Commit 1667c08a authored Jan 29, 2019 by Toshiaki Makita Committed by David S. Miller Jan 30, 2019

virtio_net: Fix out of bounds access of sq



When XDP is disabled, curr_queue_pairs + smp_processor_id() can be
larger than max_queue_pairs.
There is no guarantee that we have enough XDP send queues dedicated for
each cpu when XDP is disabled, so do not count drops on sq in that case.

Fixes: 5b8f3c8d ("virtio_net: Add XDP related stats")
Signed-off-by: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
Acked-by: Jason Wang <jasowang@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 188313c1

drivers/net/virtio_net.c

+7 −10

Original line number	Diff line number	Diff line
		@@ -491,20 +491,17 @@ static int virtnet_xdp_xmit(struct net_device *dev,
		int ret, err;
		int i;

		sq = virtnet_xdp_sq(vi);

		if (unlikely(flags & ~XDP_XMIT_FLAGS_MASK)) {
		ret = -EINVAL;
		drops = n;
		goto out;
		}

		/* Only allow ndo_xdp_xmit if XDP is loaded on dev, as this
		* indicate XDP resources have been successfully allocated.
		*/
		xdp_prog = rcu_dereference(rq->xdp_prog);
		if (!xdp_prog) {
		ret = -ENXIO;
		if (!xdp_prog)
		return -ENXIO;

		sq = virtnet_xdp_sq(vi);

		if (unlikely(flags & ~XDP_XMIT_FLAGS_MASK)) {
		ret = -EINVAL;
		drops = n;
		goto out;
		}

Admin message