Reference in a new issue

Blame

Copy permalink

Reference in a new issue

Copy permalink

Ziyi Guo ec4859ac5c xen-netback: reject zero-queue configuration from guest ... [ Upstream commit 6d1dc80143 ] A malicious or buggy Xen guest can write "0" to the xenbus key "multi-queue-num-queues". The connect() function in the backend only validates the upper bound (requested_num_queues > xenvif_max_queues) but not zero, allowing requested_num_queues=0 to reach vzalloc(array_size(0, sizeof(struct xenvif_queue))), which triggers WARN_ON_ONCE(!size) in __vmalloc_node_range(). On systems with panic_on_warn=1, this allows a guest-to-host denial of service. The Xen network interface specification requires the queue count to be "greater than zero". Add a zero check to match the validation already present in xen-blkback, which has included this guard since its multi-queue support was added. Fixes: 8d3d53b3e4 ("xen-netback: Add support for multiple queues") Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu> Reviewed-by: Juergen Gross <jgross@suse.com> Link: https://patch.msgid.link/20260212224040.86674-1-n7l8m4@u.northwestern.edu Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		History 2026-03-04 07:20:37 -05:00
..
common.h	net: extend ubuf_info callback to ops structure	2024-04-22 16:21:35 -07:00
hash.c	net/xen-netback: prevent UAF in xenvif_flush_hash()	2024-08-28 17:07:42 -07:00
interface.c	net: annotate writes on dev->mtu from ndo_change_mtu()	2024-05-07 16:19:14 -07:00
Makefile	treewide: Add SPDX license identifier - Makefile/Kconfig	2019-05-21 10:50:46 +02:00
netback.c	Merge branch 'for-uring-ubufops' into HEAD	2024-04-22 17:15:39 -07:00
rx.c	xen/netback: don't call kfree_skb() with interrupts disabled	2022-12-06 16:00:33 +01:00
xenbus.c	xen-netback: reject zero-queue configuration from guest	2026-03-04 07:20:37 -05:00