[PATCH 22.11] net/virtio: fix Rx checksum calculation

[Maxime Coquelin]

From: Olivier Matz <olivier.matz at 6wind.com>

If hdr->csum_start is larger than packet length, the len argument passed
to rte_raw_cksum_mbuf() overflows and causes a segmentation fault.

Ignore checksum computation in this case.

CVE-2024-11614

Fixes: ca7036b4af3a ("vhost: fix offload flags in Rx path")
Signed-off-by: Maxime Gouin <maxime.gouin at 6wind.com>
Signed-off-by: Olivier Matz <olivier.matz at 6wind.com>
(cherry picked from commit 2b85965865e543373163577c0bba6c4e1dc3a3ad)
---
 lib/vhost/virtio_net.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/vhost/virtio_net.c b/lib/vhost/virtio_net.c
index 9f314f83c7..9c9d05d4d9 100644
--- a/lib/vhost/virtio_net.c
+++ b/lib/vhost/virtio_net.c
@@ -2593,6 +2593,9 @@ vhost_dequeue_offload(struct virtio_net *dev, struct virtio_net_hdr *hdr,
 			 */
 			uint16_t csum = 0, off;
 
+			if (hdr->csum_start >= rte_pktmbuf_pkt_len(m))
+				return;
+
 			if (rte_raw_cksum_mbuf(m, hdr->csum_start,
 					rte_pktmbuf_pkt_len(m) - hdr->csum_start, &csum) < 0)
 				return;
-- 
2.47.0