Re: [PATCH] virtio-net: correctly copy vnet header when flushing TX

2024-01-21 Thread Jason Wang
On Sat, Jan 20, 2024 at 6:42 PM Michael Tokarev wrote: > > 02.01.2024 06:29, Jason Wang : > > When HASH_REPORT is negotiated, the guest_hdr_len might be larger than > > the size of the mergeable rx buffer header. Using > > virtio_net_hdr_mrg_rxbuf during the header swap might lead a stack > > over

Re: [PATCH] virtio-net: correctly copy vnet header when flushing TX

2024-01-20 Thread Michael Tokarev
02.01.2024 06:29, Jason Wang : When HASH_REPORT is negotiated, the guest_hdr_len might be larger than the size of the mergeable rx buffer header. Using virtio_net_hdr_mrg_rxbuf during the header swap might lead a stack overflow in this case. Fixing this by using virtio_net_hdr_v1_hash instead. R

Re: [PATCH] virtio-net: correctly copy vnet header when flushing TX

2024-01-20 Thread Michael Tokarev
02.01.2024 06:29, Jason Wang : When HASH_REPORT is negotiated, the guest_hdr_len might be larger than the size of the mergeable rx buffer header. Using virtio_net_hdr_mrg_rxbuf during the header swap might lead a stack overflow in this case. Fixing this by using virtio_net_hdr_v1_hash instead. R

Re: [PATCH] virtio-net: correctly copy vnet header when flushing TX

2024-01-14 Thread Jason Wang
On Tue, Jan 2, 2024 at 11:29 AM Jason Wang wrote: > > When HASH_REPORT is negotiated, the guest_hdr_len might be larger than > the size of the mergeable rx buffer header. Using > virtio_net_hdr_mrg_rxbuf during the header swap might lead a stack > overflow in this case. Fixing this by using virtio

Re: [PATCH] virtio-net: correctly copy vnet header when flushing TX

2024-01-02 Thread Mauro Matteo Cascella
On Tue, Jan 2, 2024 at 12:20 PM Yuri Benditovich wrote: > > I agree, thank you. > > Where is this CVE-2023-6693 available? Here: https://bugzilla.redhat.com/show_bug.cgi?id=2254580. > Thanks, > Yuri > > On Tue, Jan 2, 2024 at 5:29 AM Jason Wang wrote: >> >> When HASH_REPORT is negotiated, the g

Re: [PATCH] virtio-net: correctly copy vnet header when flushing TX

2024-01-02 Thread Yuri Benditovich
I agree, thank you. Where is this CVE-2023-6693 available? Thanks, Yuri On Tue, Jan 2, 2024 at 5:29 AM Jason Wang wrote: > When HASH_REPORT is negotiated, the guest_hdr_len might be larger than > the size of the mergeable rx buffer header. Using > virtio_net_hdr_mrg_rxbuf during the header swa

[PATCH] virtio-net: correctly copy vnet header when flushing TX

2024-01-01 Thread Jason Wang
When HASH_REPORT is negotiated, the guest_hdr_len might be larger than the size of the mergeable rx buffer header. Using virtio_net_hdr_mrg_rxbuf during the header swap might lead a stack overflow in this case. Fixing this by using virtio_net_hdr_v1_hash instead. Reported-by: Xiao Lei Cc: Yuri Be