| Message ID | 20210531135852.113-1-xieyongji@bytedance.com |
|---|---|
| State | New |
| Headers | show |
| Series | [v4] virtio-net: Add validation for used length | expand |
在 2021/5/31 下午9:58, Xie Yongji 写道: > This adds validation for used length (might come > from an untrusted device) to avoid data corruption > or loss. > > Signed-off-by: Xie Yongji <xieyongji@bytedance.com> Acked-by: Jason Wang <jasowang@redhat.com> > --- > drivers/net/virtio_net.c | 20 +++++++++++++------- > 1 file changed, 13 insertions(+), 7 deletions(-) > > diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c > index 073fec4c0df1..ed969b65126e 100644 > --- a/drivers/net/virtio_net.c > +++ b/drivers/net/virtio_net.c > @@ -730,6 +730,12 @@ static struct sk_buff *receive_small(struct net_device *dev, > len -= vi->hdr_len; > stats->bytes += len; > > + if (unlikely(len > GOOD_PACKET_LEN)) { > + pr_debug("%s: rx error: len %u exceeds max size %d\n", > + dev->name, len, GOOD_PACKET_LEN); > + dev->stats.rx_length_errors++; > + goto err_len; > + } > rcu_read_lock(); > xdp_prog = rcu_dereference(rq->xdp_prog); > if (xdp_prog) { > @@ -833,6 +839,7 @@ static struct sk_buff *receive_small(struct net_device *dev, > err_xdp: > rcu_read_unlock(); > stats->xdp_drops++; > +err_len: > stats->drops++; > put_page(page); > xdp_xmit: > @@ -886,6 +893,12 @@ static struct sk_buff *receive_mergeable(struct net_device *dev, > head_skb = NULL; > stats->bytes += len - vi->hdr_len; > > + if (unlikely(len > truesize)) { > + pr_debug("%s: rx error: len %u exceeds truesize %lu\n", > + dev->name, len, (unsigned long)ctx); > + dev->stats.rx_length_errors++; > + goto err_skb; > + } > rcu_read_lock(); > xdp_prog = rcu_dereference(rq->xdp_prog); > if (xdp_prog) { > @@ -1012,13 +1025,6 @@ static struct sk_buff *receive_mergeable(struct net_device *dev, > } > rcu_read_unlock(); > > - if (unlikely(len > truesize)) { > - pr_debug("%s: rx error: len %u exceeds truesize %lu\n", > - dev->name, len, (unsigned long)ctx); > - dev->stats.rx_length_errors++; > - goto err_skb; > - } > - > head_skb = page_to_skb(vi, rq, page, offset, len, truesize, !xdp_prog, > metasize, !!headroom); > curr_skb = head_skb;
Hello: This patch was applied to netdev/net-next.git (refs/heads/master): On Mon, 31 May 2021 21:58:52 +0800 you wrote: > This adds validation for used length (might come > from an untrusted device) to avoid data corruption > or loss. > > Signed-off-by: Xie Yongji <xieyongji@bytedance.com> > --- > drivers/net/virtio_net.c | 20 +++++++++++++------- > 1 file changed, 13 insertions(+), 7 deletions(-) Here is the summary with links: - [v4] virtio-net: Add validation for used length https://git.kernel.org/netdev/net-next/c/ad993a95c508 You are awesome, thank you! -- Deet-doot-dot, I am a bot. https://korg.docs.kernel.org/patchwork/pwbot.html
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c index 073fec4c0df1..ed969b65126e 100644 --- a/drivers/net/virtio_net.c +++ b/drivers/net/virtio_net.c @@ -730,6 +730,12 @@ static struct sk_buff *receive_small(struct net_device *dev, len -= vi->hdr_len; stats->bytes += len; + if (unlikely(len > GOOD_PACKET_LEN)) { + pr_debug("%s: rx error: len %u exceeds max size %d\n", + dev->name, len, GOOD_PACKET_LEN); + dev->stats.rx_length_errors++; + goto err_len; + } rcu_read_lock(); xdp_prog = rcu_dereference(rq->xdp_prog); if (xdp_prog) { @@ -833,6 +839,7 @@ static struct sk_buff *receive_small(struct net_device *dev, err_xdp: rcu_read_unlock(); stats->xdp_drops++; +err_len: stats->drops++; put_page(page); xdp_xmit: @@ -886,6 +893,12 @@ static struct sk_buff *receive_mergeable(struct net_device *dev, head_skb = NULL; stats->bytes += len - vi->hdr_len; + if (unlikely(len > truesize)) { + pr_debug("%s: rx error: len %u exceeds truesize %lu\n", + dev->name, len, (unsigned long)ctx); + dev->stats.rx_length_errors++; + goto err_skb; + } rcu_read_lock(); xdp_prog = rcu_dereference(rq->xdp_prog); if (xdp_prog) { @@ -1012,13 +1025,6 @@ static struct sk_buff *receive_mergeable(struct net_device *dev, } rcu_read_unlock(); - if (unlikely(len > truesize)) { - pr_debug("%s: rx error: len %u exceeds truesize %lu\n", - dev->name, len, (unsigned long)ctx); - dev->stats.rx_length_errors++; - goto err_skb; - } - head_skb = page_to_skb(vi, rq, page, offset, len, truesize, !xdp_prog, metasize, !!headroom); curr_skb = head_skb;
This adds validation for used length (might come from an untrusted device) to avoid data corruption or loss. Signed-off-by: Xie Yongji <xieyongji@bytedance.com> --- drivers/net/virtio_net.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-)