diff options
| author | Ross Lagerwall <ross.lagerwall@citrix.com> | 2023-08-03 08:41:22 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2023-08-08 20:04:52 +0200 |
| commit | cf482893f721f76ac60c0a43482a59b2f194156b (patch) | |
| tree | f014995aee61d2f2e0b598ac0c7b4c600326f693 /net/ipv6/xfrm6_input.c | |
| parent | 9b73a2a43f4dbc6f870cdcc67a79949c687a22c5 (diff) | |
| download | linux-stable-cf482893f721f76ac60c0a43482a59b2f194156b.tar.gz linux-stable-cf482893f721f76ac60c0a43482a59b2f194156b.tar.bz2 linux-stable-cf482893f721f76ac60c0a43482a59b2f194156b.zip | |
xen/netback: Fix buffer overrun triggered by unusual packet
commit 534fc31d09b706a16d83533e16b5dc855caf7576 upstream.
It is possible that a guest can send a packet that contains a head + 18
slots and yet has a len <= XEN_NETBACK_TX_COPY_LEN. This causes nr_slots
to underflow in xenvif_get_requests() which then causes the subsequent
loop's termination condition to be wrong, causing a buffer overrun of
queue->tx_map_ops.
Rework the code to account for the extra frag_overflow slots.
This is CVE-2023-34319 / XSA-432.
Fixes: ad7f402ae4f4 ("xen/netback: Ensure protocol headers don't fall in the non-linear area")
Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
Reviewed-by: Paul Durrant <paul@xen.org>
Reviewed-by: Wei Liu <wei.liu@kernel.org>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net/ipv6/xfrm6_input.c')
0 files changed, 0 insertions, 0 deletions