virtio-net: Add validation for used length
[ Upstream commit ad993a95c508417acdeb15244109e009e50d8758 ] This adds validation for used length (might come from an untrusted device) to avoid data corruption or loss. Signed-off-by: Xie Yongji <xieyongji@bytedance.com> Acked-by: Jason Wang <jasowang@redhat.com> Link: https://lore.kernel.org/r/20210531135852.113-1-xieyongji@bytedance.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
5e039a80a7
commit
c92298d228
@ -660,6 +660,12 @@ static struct sk_buff *receive_small(struct net_device *dev,
|
||||
len -= vi->hdr_len;
|
||||
stats->bytes += len;
|
||||
|
||||
if (unlikely(len > GOOD_PACKET_LEN)) {
|
||||
pr_debug("%s: rx error: len %u exceeds max size %d\n",
|
||||
dev->name, len, GOOD_PACKET_LEN);
|
||||
dev->stats.rx_length_errors++;
|
||||
goto err_len;
|
||||
}
|
||||
rcu_read_lock();
|
||||
xdp_prog = rcu_dereference(rq->xdp_prog);
|
||||
if (xdp_prog) {
|
||||
@ -763,6 +769,7 @@ err:
|
||||
err_xdp:
|
||||
rcu_read_unlock();
|
||||
stats->xdp_drops++;
|
||||
err_len:
|
||||
stats->drops++;
|
||||
put_page(page);
|
||||
xdp_xmit:
|
||||
@ -816,6 +823,12 @@ static struct sk_buff *receive_mergeable(struct net_device *dev,
|
||||
head_skb = NULL;
|
||||
stats->bytes += len - vi->hdr_len;
|
||||
|
||||
if (unlikely(len > truesize)) {
|
||||
pr_debug("%s: rx error: len %u exceeds truesize %lu\n",
|
||||
dev->name, len, (unsigned long)ctx);
|
||||
dev->stats.rx_length_errors++;
|
||||
goto err_skb;
|
||||
}
|
||||
rcu_read_lock();
|
||||
xdp_prog = rcu_dereference(rq->xdp_prog);
|
||||
if (xdp_prog) {
|
||||
@ -943,13 +956,6 @@ static struct sk_buff *receive_mergeable(struct net_device *dev,
|
||||
}
|
||||
rcu_read_unlock();
|
||||
|
||||
if (unlikely(len > truesize)) {
|
||||
pr_debug("%s: rx error: len %u exceeds truesize %lu\n",
|
||||
dev->name, len, (unsigned long)ctx);
|
||||
dev->stats.rx_length_errors++;
|
||||
goto err_skb;
|
||||
}
|
||||
|
||||
head_skb = page_to_skb(vi, rq, page, offset, len, truesize, !xdp_prog,
|
||||
metasize);
|
||||
curr_skb = head_skb;
|
||||
|
Loading…
x
Reference in New Issue
Block a user