[dpdk-stable] patch 'net/tap: add buffer overflow checks before checksum' has been queued to LTS release 17.11.6

[Yongseok Koh <yskoh@mellanox.com>]

Hi,

FYI, your patch has been queued to LTS release 17.11.6

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objection by 03/13/19. So please
shout if anyone has objection.

Also note that after the patch there's a diff of the upstream commit vs the patch applied
to the branch. If the code is different (ie: not only metadata diffs), due for example to
a change in context or macro names, please double check it.

Thanks.

Yongseok

---
>From a9adae365dbc5e7526edfde377a3edd31f820f67 Mon Sep 17 00:00:00 2001
From: Bruce Richardson <bruce.richardson@intel.com>
Date: Mon, 17 Dec 2018 15:50:05 +0000
Subject: [PATCH] net/tap: add buffer overflow checks before checksum

[ upstream commit 1168a4fd193c3bf981c4889cba150a7bb4c1d169 ]

The checksum calculation APIs take only the packet headers pointers as
parameters, so they assume that the lengths reported in those headers
are correct. However, a malicious packet could claim to be far larger
than it is, so we need to check the header lengths in the driver before
calling the checksum API.

A better fix would be to allow the lengths to be passed into the API
function, but that would be an API break, so fixing in TAP driver for
now.

Fixes: 8ae3023387e9 ("net/tap: add Rx/Tx checksum offload support")

Signed-off-by: Bruce Richardson <bruce.richardson@intel.com>
Reviewed-by: Ferruh Yigit <ferruh.yigit@intel.com>
Acked-by: Keith Wiles <keith.wiles@intel.com>
---
 drivers/net/tap/rte_eth_tap.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/drivers/net/tap/rte_eth_tap.c b/drivers/net/tap/rte_eth_tap.c
index 466624ae6..bd2b4d995 100644
--- a/drivers/net/tap/rte_eth_tap.c
+++ b/drivers/net/tap/rte_eth_tap.c
@@ -255,13 +255,27 @@ tap_verify_csum(struct rte_mbuf *mbuf)
 		l3_len = 4 * (iph->version_ihl & 0xf);
 		if (unlikely(l2_len + l3_len > rte_pktmbuf_data_len(mbuf)))
 			return;
+		/* check that the total length reported by header is not
+		 * greater than the total received size
+		 */
+		if (l2_len + rte_be_to_cpu_16(iph->total_length) >
+				rte_pktmbuf_data_len(mbuf))
+			return;
 
 		cksum = ~rte_raw_cksum(iph, l3_len);
 		mbuf->ol_flags |= cksum ?
 			PKT_RX_IP_CKSUM_BAD :
 			PKT_RX_IP_CKSUM_GOOD;
 	} else if (l3 == RTE_PTYPE_L3_IPV6) {
+		struct ipv6_hdr *iph = l3_hdr;
+
 		l3_len = sizeof(struct ipv6_hdr);
+		/* check that the total length reported by header is not
+		 * greater than the total received size
+		 */
+		if (l2_len + l3_len + rte_be_to_cpu_16(iph->payload_len) >
+				rte_pktmbuf_data_len(mbuf))
+			return;
 	} else {
 		/* IPv6 extensions are not supported */
 		return;
-- 
2.11.0

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2019-03-08 09:46:41.347685587 -0800
+++ 0020-net-tap-add-buffer-overflow-checks-before-checksum.patch	2019-03-08 09:46:40.055402000 -0800
@@ -1,8 +1,10 @@
-From 1168a4fd193c3bf981c4889cba150a7bb4c1d169 Mon Sep 17 00:00:00 2001
+From a9adae365dbc5e7526edfde377a3edd31f820f67 Mon Sep 17 00:00:00 2001
 From: Bruce Richardson <bruce.richardson@intel.com>
 Date: Mon, 17 Dec 2018 15:50:05 +0000
 Subject: [PATCH] net/tap: add buffer overflow checks before checksum
 
+[ upstream commit 1168a4fd193c3bf981c4889cba150a7bb4c1d169 ]
+
 The checksum calculation APIs take only the packet headers pointers as
 parameters, so they assume that the lengths reported in those headers
 are correct. However, a malicious packet could claim to be far larger
@@ -14,7 +16,6 @@
 now.
 
 Fixes: 8ae3023387e9 ("net/tap: add Rx/Tx checksum offload support")
-Cc: stable@dpdk.org
 
 Signed-off-by: Bruce Richardson <bruce.richardson@intel.com>
 Reviewed-by: Ferruh Yigit <ferruh.yigit@intel.com>
@@ -24,10 +25,10 @@
  1 file changed, 14 insertions(+)
 
 diff --git a/drivers/net/tap/rte_eth_tap.c b/drivers/net/tap/rte_eth_tap.c
-index 49afd38dd..0ec030bef 100644
+index 466624ae6..bd2b4d995 100644
 --- a/drivers/net/tap/rte_eth_tap.c
 +++ b/drivers/net/tap/rte_eth_tap.c
-@@ -281,13 +281,27 @@ tap_verify_csum(struct rte_mbuf *mbuf)
+@@ -255,13 +255,27 @@ tap_verify_csum(struct rte_mbuf *mbuf)
  		l3_len = 4 * (iph->version_ihl & 0xf);
  		if (unlikely(l2_len + l3_len > rte_pktmbuf_data_len(mbuf)))
  			return;