Re: [PATCH 5.4.y] virtio-net: Add validation for used length

[Sasha Levin <sashal@kernel.org>]

[ Sasha's backport helper bot ]

Hi,

Summary of potential issues:
⚠️ Found matching upstream commit but patch is missing proper reference to it

Found matching upstream commit: ad993a95c508417acdeb15244109e009e50d8758

WARNING: Author mismatch between patch and found commit:
Backport author: Larry Bassel<larry.bassel@oracle.com>
Commit author: Xie Yongji<xieyongji@bytedance.com>

Status in newer kernel trees:
6.13.y | Present (exact SHA1)
6.12.y | Present (exact SHA1)
6.6.y | Present (exact SHA1)
6.1.y | Present (exact SHA1)
5.15.y | Present (exact SHA1)
5.10.y | Present (different SHA1: c92298d228f6)

Note: The patch differs from the upstream commit:
---
1:  ad993a95c5084 ! 1:  34cd3a563c1ba virtio-net: Add validation for used length
    @@ Metadata
      ## Commit message ##
         virtio-net: Add validation for used length
     
    +    commit ad993a95c508 ("virtio-net: Add validation for used length")
    +
         This adds validation for used length (might come
         from an untrusted device) to avoid data corruption
         or loss.
    @@ Commit message
         Acked-by: Jason Wang <jasowang@redhat.com>
         Link: https://lore.kernel.org/r/20210531135852.113-1-xieyongji@bytedance.com
         Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    +    (cherry picked from commit ad993a95c508417acdeb15244109e009e50d8758)
    +    [Larry: backport to 5.4.y. Minor conflict resolved due to missing commit 9ce6146ec7b50
    +    virtio_net: Add XDP frame size in two code paths]
    +    Signed-off-by: Larry Bassel <larry.bassel@oracle.com>
     
      ## drivers/net/virtio_net.c ##
     @@ drivers/net/virtio_net.c: static struct sk_buff *receive_small(struct net_device *dev,
    @@ drivers/net/virtio_net.c: static struct sk_buff *receive_mergeable(struct net_de
      	head_skb = NULL;
      	stats->bytes += len - vi->hdr_len;
      
    ++	truesize = mergeable_ctx_to_truesize(ctx);
     +	if (unlikely(len > truesize)) {
     +		pr_debug("%s: rx error: len %u exceeds truesize %lu\n",
     +			 dev->name, len, (unsigned long)ctx);
    @@ drivers/net/virtio_net.c: static struct sk_buff *receive_mergeable(struct net_de
      	}
      	rcu_read_unlock();
      
    +-	truesize = mergeable_ctx_to_truesize(ctx);
     -	if (unlikely(len > truesize)) {
     -		pr_debug("%s: rx error: len %u exceeds truesize %lu\n",
     -			 dev->name, len, (unsigned long)ctx);
    @@ drivers/net/virtio_net.c: static struct sk_buff *receive_mergeable(struct net_de
     -	}
     -
      	head_skb = page_to_skb(vi, rq, page, offset, len, truesize, !xdp_prog,
    - 			       metasize, !!headroom);
    + 			       metasize);
      	curr_skb = head_skb;
---

Results of testing on various branches:

| Branch                    | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| stable/linux-5.4.y        |  Success    |  Success   |