[dpdk-stable] patch 'net/tap: add buffer overflow checks before checksum' has been queued to LTS release 17.11.6
Yongseok Koh
yskoh at mellanox.com
Fri Mar 8 18:46:58 CET 2019
Hi,
FYI, your patch has been queued to LTS release 17.11.6
Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objection by 03/13/19. So please
shout if anyone has objection.
Also note that after the patch there's a diff of the upstream commit vs the patch applied
to the branch. If the code is different (ie: not only metadata diffs), due for example to
a change in context or macro names, please double check it.
Thanks.
Yongseok
---
>From a9adae365dbc5e7526edfde377a3edd31f820f67 Mon Sep 17 00:00:00 2001
From: Bruce Richardson <bruce.richardson at intel.com>
Date: Mon, 17 Dec 2018 15:50:05 +0000
Subject: [PATCH] net/tap: add buffer overflow checks before checksum
[ upstream commit 1168a4fd193c3bf981c4889cba150a7bb4c1d169 ]
The checksum calculation APIs take only the packet headers pointers as
parameters, so they assume that the lengths reported in those headers
are correct. However, a malicious packet could claim to be far larger
than it is, so we need to check the header lengths in the driver before
calling the checksum API.
A better fix would be to allow the lengths to be passed into the API
function, but that would be an API break, so fixing in TAP driver for
now.
Fixes: 8ae3023387e9 ("net/tap: add Rx/Tx checksum offload support")
Signed-off-by: Bruce Richardson <bruce.richardson at intel.com>
Reviewed-by: Ferruh Yigit <ferruh.yigit at intel.com>
Acked-by: Keith Wiles <keith.wiles at intel.com>
---
drivers/net/tap/rte_eth_tap.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/drivers/net/tap/rte_eth_tap.c b/drivers/net/tap/rte_eth_tap.c
index 466624ae6..bd2b4d995 100644
--- a/drivers/net/tap/rte_eth_tap.c
+++ b/drivers/net/tap/rte_eth_tap.c
@@ -255,13 +255,27 @@ tap_verify_csum(struct rte_mbuf *mbuf)
l3_len = 4 * (iph->version_ihl & 0xf);
if (unlikely(l2_len + l3_len > rte_pktmbuf_data_len(mbuf)))
return;
+ /* check that the total length reported by header is not
+ * greater than the total received size
+ */
+ if (l2_len + rte_be_to_cpu_16(iph->total_length) >
+ rte_pktmbuf_data_len(mbuf))
+ return;
cksum = ~rte_raw_cksum(iph, l3_len);
mbuf->ol_flags |= cksum ?
PKT_RX_IP_CKSUM_BAD :
PKT_RX_IP_CKSUM_GOOD;
} else if (l3 == RTE_PTYPE_L3_IPV6) {
+ struct ipv6_hdr *iph = l3_hdr;
+
l3_len = sizeof(struct ipv6_hdr);
+ /* check that the total length reported by header is not
+ * greater than the total received size
+ */
+ if (l2_len + l3_len + rte_be_to_cpu_16(iph->payload_len) >
+ rte_pktmbuf_data_len(mbuf))
+ return;
} else {
/* IPv6 extensions are not supported */
return;
--
2.11.0
---
Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- - 2019-03-08 09:46:41.347685587 -0800
+++ 0020-net-tap-add-buffer-overflow-checks-before-checksum.patch 2019-03-08 09:46:40.055402000 -0800
@@ -1,8 +1,10 @@
-From 1168a4fd193c3bf981c4889cba150a7bb4c1d169 Mon Sep 17 00:00:00 2001
+From a9adae365dbc5e7526edfde377a3edd31f820f67 Mon Sep 17 00:00:00 2001
From: Bruce Richardson <bruce.richardson at intel.com>
Date: Mon, 17 Dec 2018 15:50:05 +0000
Subject: [PATCH] net/tap: add buffer overflow checks before checksum
+[ upstream commit 1168a4fd193c3bf981c4889cba150a7bb4c1d169 ]
+
The checksum calculation APIs take only the packet headers pointers as
parameters, so they assume that the lengths reported in those headers
are correct. However, a malicious packet could claim to be far larger
@@ -14,7 +16,6 @@
now.
Fixes: 8ae3023387e9 ("net/tap: add Rx/Tx checksum offload support")
-Cc: stable at dpdk.org
Signed-off-by: Bruce Richardson <bruce.richardson at intel.com>
Reviewed-by: Ferruh Yigit <ferruh.yigit at intel.com>
@@ -24,10 +25,10 @@
1 file changed, 14 insertions(+)
diff --git a/drivers/net/tap/rte_eth_tap.c b/drivers/net/tap/rte_eth_tap.c
-index 49afd38dd..0ec030bef 100644
+index 466624ae6..bd2b4d995 100644
--- a/drivers/net/tap/rte_eth_tap.c
+++ b/drivers/net/tap/rte_eth_tap.c
-@@ -281,13 +281,27 @@ tap_verify_csum(struct rte_mbuf *mbuf)
+@@ -255,13 +255,27 @@ tap_verify_csum(struct rte_mbuf *mbuf)
l3_len = 4 * (iph->version_ihl & 0xf);
if (unlikely(l2_len + l3_len > rte_pktmbuf_data_len(mbuf)))
return;
More information about the stable
mailing list