Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/49013/?format=api
{ "id": 49013, "url": "http://patches.dpdk.org/api/patches/49013/?format=api", "web_url": "http://patches.dpdk.org/project/dpdk/patch/20181217155005.13457-3-bruce.richardson@intel.com/", "project": { "id": 1, "url": "http://patches.dpdk.org/api/projects/1/?format=api", "name": "DPDK", "link_name": "dpdk", "list_id": "dev.dpdk.org", "list_email": "dev@dpdk.org", "web_url": "http://core.dpdk.org", "scm_url": "git://dpdk.org/dpdk", "webscm_url": "http://git.dpdk.org/dpdk", "list_archive_url": "https://inbox.dpdk.org/dev", "list_archive_url_format": "https://inbox.dpdk.org/dev/{}", "commit_url_format": "" }, "msgid": "<20181217155005.13457-3-bruce.richardson@intel.com>", "list_archive_url": "https://inbox.dpdk.org/dev/20181217155005.13457-3-bruce.richardson@intel.com", "date": "2018-12-17T15:50:05", "name": "[2/2] net/tap: add buffer overflow checks before checksum", "commit_ref": null, "pull_url": null, "state": "accepted", "archived": true, "hash": "827e4ef2c9e8499559541ca605938bbccf2ea492", "submitter": { "id": 20, "url": "http://patches.dpdk.org/api/people/20/?format=api", "name": "Bruce Richardson", "email": "bruce.richardson@intel.com" }, "delegate": { "id": 319, "url": "http://patches.dpdk.org/api/users/319/?format=api", "username": "fyigit", "first_name": "Ferruh", "last_name": "Yigit", "email": "ferruh.yigit@amd.com" }, "mbox": "http://patches.dpdk.org/project/dpdk/patch/20181217155005.13457-3-bruce.richardson@intel.com/mbox/", "series": [ { "id": 2835, "url": "http://patches.dpdk.org/api/series/2835/?format=api", "web_url": "http://patches.dpdk.org/project/dpdk/list/?series=2835", "date": "2018-12-17T15:50:03", "name": "prevent out of bounds read with checksum", "version": 1, "mbox": "http://patches.dpdk.org/series/2835/mbox/" } ], "comments": "http://patches.dpdk.org/api/patches/49013/comments/", "check": "success", "checks": "http://patches.dpdk.org/api/patches/49013/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "<dev-bounces@dpdk.org>", "X-Original-To": "patchwork@dpdk.org", "Delivered-To": "patchwork@dpdk.org", "Received": [ "from [92.243.14.124] (localhost [127.0.0.1])\n\tby dpdk.org (Postfix) with ESMTP id C3A261B90E;\n\tMon, 17 Dec 2018 16:50:41 +0100 (CET)", "from mga04.intel.com (mga04.intel.com [192.55.52.120])\n\tby dpdk.org (Postfix) with ESMTP id B15111B6F7;\n\tMon, 17 Dec 2018 16:50:37 +0100 (CET)", "from fmsmga001.fm.intel.com ([10.253.24.23])\n\tby fmsmga104.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384;\n\t17 Dec 2018 07:50:33 -0800", "from silpixa00399126.ir.intel.com (HELO\n\tsilpixa00399126.ger.corp.intel.com) ([10.237.222.236])\n\tby fmsmga001.fm.intel.com with ESMTP; 17 Dec 2018 07:50:31 -0800" ], "X-Amp-Result": "SKIPPED(no attachment in message)", "X-Amp-File-Uploaded": "False", "X-ExtLoop1": "1", "X-IronPort-AV": "E=Sophos;i=\"5.56,365,1539673200\"; d=\"scan'208\";a=\"130652891\"", "From": "Bruce Richardson <bruce.richardson@intel.com>", "To": "Olivier Matz <olivier.matz@6wind.com>,\n\tKeith Wiles <keith.wiles@intel.com>", "Cc": "dev@dpdk.org, Bruce Richardson <bruce.richardson@intel.com>,\n\tstable@dpdk.org", "Date": "Mon, 17 Dec 2018 15:50:05 +0000", "Message-Id": "<20181217155005.13457-3-bruce.richardson@intel.com>", "X-Mailer": "git-send-email 2.19.2", "In-Reply-To": "<20181217155005.13457-1-bruce.richardson@intel.com>", "References": "<20181217155005.13457-1-bruce.richardson@intel.com>", "MIME-Version": "1.0", "Content-Transfer-Encoding": "8bit", "Subject": "[dpdk-dev] [PATCH 2/2] net/tap: add buffer overflow checks before\n\tchecksum", "X-BeenThere": "dev@dpdk.org", "X-Mailman-Version": "2.1.15", "Precedence": "list", "List-Id": "DPDK patches and discussions <dev.dpdk.org>", "List-Unsubscribe": "<https://mails.dpdk.org/options/dev>,\n\t<mailto:dev-request@dpdk.org?subject=unsubscribe>", "List-Archive": "<http://mails.dpdk.org/archives/dev/>", "List-Post": "<mailto:dev@dpdk.org>", "List-Help": "<mailto:dev-request@dpdk.org?subject=help>", "List-Subscribe": "<https://mails.dpdk.org/listinfo/dev>,\n\t<mailto:dev-request@dpdk.org?subject=subscribe>", "Errors-To": "dev-bounces@dpdk.org", "Sender": "\"dev\" <dev-bounces@dpdk.org>" }, "content": "The checksum calculation APIs take only the packet headers pointers as\nparameters, so they assume that the lengths reported in those headers are\ncorrect. However, a malicious packet could claim to be far larger than it\nis, so we need to check the header lengths in the driver before calling\nthe checksum API.\n\nA better fix would be to allow the lengths to be passed into the API\nfunction, but that would be an API break, so fixing in TAP driver for\nnow.\n\nCC: stable@dpdk.org\nFixes: 8ae3023387e9 (\"net/tap: add Rx/Tx checksum offload support\")\n\nSigned-off-by: Bruce Richardson <bruce.richardson@intel.com>\n---\n drivers/net/tap/rte_eth_tap.c | 14 ++++++++++++++\n 1 file changed, 14 insertions(+)", "diff": "diff --git a/drivers/net/tap/rte_eth_tap.c b/drivers/net/tap/rte_eth_tap.c\nindex 49afd38dd..0ec030bef 100644\n--- a/drivers/net/tap/rte_eth_tap.c\n+++ b/drivers/net/tap/rte_eth_tap.c\n@@ -281,13 +281,27 @@ tap_verify_csum(struct rte_mbuf *mbuf)\n \t\tl3_len = 4 * (iph->version_ihl & 0xf);\n \t\tif (unlikely(l2_len + l3_len > rte_pktmbuf_data_len(mbuf)))\n \t\t\treturn;\n+\t\t/* check that the total length reported by header is not\n+\t\t * greater than the total received size\n+\t\t */\n+\t\tif (l2_len + rte_be_to_cpu_16(iph->total_length) >\n+\t\t\t\trte_pktmbuf_data_len(mbuf))\n+\t\t\treturn;\n \n \t\tcksum = ~rte_raw_cksum(iph, l3_len);\n \t\tmbuf->ol_flags |= cksum ?\n \t\t\tPKT_RX_IP_CKSUM_BAD :\n \t\t\tPKT_RX_IP_CKSUM_GOOD;\n \t} else if (l3 == RTE_PTYPE_L3_IPV6) {\n+\t\tstruct ipv6_hdr *iph = l3_hdr;\n+\n \t\tl3_len = sizeof(struct ipv6_hdr);\n+\t\t/* check that the total length reported by header is not\n+\t\t * greater than the total received size\n+\t\t */\n+\t\tif (l2_len + l3_len + rte_be_to_cpu_16(iph->payload_len) >\n+\t\t\t\trte_pktmbuf_data_len(mbuf))\n+\t\t\treturn;\n \t} else {\n \t\t/* IPv6 extensions are not supported */\n \t\treturn;\n", "prefixes": [ "2/2" ] }