From 606fd08b1bfce6d81c9532a9ecbbbe88aa266793 Mon Sep 17 00:00:00 2001 From: Olivier Matz Date: Thu, 28 Nov 2024 12:09:56 +0100 Subject: [PATCH] net/virtio: fix Rx checksum calculation If hdr->csum_start is larger than packet length, the len argument passed to rte_raw_cksum_mbuf() overflows and causes a segmentation fault. Ignore checksum computation in this case. CVE-2024-11614 Fixes: ca7036b4af3a ("vhost: fix offload flags in Rx path") Signed-off-by: Maxime Gouin Signed-off-by: Olivier Matz Reviewed-by: Maxime Coquelin --- lib/vhost/virtio_net.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/lib/vhost/virtio_net.c b/lib/vhost/virtio_net.c index 6d53ff932d..e42aabf126 100644 --- a/lib/vhost/virtio_net.c +++ b/lib/vhost/virtio_net.c @@ -2831,6 +2831,9 @@ vhost_dequeue_offload(struct virtio_net *dev, struct virtio_net_hdr *hdr, */ uint16_t csum = 0, off; + if (hdr->csum_start >= rte_pktmbuf_pkt_len(m)) + return; + if (rte_raw_cksum_mbuf(m, hdr->csum_start, rte_pktmbuf_pkt_len(m) - hdr->csum_start, &csum) < 0) return; -- 2.47.0