Re: [PATCH 6.1.y] virtio_net: clamp rss_indir_table_size to VIRTIO_NET_RSS_MAX_TABLE_LEN

[Greg KH <gregkh@linuxfoundation.org>]

On Fri, Jul 03, 2026 at 07:52:56PM +0900, Hyokyung Kim wrote:
> virtnet_probe() reads rss_max_indirection_table_length from the device
> config space into vi->rss_indir_table_size and later uses it as the
> number of entries to write into the fixed-size 128-entry indirection
> table in struct virtio_net_ctrl_rss (in virtnet_init_default_rss(), and
> again in virtnet_set_rxfh()/virtnet_get_rxfh()), without validating it
> against VIRTIO_NET_RSS_MAX_TABLE_LEN. A malicious or buggy device can
> report a length larger than 128 and overflow the array, corrupting
> adjacent slab memory. This is reachable at probe time, before the
> interface is brought up.
> 
> This was fixed upstream by commit 86a48a00efdf ("virtio_net: Support
> dynamic rss indirection table size"), which reworks the driver to
> allocate the indirection table dynamically. However that change is too
> large to backport to stable. Instead, clamp the device-advertised length
> to VIRTIO_NET_RSS_MAX_TABLE_LEN: this solves the overflow with minimal
> changes.

Why is it "too large"?  Again, we want to keep as close as possible to
upstream as diverging will cause bugs and maintenance problems over
time.

thanks,

greg k-h