From: Maxime Coquelin <maxime.coquelin@redhat.com>
To: "Wangyunjian(wangyunjian,TongTu)" <wangyunjian@huawei.com>,
"dev@dpdk.org" <dev@dpdk.org>
Cc: Olivier Matz <olivier.matz@6wind.com>,
Maxime Gouin <maxime.gouin@6wind.com>,
"Lilijun (Jerry)" <jerry.lilijun@huawei.com>,
wangzengyuan <wangzengyuan@huawei.com>,
"xiawei (H)" <xiawei40@huawei.com>
Subject: Re: [PATCH] net/virtio: fix Rx checksum calculation
Date: Wed, 18 Dec 2024 09:59:05 +0100 [thread overview]
Message-ID: <4649ed66-274a-483c-9241-59ba3a40c820@redhat.com> (raw)
In-Reply-To: <8fdd9fc017f64ed088932d66119edc38@huawei.com>
Hi,
On 12/18/24 08:34, Wangyunjian(wangyunjian,TongTu) wrote:
>> -----Original Message-----
>> From: Maxime Coquelin [mailto:maxime.coquelin@redhat.com]
>> Sent: Tuesday, December 17, 2024 11:33 PM
>> To: dev@dpdk.org
>> Cc: Olivier Matz <olivier.matz@6wind.com>; Maxime Gouin
>> <maxime.gouin@6wind.com>; Maxime Coquelin
>> <maxime.coquelin@redhat.com>
>> Subject: [PATCH] net/virtio: fix Rx checksum calculation
>>
>> From: Olivier Matz <olivier.matz@6wind.com>
>>
>> If hdr->csum_start is larger than packet length, the len argument passed
>> to rte_raw_cksum_mbuf() overflows and causes a segmentation fault.
>>
>> Ignore checksum computation in this case.
>>
>> CVE-2024-11614
>>
>> Fixes: ca7036b4af3a ("vhost: fix offload flags in Rx path")
>>
>> Signed-off-by: Maxime Gouin <maxime.gouin@6wind.com>
>> Signed-off-by: Olivier Matz <olivier.matz@6wind.com>
>> Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com>
>> ---
>> lib/vhost/virtio_net.c | 3 +++
>> 1 file changed, 3 insertions(+)
>>
>> diff --git a/lib/vhost/virtio_net.c b/lib/vhost/virtio_net.c
>> index d764d4bc6a..69901ab3b5 100644
>> --- a/lib/vhost/virtio_net.c
>> +++ b/lib/vhost/virtio_net.c
>> @@ -2823,6 +2823,9 @@ vhost_dequeue_offload(struct virtio_net *dev,
>> struct virtio_net_hdr *hdr,
>> */
>> uint16_t csum = 0, off;
>>
>> + if (hdr->csum_start >= rte_pktmbuf_pkt_len(m))
>> + return;
>> +
>
> The hdr->csum_start does two successive reads from user space to read
> a variable length data structure. The result overflow if the data structure
> changes between the two reads.
>
> We can prevent double fetch issue by using the temporary variable csum_start.
Right, that's a good catch! The exploitation od this issue seem
difficult though.
We may systematically copy the full header, as we only do it for ones
not contiguous in host VA space.
What do you think? Are you willing to contribute a fix?
Thanks,
Maxime
>
> Thanks,
> Yunjian
>
>> if (rte_raw_cksum_mbuf(m, hdr->csum_start,
>> rte_pktmbuf_pkt_len(m) - hdr->csum_start, &csum) <
>> 0)
>> return;
>> --
>> 2.47.0
>
next prev parent reply other threads:[~2024-12-18 8:59 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-12-17 15:32 Maxime Coquelin
2024-12-18 7:34 ` Wangyunjian(wangyunjian,TongTu)
2024-12-18 8:59 ` Maxime Coquelin [this message]
2024-12-18 9:20 ` Olivier Matz
2024-12-18 16:37 ` Stephen Hemminger
2024-12-18 17:19 ` Mattias Rönnblom
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4649ed66-274a-483c-9241-59ba3a40c820@redhat.com \
--to=maxime.coquelin@redhat.com \
--cc=dev@dpdk.org \
--cc=jerry.lilijun@huawei.com \
--cc=maxime.gouin@6wind.com \
--cc=olivier.matz@6wind.com \
--cc=wangyunjian@huawei.com \
--cc=wangzengyuan@huawei.com \
--cc=xiawei40@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).