From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 7D6D445EDE; Wed, 18 Dec 2024 18:19:30 +0100 (CET) Received: from mails.dpdk.org (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 18A7B40EE2; Wed, 18 Dec 2024 18:19:30 +0100 (CET) Received: from mail.lysator.liu.se (mail.lysator.liu.se [130.236.254.3]) by mails.dpdk.org (Postfix) with ESMTP id E634840DF5 for ; Wed, 18 Dec 2024 18:19:28 +0100 (CET) Received: from mail.lysator.liu.se (localhost [127.0.0.1]) by mail.lysator.liu.se (Postfix) with ESMTP id 75874C782 for ; Wed, 18 Dec 2024 18:19:28 +0100 (CET) Received: by mail.lysator.liu.se (Postfix, from userid 1004) id 69F3DC781; Wed, 18 Dec 2024 18:19:28 +0100 (CET) X-Spam-Checker-Version: SpamAssassin 4.0.0 (2022-12-13) on hermod.lysator.liu.se X-Spam-Level: X-Spam-Status: No, score=-1.2 required=5.0 tests=ALL_TRUSTED,AWL, T_SCC_BODY_TEXT_LINE autolearn=disabled version=4.0.0 X-Spam-Score: -1.2 Received: from [192.168.1.85] (h-62-63-215-114.A163.priv.bahnhof.se [62.63.215.114]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by mail.lysator.liu.se (Postfix) with ESMTPSA id D9EB9C64E; Wed, 18 Dec 2024 18:19:25 +0100 (CET) Message-ID: <41fde13e-2380-45d5-8d47-2b9b5ea8ee11@lysator.liu.se> Date: Wed, 18 Dec 2024 18:19:24 +0100 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] net/virtio: fix Rx checksum calculation To: Maxime Coquelin , "Wangyunjian(wangyunjian,TongTu)" , "dev@dpdk.org" Cc: Olivier Matz , Maxime Gouin , "Lilijun (Jerry)" , wangzengyuan , "xiawei (H)" References: <20241217153253.457646-1-maxime.coquelin@redhat.com> <8fdd9fc017f64ed088932d66119edc38@huawei.com> <4649ed66-274a-483c-9241-59ba3a40c820@redhat.com> Content-Language: en-US From: =?UTF-8?Q?Mattias_R=C3=B6nnblom?= In-Reply-To: <4649ed66-274a-483c-9241-59ba3a40c820@redhat.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit X-Virus-Scanned: ClamAV using ClamSMTP X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org On 2024-12-18 09:59, Maxime Coquelin wrote: > Hi, > > On 12/18/24 08:34, Wangyunjian(wangyunjian,TongTu) wrote: >>> -----Original Message----- >>> From: Maxime Coquelin [mailto:maxime.coquelin@redhat.com] >>> Sent: Tuesday, December 17, 2024 11:33 PM >>> To: dev@dpdk.org >>> Cc: Olivier Matz ; Maxime Gouin >>> ; Maxime Coquelin >>> >>> Subject: [PATCH] net/virtio: fix Rx checksum calculation >>> >>> From: Olivier Matz >>> >>> If hdr->csum_start is larger than packet length, the len argument passed >>> to rte_raw_cksum_mbuf() overflows and causes a segmentation fault. >>> >>> Ignore checksum computation in this case. >>> >>> CVE-2024-11614 >>> >>> Fixes: ca7036b4af3a ("vhost: fix offload flags in Rx path") >>> >>> Signed-off-by: Maxime Gouin >>> Signed-off-by: Olivier Matz >>> Reviewed-by: Maxime Coquelin >>> --- >>>   lib/vhost/virtio_net.c | 3 +++ >>>   1 file changed, 3 insertions(+) >>> >>> diff --git a/lib/vhost/virtio_net.c b/lib/vhost/virtio_net.c >>> index d764d4bc6a..69901ab3b5 100644 >>> --- a/lib/vhost/virtio_net.c >>> +++ b/lib/vhost/virtio_net.c >>> @@ -2823,6 +2823,9 @@ vhost_dequeue_offload(struct virtio_net *dev, >>> struct virtio_net_hdr *hdr, >>>                */ >>>               uint16_t csum = 0, off; >>> >>> +            if (hdr->csum_start >= rte_pktmbuf_pkt_len(m)) >>> +                return; >>> + >> >> The hdr->csum_start does two successive reads from user space to read >> a variable length data structure. The result overflow if the data >> structure >> changes between the two reads. >> You don't know if the resulting object code will perform one, two or more loads from memory. If you want to be sure it's exactly one load, you need to go through a volatile pointer. This seems like a use case for RTE_READ_ONCE() (which doesn't exist). An alternative is to do a relaxed atomic load, which is really what you ask for. >> We can prevent double fetch issue by using the temporary variable >> csum_start. > I don't think that makes a difference. The compiler is still free to generate object code which load from the same location multiple times. > Right, that's a good catch! The exploitation od this issue seem > difficult though. > > We may systematically copy the full header, as we only do it for ones > not contiguous in host VA space. > I think you would need to go through a volatile pointer here as well, to make sure the copy actually occur. At least if the target is stack-allocated object. > What do you think? Are you willing to contribute a fix? > > Thanks, > Maxime >> >> Thanks, >> Yunjian >> >>>               if (rte_raw_cksum_mbuf(m, hdr->csum_start, >>>                       rte_pktmbuf_pkt_len(m) - hdr->csum_start, &csum) < >>> 0) >>>                   return; >>> -- >>> 2.47.0 >> >