Add a bounds check before accessing the UDP or TCP header in tap_verify_csum(). A single-segment packet whose L4 header extends past rte_pktmbuf_data_len() would cause an out-of-bounds read.
Signed-off-by: Stephen Hemminger <[email protected]> --- drivers/net/tap/rte_eth_tap.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/drivers/net/tap/rte_eth_tap.c b/drivers/net/tap/rte_eth_tap.c index fcc452527b..4fa71429fe 100644 --- a/drivers/net/tap/rte_eth_tap.c +++ b/drivers/net/tap/rte_eth_tap.c @@ -342,7 +342,7 @@ tap_verify_csum(struct rte_mbuf *mbuf) * greater than the total received size */ if (l2_len + rte_be_to_cpu_16(iph->total_length) > - rte_pktmbuf_data_len(mbuf)) + rte_pktmbuf_data_len(mbuf)) return; cksum = ~rte_raw_cksum(iph, l3_len); @@ -357,7 +357,7 @@ tap_verify_csum(struct rte_mbuf *mbuf) * greater than the total received size */ if (l2_len + l3_len + rte_be_to_cpu_16(iph->payload_len) > - rte_pktmbuf_data_len(mbuf)) + rte_pktmbuf_data_len(mbuf)) return; } else { /* - RTE_PTYPE_L3_IPV4_EXT_UNKNOWN cannot happen because @@ -367,8 +367,15 @@ tap_verify_csum(struct rte_mbuf *mbuf) */ return; } + if (l4 == RTE_PTYPE_L4_UDP || l4 == RTE_PTYPE_L4_TCP) { int cksum_ok; + const unsigned int l4_min_len = (l4 == RTE_PTYPE_L4_UDP) + ? sizeof(struct rte_udp_hdr) : sizeof(struct rte_tcp_hdr); + + /* Don't verify checksum if L4 header is truncated */ + if (l2_len + l3_len + l4_min_len > rte_pktmbuf_data_len(mbuf)) + return; l4_hdr = rte_pktmbuf_mtod_offset(mbuf, void *, l2_len + l3_len); /* Don't verify checksum for multi-segment packets. */ -- 2.51.0
