diff options
| author | Akihiko Odaki <akihiko.odaki@daynix.com> | 2024-07-01 20:58:04 +0900 |
|---|---|---|
| committer | Michael Tokarev <mjt@tls.msk.ru> | 2024-08-06 17:18:08 +0300 |
| commit | d2476ced2e34b661dded77d8774955b5a90fbda4 (patch) | |
| tree | 519bd8862a500555d3a34da54a4fac2b4d31839d | |
| parent | 318a0b055634efa543cc6dcb880780ed329cc24e (diff) | |
virtio-net: Ensure queue index fits with RSS
Ensure the queue index points to a valid queue when software RSS
enabled. The new calculation matches with the behavior of Linux's TAP
device with the RSS eBPF program.
Fixes: 4474e37a5b3a ("virtio-net: implement RX RSS processing")
Reported-by: Zhibin Hu <huzhibin5@huawei.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
(cherry picked from commit f1595ceb9aad36a6c1da95bcb77ab9509b38822d)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Fixes: CVE-2024-6505
| -rw-r--r-- | hw/net/virtio-net.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c index beadea5bf8..ebee5db1bc 100644 --- a/hw/net/virtio-net.c +++ b/hw/net/virtio-net.c @@ -1846,7 +1846,8 @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf, if (!no_rss && n->rss_data.enabled && n->rss_data.enabled_software_rss) { int index = virtio_net_process_rss(nc, buf, size); if (index >= 0) { - NetClientState *nc2 = qemu_get_subqueue(n->nic, index); + NetClientState *nc2 = + qemu_get_subqueue(n->nic, index % n->curr_queue_pairs); return virtio_net_receive_rcu(nc2, buf, size, true); } } |