Re: [PATCH net v2] hv_netvsc: Stop PPI parsing on invalid metadata

[Simon Horman <horms@kernel.org>]

On Fri, Oct 30, 2026 at 02:34:59AM -0700, Erni Sri Satya Vennela wrote:
> rndis_get_ppi() uses continue when a per-packet information entry has an
> invalid size or offset, or cannot hold the requested metadata. However,
> the remaining length and entry pointer are only updated at the bottom
> of the loop. Each error path therefore retries the same invalid entry
> indefinitely, repeatedly logging the error and preventing receive
> processing from completing.
> 
> Return NULL on these validation failures instead of continuing. This
> terminates the lookup when malformed metadata is encountered while
> preserving the existing behavior for valid entries.
> 
> The issue was reported through an internal bug-tracking system and
> confirmed by manual code inspection. The pre-fix hang has not been
> reproduced locally.
> 
> Fixes: 44144185951a ("hv_netvsc: Add validation for untrusted Hyper-V values")
> Cc: stable@vger.kernel.org
> Signed-off-by: Erni Sri Satya Vennela <ernis@linux.microsoft.com>
> Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com>
> Reviewed-by: Wei Liu <liuwe@microsoft.com>
> ---
> Changes in v2:
> * Add Cc: stable@vger.kernel.org
> * Clarify how the issue was reported and confirmed in commit message.

Reviewed-by: Simon Horman <horms@kernel.org>