Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0921dd50 authored by Toshiaki Makita's avatar Toshiaki Makita Committed by Greg Kroah-Hartman
Browse files

virtio_net: Fix out of bounds access of sq 



[ Upstream commit 1667c08a9d31c7cdf09f4890816bfbf20b685495 ]

When XDP is disabled, curr_queue_pairs + smp_processor_id() can be
larger than max_queue_pairs.
There is no guarantee that we have enough XDP send queues dedicated for
each cpu when XDP is disabled, so do not count drops on sq in that case.

Fixes: 5b8f3c8d ("virtio_net: Add XDP related stats")
Signed-off-by: default avatarToshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
Acked-by: default avatarJason Wang <jasowang@redhat.com>
Acked-by: default avatarMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent d97117bd

drivers/net/virtio_net.c

+7 −10
Original line number Original line Diff line number Diff line
@@ -490,20 +490,17 @@ static int virtnet_xdp_xmit(struct net_device *dev, 
	int ret, err;

	int ret, err;

	int i;

	int i;





	sq = virtnet_xdp_sq(vi);



	if (unlikely(flags & ~XDP_XMIT_FLAGS_MASK)) {

		ret = -EINVAL;

		drops = n;

		goto out;

	}



	/* Only allow ndo_xdp_xmit if XDP is loaded on dev, as this

	/* Only allow ndo_xdp_xmit if XDP is loaded on dev, as this

	 * indicate XDP resources have been successfully allocated.

	 * indicate XDP resources have been successfully allocated.

	 */

	 */

	xdp_prog = rcu_dereference(rq->xdp_prog);

	xdp_prog = rcu_dereference(rq->xdp_prog);

	if (!xdp_prog) {

	if (!xdp_prog)

		ret = -ENXIO;

		return -ENXIO;



	sq = virtnet_xdp_sq(vi);



	if (unlikely(flags & ~XDP_XMIT_FLAGS_MASK)) {

		ret = -EINVAL;

		drops = n;

		drops = n;

		goto out;

		goto out;

	}

	}