diff options
| author | Jakub Kicinski <kuba@kernel.org> | 2024-07-25 17:07:06 +0200 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2024-07-25 17:07:07 +0200 |
| commit | af65ea42bd1d28d818b74b9b3b4f8da7ada9f88b (patch) | |
| tree | 0e2b808ca37e42419f7ef7ed1ca78e61a21fef9c | |
| parent | mISDN: Fix a use after free in hfcmulti_tx() (diff) | |
| parent | tun: add missing verification for short frame (diff) | |
| download | linux-af65ea42bd1d28d818b74b9b3b4f8da7ada9f88b.tar.xz linux-af65ea42bd1d28d818b74b9b3b4f8da7ada9f88b.zip | |
Merge branch 'tap-tun-harden-by-dropping-short-frame'
Dongli Zhang says:
====================
tap/tun: harden by dropping short frame
This is to harden all of tap/tun to avoid any short frame smaller than the
Ethernet header (ETH_HLEN).
While the xen-netback already rejects short frame smaller than ETH_HLEN ...
914 static void xenvif_tx_build_gops(struct xenvif_queue *queue,
915 int budget,
916 unsigned *copy_ops,
917 unsigned *map_ops)
918 {
... ...
1007 if (unlikely(txreq.size < ETH_HLEN)) {
1008 netdev_dbg(queue->vif->dev,
1009 "Bad packet size: %d\n", txreq.size);
1010 xenvif_tx_err(queue, &txreq, extra_count, idx);
1011 break;
1012 }
... the short frame may not be dropped by vhost-net/tap/tun.
This fixes CVE-2024-41090 and CVE-2024-41091.
====================
Link: https://patch.msgid.link/20240724170452.16837-1-dongli.zhang@oracle.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
| -rw-r--r-- | drivers/net/tap.c | 5 | ||||
| -rw-r--r-- | drivers/net/tun.c | 3 |
2 files changed, 8 insertions, 0 deletions
diff --git a/drivers/net/tap.c b/drivers/net/tap.c index bfdd3875fe86..77574f7a3bd4 100644 --- a/drivers/net/tap.c +++ b/drivers/net/tap.c @@ -1177,6 +1177,11 @@ static int tap_get_user_xdp(struct tap_queue *q, struct xdp_buff *xdp) struct sk_buff *skb; int err, depth; + if (unlikely(xdp->data_end - xdp->data < ETH_HLEN)) { + err = -EINVAL; + goto err; + } + if (q->flags & IFF_VNET_HDR) vnet_hdr_len = READ_ONCE(q->vnet_hdr_sz); diff --git a/drivers/net/tun.c b/drivers/net/tun.c index 9b24861464bc..1d06c560c5e6 100644 --- a/drivers/net/tun.c +++ b/drivers/net/tun.c @@ -2455,6 +2455,9 @@ static int tun_xdp_one(struct tun_struct *tun, bool skb_xdp = false; struct page *page; + if (unlikely(datasize < ETH_HLEN)) + return -EINVAL; + xdp_prog = rcu_dereference(tun->xdp_prog); if (xdp_prog) { if (gso->gso_type) { |