelin@redhat.com]
> > > Sent: Tuesday, December 17, 2024 11:33 PM
> > > To: dev@dpdk.org
> > > Cc: Olivier Matz <olivier.matz@6wind.com>; Maxime Gouin
> > > <maxime.gouin@6wind.com>; Maxime Coquelin
> > > <maxime.coquelin@redhat.com>
> > > Subject: [PATCH] net/virtio: fix Rx checksum calculation
> > > 
> > > From: Olivier Matz <olivier.matz@6wind.com>
> > > 
> > > If hdr->csum_start is larger than packet length, the len argument passed
> > > to rte_raw_cksum_mbuf() overflows and causes a segmentation fault.
> > > 
> > > Ignore checksum computation in this case.
> > > 
> > > CVE-2024-11614
> > > 
> > > Fixes: ca7036b4af3a ("vhost: fix offload flags in Rx path")
> > > 
> > > Signed-off-by: Maxime Gouin <maxime.gouin@6wind.com>
> > > Signed-off-by: Olivier Matz <olivier.matz@6wind.com>
> > > Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com>
> > > ---
> > >   lib/vhost/virtio_net.c | 3 +++
> > >   1 file changed, 3 insertions(+)
> > > 
> > > diff --git a/lib/vhost/virtio_net.c b/lib/vhost/virtio_net.c
> > > index d764d4bc6a..69901ab3b5 100644
> > > --- a/lib/vhost/virtio_net.c
> > > +++ b/lib/vhost/virtio_net.c
> > > @@ -2823,6 +2823,9 @@ vhost_dequeue_offload(struct virtio_net *dev,
> > > struct virtio_net_hdr *hdr,
> > >   			 */
> > >   			uint16_t csum = 0, off;
> > > 
> > > +			if (hdr->csum_start >= rte_pktmbuf_pkt_len(m))
> > > +				return;
> > > +
> > 
> > The hdr->csum_start does two successive reads from user space to read
> > a variable length data structure. The result overflow if the data structure
> > changes between the two reads.
> > 
> > We can prevent double fetch issue by using the temporary variable csum_start.

This is an interesting remark, thanks!

However, in practical, I'd say that the hdr->csum_start is fetched in a register
only once if using optimized compilation, because the compiler has no reason to
think that hdr->csum_start can be modified.

Olivier

> 
> Right, that's a good catch! The exploitation od this issue seem
> difficult though.
> 
> We may systematically copy the full header, as we only do it for ones
> not contiguous in host VA space.
> 
> What do you think? Are you willing to contribute a fix?
> 
> Thanks,
> Maxime
> > 
> > Thanks,
> > Yunjian
> > 
> > >   			if (rte_raw_cksum_mbuf(m, hdr->csum_start,
> > >   					rte_pktmbuf_pkt_len(m) - hdr->csum_start, &csum) <
> > > 0)
> > >   				return;
> > > --
> > > 2.47.0
> > 
> 

Re: [PATCH] net/virtio: fix Rx checksum calculation

[Stephen Hemminger]

On Wed, 18 Dec 2024 10:20:47 +0100
Olivier Matz <olivier.matz@6wind.com> wrote:

> Hi,
> 
> On Wed, Dec 18, 2024 at 09:59:05AM +0100, Maxime Coquelin wrote:
> > Hi,
> > 
> > On 12/18/24 08:34, Wangyunjian(wangyunjian,TongTu) wrote:  
> > > > -----Original Message-----
> > > > From: Maxime Coquelin [mailto:maxime.coquelin@redhat.com]
> > > > Sent: Tuesday, December 17, 2024 11:33 PM
> > > > To: dev@dpdk.org
> > > > Cc: Olivier Matz <olivier.matz@6wind.com>; Maxime Gouin
> > > > <maxime.gouin@6wind.com>; Maxime Coquelin
> > > > <maxime.coquelin@redhat.com>
> > > > Subject: [PATCH] net/virtio: fix Rx checksum calculation
> > > > 
> > > > From: Olivier Matz <olivier.matz@6wind.com>
> > > > 
> > > > If hdr->csum_start is larger than packet length, the len argument passed
> > > > to rte_raw_cksum_mbuf() overflows and causes a segmentation fault.
> > > > 
> > > > Ignore checksum computation in this case.
> > > > 
> > > > CVE-2024-11614
> > > > 
> > > > Fixes: ca7036b4af3a ("vhost: fix offload flags in Rx path")
> > > > 
> > > > Signed-off-by: Maxime Gouin <maxime.gouin@6wind.com>
> > > > Signed-off-by: Olivier Matz <olivier.matz@6wind.com>
> > > > Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com>
> > > > ---
> > > >   lib/vhost/virtio_net.c | 3 +++
> > > >   1 file changed, 3 insertions(+)
> > > > 
> > > > diff --git a/lib/vhost/virtio_net.c b/lib/vhost/virtio_net.c
> > > > index d764d4bc6a..69901ab3b5 100644
> > > > --- a/lib/vhost/virtio_net.c
> > > > +++ b/lib/vhost/virtio_net.c
> > > > @@ -2823,6 +2823,9 @@ vhost_dequeue_offload(struct virtio_net *dev,
> > > > struct virtio_net_hdr *hdr,
> > > >   			 */
> > > >   			uint16_t csum = 0, off;
> > > > 
> > > > +			if (hdr->csum_start >= rte_pktmbuf_pkt_len(m))
> > > > +				return;
> > > > +  
> > > 
> > > The hdr->csum_start does two successive reads from user space to read
> > > a variable length data structure. The result overflow if the data structure
> > > changes between the two reads.
> > > 
> > > We can prevent double fetch issue by using the temporary variable csum_start.  
> 
> This is an interesting remark, thanks!
> 
> However, in practical, I'd say that the hdr->csum_start is fetched in a register
> only once if using optimized compilation, because the compiler has no reason to
> think that hdr->csum_start can be modified.
> 
> Olivier

True, but security never depend on optimization.
Needs a fetch and compiler barrier to be truly safe against compilers.

Re: [PATCH] net/virtio: fix Rx checksum calculation

[Mattias Rönnblom]

On 2024-12-18 09:59, Maxime Coquelin wrote:
> Hi,
> 
> On 12/18/24 08:34, Wangyunjian(wangyunjian,TongTu) wrote:
>>> -----Original Message-----
>>> From: Maxime Coquelin [mailto:maxime.coquelin@redhat.com]
>>> Sent: Tuesday, December 17, 2024 11:33 PM
>>> To: dev@dpdk.org
>>> Cc: Olivier Matz <olivier.matz@6wind.com>; Maxime Gouin
>>> <maxime.gouin@6wind.com>; Maxime Coquelin
>>> <maxime.coquelin@redhat.com>
>>> Subject: [PATCH] net/virtio: fix Rx checksum calculation
>>>
>>> From: Olivier Matz <olivier.matz@6wind.com>
>>>
>>> If hdr->csum_start is larger than packet length, the len argument passed
>>> to rte_raw_cksum_mbuf() overflows and causes a segmentation fault.
>>>
>>> Ignore checksum computation in this case.
>>>
>>> CVE-2024-11614
>>>
>>> Fixes: ca7036b4af3a ("vhost: fix offload flags in Rx path")
>>>
>>> Signed-off-by: Maxime Gouin <maxime.gouin@6wind.com>
>>> Signed-off-by: Olivier Matz <olivier.matz@6wind.com>
>>> Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com>
>>> ---
>>>   lib/vhost/virtio_net.c | 3 +++
>>>   1 file changed, 3 insertions(+)
>>>
>>> diff --git a/lib/vhost/virtio_net.c b/lib/vhost/virtio_net.c
>>> index d764d4bc6a..69901ab3b5 100644
>>> --- a/lib/vhost/virtio_net.c
>>> +++ b/lib/vhost/virtio_net.c
>>> @@ -2823,6 +2823,9 @@ vhost_dequeue_offload(struct virtio_net *dev,
>>> struct virtio_net_hdr *hdr,
>>>                */
>>>               uint16_t csum = 0, off;
>>>
>>> +            if (hdr->csum_start >= rte_pktmbuf_pkt_len(m))
>>> +                return;
>>> +
>>
>> The hdr->csum_start does two successive reads from user space to read
>> a variable length data structure. The result overflow if the data 
>> structure
>> changes between the two reads.
>>

You don't know if the resulting object code will perform one, two or 
more loads from memory.

If you want to be sure it's exactly one load, you need to go through a 
volatile pointer. This seems like a use case for RTE_READ_ONCE() (which 
doesn't exist).

An alternative is to do a relaxed atomic load, which is really what you 
ask for.

>> We can prevent double fetch issue by using the temporary variable 
>> csum_start.
> 

I don't think that makes a difference. The compiler is still free to 
generate object code which load from the same location multiple times.

> Right, that's a good catch! The exploitation od this issue seem
> difficult though.
> 
> We may systematically copy the full header, as we only do it for ones
> not contiguous in host VA space.
> 

I think you would need to go through a volatile pointer here as well, to 
make sure the copy actually occur. At least if the target is 
stack-allocated object.

> What do you think? Are you willing to contribute a fix?
> 
> Thanks,
> Maxime
>>
>> Thanks,
>> Yunjian
>>
>>>               if (rte_raw_cksum_mbuf(m, hdr->csum_start,
>>>                       rte_pktmbuf_pkt_len(m) - hdr->csum_start, &csum) <
>>> 0)
>>>                   return;
>>> -- 
>>> 2.47.0
>>
>