tree 1e3c12395254c1afd1c6ebda3e1a18c381f9c9e0
parent 0ce146dcb28a61f9f9bc1eba7ee69e72ba20bcc7
author Jan Beulich <jbeulich@suse.com> 1704706692 +0100
committer He Gao <hegao@google.com> 1707171169 +0000

xen-netback: don't produce zero-size SKB frags

commit c7ec4f2d684e17d69bbdd7c4324db0ef5daac26a upstream.

While frontends may submit zero-size requests (wasting a precious slot),
core networking code as of at least 3ece782693c4b ("sock: skb_copy_ubufs
support for compound pages") can't deal with SKBs when they have all
zero-size fragments. Respond to empty requests right when populating
fragments; all further processing is fragment based and hence won't
encounter these empty requests anymore.

In a way this should have been that way from the beginning: When no data
is to be transferred for a particular request, there's not even a point
in validating the respective grant ref. That's no different from e.g.
passing NULL into memcpy() when at the same time the size is 0.

This is XSA-448 / CVE-2023-46838.

BUG=b/323501498
TEST=presubmit
RELEASE_NOTE=Fixed CVE-2023-46838 in the Linux kernel.

Change-Id: I9589596c21182df5219dffd37055fbc0dc986e57
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/64610
Reviewed-by: Michael Kochera <kochera@google.com>
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>