diff options
| author | Akihiko Odaki <akihiko.odaki@daynix.com> | 2024-07-01 20:58:04 +0900 |
|---|---|---|
| committer | Michael Tokarev <mjt@tls.msk.ru> | 2024-08-28 08:37:14 +0300 |
| commit | 44ef533498db5078c4432a3f1e160ed5539d7d29 (patch) | |
| tree | 20f3ded3cf252cdcf20ec5f84caea41ceca32cda | |
| parent | 17af53e425652caeefae5a3c4a8d9854299c684f (diff) | |
virtio-net: Ensure queue index fits with RSS
Ensure the queue index points to a valid queue when software RSS
enabled. The new calculation matches with the behavior of Linux's TAP
device with the RSS eBPF program.
Fixes: 4474e37a5b3a ("virtio-net: implement RX RSS processing")
Reported-by: Zhibin Hu <huzhibin5@huawei.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
(cherry picked from commit f1595ceb9aad36a6c1da95bcb77ab9509b38822d)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Fixes: CVE-2024-6505
| -rw-r--r-- | hw/net/virtio-net.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c index 0467b3bd8a..f84cff43aa 100644 --- a/hw/net/virtio-net.c +++ b/hw/net/virtio-net.c @@ -1909,7 +1909,8 @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf, if (!no_rss && n->rss_data.enabled && n->rss_data.enabled_software_rss) { int index = virtio_net_process_rss(nc, buf, size); if (index >= 0) { - NetClientState *nc2 = qemu_get_subqueue(n->nic, index); + NetClientState *nc2 = + qemu_get_subqueue(n->nic, index % n->curr_queue_pairs); return virtio_net_receive_rcu(nc2, buf, size, true); } } |