net/virtio: fix Rx checksum calculation

If hdr->csum_start is larger than packet length, the len argument passed to rte_raw_cksum_mbuf() overflows and causes a segmentation fault. Ignore checksum computation in this case. CVE-2024-11614 Fixes: ca7036b ("vhost: fix offload flags in Rx path") Signed-off-by: Maxime Gouin <[email protected]> Signed-off-by: Olivier Matz <[email protected]> Reviewed-by: Maxime Coquelin <[email protected]>
DPDK · Dec 17, 2024 · b8e7797 · b8e7797
1 parent 39bcde2
commit b8e7797
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/lib/vhost/virtio_net.c b/lib/vhost/virtio_net.c
@@ -2831,6 +2831,9 @@ vhost_dequeue_offload(struct virtio_net *dev, struct virtio_net_hdr *hdr,
 			 */
 			uint16_t csum = 0, off;
 
+			if (hdr->csum_start >= rte_pktmbuf_pkt_len(m))
+				return;
+
 			if (rte_raw_cksum_mbuf(m, hdr->csum_start,
 					rte_pktmbuf_pkt_len(m) - hdr->csum_start, &csum) < 0)
 				return;