mbox series

[SRU,Mantic,Jammy,Focal,0/1] CVE-2023-46838

Message ID 20240213180959.27262-1-bethany.jamison@canonical.com
Headers show
Series [SRU,Mantic,Jammy,Focal,1/1] xen-netback: don't produce zero-size SKB frags | expand

Message

Bethany Jamison Feb. 13, 2024, 6:09 p.m. UTC
[Impact]

Transmit requests in Xen's virtual network protocol can consist of multiple
parts. While not really useful, except for the initial part any of them may
be of zero length, i.e. carry no data at all. Besides a certain initial
portion of the to be transferred data, these parts are directly translated
into what Linux calls SKB fragments. Such converted request parts can, when
for a particular SKB they are all of length zero, lead to a de-reference of
NULL in core networking code.

[Fix]

Mantic: Clean cherry-pick.
Jammy: Mantic patch applied cleanly.
Focal: Mantic patch applied cleanly.

[Test Case]

Compile and boot tested.

[Regression Potential]

Issues could occur when sending data through Xen's networking especially
when any of those segments are zeroed.

Jan Beulich (1):
  xen-netback: don't produce zero-size SKB frags

 drivers/net/xen-netback/netback.c | 44 ++++++++++++++++++++++++++-----
 1 file changed, 38 insertions(+), 6 deletions(-)

Comments

Stefan Bader Feb. 15, 2024, 8:29 a.m. UTC | #1
On 13.02.24 19:09, Bethany Jamison wrote:
> [Impact]
> 
> Transmit requests in Xen's virtual network protocol can consist of multiple
> parts. While not really useful, except for the initial part any of them may
> be of zero length, i.e. carry no data at all. Besides a certain initial
> portion of the to be transferred data, these parts are directly translated
> into what Linux calls SKB fragments. Such converted request parts can, when
> for a particular SKB they are all of length zero, lead to a de-reference of
> NULL in core networking code.
> 
> [Fix]
> 
> Mantic: Clean cherry-pick.
> Jammy: Mantic patch applied cleanly.
> Focal: Mantic patch applied cleanly.
> 
> [Test Case]
> 
> Compile and boot tested.
> 
> [Regression Potential]
> 
> Issues could occur when sending data through Xen's networking especially
> when any of those segments are zeroed.
> 
> Jan Beulich (1):
>    xen-netback: don't produce zero-size SKB frags
> 
>   drivers/net/xen-netback/netback.c | 44 ++++++++++++++++++++++++++-----
>   1 file changed, 38 insertions(+), 6 deletions(-)
> 

Acked-by: Stefan Bader <stefan.bader@canonical.com>
Andrei Gherzan Feb. 15, 2024, 1:13 p.m. UTC | #2
On 24/02/13 12:09PM, Bethany Jamison wrote:
> [Impact]
> 
> Transmit requests in Xen's virtual network protocol can consist of multiple
> parts. While not really useful, except for the initial part any of them may
> be of zero length, i.e. carry no data at all. Besides a certain initial
> portion of the to be transferred data, these parts are directly translated
> into what Linux calls SKB fragments. Such converted request parts can, when
> for a particular SKB they are all of length zero, lead to a de-reference of
> NULL in core networking code.
> 
> [Fix]
> 
> Mantic: Clean cherry-pick.
> Jammy: Mantic patch applied cleanly.
> Focal: Mantic patch applied cleanly.
> 
> [Test Case]
> 
> Compile and boot tested.
> 
> [Regression Potential]
> 
> Issues could occur when sending data through Xen's networking especially
> when any of those segments are zeroed.
> 
> Jan Beulich (1):
>   xen-netback: don't produce zero-size SKB frags
> 
>  drivers/net/xen-netback/netback.c | 44 ++++++++++++++++++++++++++-----
>  1 file changed, 38 insertions(+), 6 deletions(-)

Acked-by: Andrei Gherzan <andrei.gherzan@canonical.com>
Stefan Bader Feb. 19, 2024, 10:22 a.m. UTC | #3
On 13.02.24 19:09, Bethany Jamison wrote:
> [Impact]
> 
> Transmit requests in Xen's virtual network protocol can consist of multiple
> parts. While not really useful, except for the initial part any of them may
> be of zero length, i.e. carry no data at all. Besides a certain initial
> portion of the to be transferred data, these parts are directly translated
> into what Linux calls SKB fragments. Such converted request parts can, when
> for a particular SKB they are all of length zero, lead to a de-reference of
> NULL in core networking code.
> 
> [Fix]
> 
> Mantic: Clean cherry-pick.
> Jammy: Mantic patch applied cleanly.
> Focal: Mantic patch applied cleanly.
> 
> [Test Case]
> 
> Compile and boot tested.
> 
> [Regression Potential]
> 
> Issues could occur when sending data through Xen's networking especially
> when any of those segments are zeroed.
> 
> Jan Beulich (1):
>    xen-netback: don't produce zero-size SKB frags
> 
>   drivers/net/xen-netback/netback.c | 44 ++++++++++++++++++++++++++-----
>   1 file changed, 38 insertions(+), 6 deletions(-)
> 

Applied to mantic,jammy,focal:linux/master-next. Thanks.

-Stefan