virtio-net: fix received length check in big packets

commit 0c716703965ffc5ef4311b65cb5d84a703784717 upstream.

Since commit 4959aebba8c0 ("virtio-net: use mtu size as buffer length
for big packets"), when guest gso is off, the allocated size for big
packets is not MAX_SKB_FRAGS * PAGE_SIZE anymore but depends on
negotiated MTU. The number of allocated frags for big packets is stored
in vi->big_packets_num_skbfrags.

Because the host announced buffer length can be malicious (e.g. the host
vhost_net driver's get_rx_bufs is modified to announce incorrect
length), we need a check in virtio_net receive path. Currently, the
check is not adapted to the new change which can lead to NULL page
pointer dereference in the below while loop when receiving length that
is larger than the allocated one.

This commit fixes the received length check corresponding to the new
change.

Fixes: 4959aebba8c0 ("virtio-net: use mtu size as buffer length for big packets")
Cc: stable@vger.kernel.org
Signed-off-by: Bui Quang Minh <minhquangbui99@gmail.com>
Reviewed-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
Tested-by: Lei Yang <leiyang@redhat.com>
Link: https://patch.msgid.link/20251030144438.7582-1-minhquangbui99@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 0c2b7d00b8e7558c208b01c5267bbc8a976e4a86..259e3a35dce935a1068e86b7a2e881c984dc01a6 100644 (file)
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -868,17 +868,6 @@ static struct sk_buff *page_to_skb(struct virtnet_info *vi,
                goto ok;
        }
 
-       /*
-        * Verify that we can indeed put this data into a skb.
-        * This is here to handle cases when the device erroneously
-        * tries to receive more than is possible. This is usually
-        * the case of a broken device.
-        */
-       if (unlikely(len > MAX_SKB_FRAGS * PAGE_SIZE)) {
-               net_dbg_ratelimited("%s: too much data\n", skb->dev->name);
-               dev_kfree_skb(skb);
-               return NULL;
-       }
        BUG_ON(offset >= PAGE_SIZE);
        while (len) {
                unsigned int frag_size = min((unsigned)PAGE_SIZE - offset, len);
@@ -1928,9 +1917,19 @@ static struct sk_buff *receive_big(struct net_device *dev,
                                   struct virtnet_rq_stats *stats)
 {
        struct page *page = buf;
-       struct sk_buff *skb =
-               page_to_skb(vi, rq, page, 0, len, PAGE_SIZE, 0);
+       struct sk_buff *skb;
+
+       /* Make sure that len does not exceed the size allocated in
+        * add_recvbuf_big.
+        */
+       if (unlikely(len > (vi->big_packets_num_skbfrags + 1) * PAGE_SIZE)) {
+               pr_debug("%s: rx error: len %u exceeds allocated size %lu\n",
+                        dev->name, len,
+                        (vi->big_packets_num_skbfrags + 1) * PAGE_SIZE);
+               goto err;
+       }
 
+       skb = page_to_skb(vi, rq, page, 0, len, PAGE_SIZE, 0);
        u64_stats_add(&stats->bytes, len - vi->hdr_len);
        if (unlikely(!skb))
                goto err;