lkml.org 
[lkml]   [2021]   [Oct]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRE: [PATCH] hv_netvsc: Fix potentionally overflow in netvsc_xdp_xmit()
Date


> -----Original Message-----
> From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
> Sent: Tuesday, October 12, 2021 11:05 PM
> To: KY Srinivasan <kys@microsoft.com>; Haiyang Zhang
> <haiyangz@microsoft.com>; Stephen Hemminger <sthemmin@microsoft.com>;
> wei.liu@kernel.org; Dexuan Cui <decui@microsoft.com>;
> davem@davemloft.net; kuba@kernel.org; ast@kernel.org;
> daniel@iogearbox.net; hawk@kernel.org; john.fastabend@gmail.com;
> andrii@kernel.org; kafai@fb.com; songliubraving@fb.com; yhs@fb.com;
> kpsingh@kernel.org
> Cc: linux-hyperv@vger.kernel.org; netdev@vger.kernel.org; linux-
> kernel@vger.kernel.org; bpf@vger.kernel.org; Jiasheng Jiang
> <jiasheng@iscas.ac.cn>
> Subject: [PATCH] hv_netvsc: Fix potentionally overflow in
> netvsc_xdp_xmit()
>
> [Some people who received this message don't often get email from
> jiasheng@iscas.ac.cn. Learn why this is important at
> http://aka.ms/LearnAboutSenderIdentification.]
>
> Adding skb_rx_queue_recorded() to avoid the value of skb->queue_mapping
> to be 0. Otherwise the return value of skb_get_rx_queue() could be
> MAX_U16
> cause by overflow.
>
> Fixes: 351e158 ("hv_netvsc: Add XDP support")
> Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
> ---
> drivers/net/hyperv/netvsc_drv.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/hyperv/netvsc_drv.c
> b/drivers/net/hyperv/netvsc_drv.c
> index f682a55..e51201e 100644
> --- a/drivers/net/hyperv/netvsc_drv.c
> +++ b/drivers/net/hyperv/netvsc_drv.c
> @@ -807,7 +807,7 @@ static void netvsc_xdp_xmit(struct sk_buff *skb,
> struct net_device *ndev)
> {
> int rc;
>
> - skb->queue_mapping = skb_get_rx_queue(skb);
> + skb->queue_mapping = skb_rx_queue_recorded(skb) ?
> skb_get_rx_queue(skb) : 0;
> __skb_push(skb, ETH_HLEN);
>

netvsc_xdp_xmit() is only called from netvsc_recv_callback()
and after skb_record_rx_queue(skb, q_idx) is called:

skb_record_rx_queue(skb, q_idx);

......

if (act == XDP_TX) {
netvsc_xdp_xmit(skb, net);
return NVSP_STAT_SUCCESS;
}

So the existing code doesn't need this patch.

To avoid future misusing of netvsc_xdp_xmit() in other places, you
may just add a comment -- "This function should only be called
after skb_record_rx_queue()".

Thanks,

- Haiyang

\
 
 \ /
  Last update: 2021-10-13 14:44    [W:0.044 / U:0.208 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site