Re: [PATCH net v2] virtio_net: check RX buffer length before DMA sync

[patchwork-bot+netdevbpf@kernel.org]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Tue, 10 Nov 2026 16:38:27 +0100 you wrote:
> An RX queue that uses the DMA API (rq->use_page_pool_dma, for example
> with VIRTIO_F_ACCESS_PLATFORM) syncs each received buffer with
> page_pool_dma_sync_for_cpu() using the length the device wrote to the
> used ring, and checks that length against the posted buffer only after
> the sync.
> 
> With SWIOTLB bouncing (swiotlb=force, or a confidential-computing
> guest), the sync copies from the shared bounce buffer into the guest's
> private page, so an oversized length also copies the bytes the device
> wrote past the posted buffer over the neighbouring page pool fragments.
> The later check drops the packet, but the copy has already happened. A
> malicious device, such as a host the confidential guest does not
> trust, can overwrite guest kernel memory next to an RX buffer with
> bytes it chooses, which is enough to take an unprivileged guest
> process to root.
> 
> [...]

Here is the summary with links:
  - [net,v2] virtio_net: check RX buffer length before DMA sync
    https://git.kernel.org/netdev/net/c/29dfa436bc48

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html