When an RSC candidate packet has trailing padding bytes beyond the
declared IP payload, virtio_net_rsc_cache_buf() copies the full wire
size into the coalescing buffer and sets seg->size to that value.
The bounds check in virtio_net_rsc_coalesce_data() uses the IP
length field (o_ip_len) which does not include the padding, so the
check can pass while the subsequent memmove() overflows the buffer.
Fix this by computing the actual IP packet size from the IP header
and using it for both the memcpy and seg->size, so that seg->size
stays in sync with the IP length field. virtio_net_rsc_sanity_check4/6()
guarantees that ip_size <= size.
Fixes: CVE-2026-66900
Fixes: 2974e916df87 ("virtio-net: support RSC v4/v6 tcp traffic for Windows
HCK")
Cc: [email protected]
Cc: Yuri Benditovich <[email protected]>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3879
Reported-by: Sven <[email protected]>
Signed-off-by: Laurent Vivier <[email protected]>
---
hw/net/virtio-net.c | 22 ++++++++++++++++++++--
1 file changed, 20 insertions(+), 2 deletions(-)
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index 814b99a43d20..53796287528a 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -2195,13 +2195,31 @@ static void virtio_net_rsc_cache_buf(VirtioNetRscChain
*chain,
{
uint16_t hdr_len;
VirtioNetRscSeg *seg;
+ size_t ip_size;
hdr_len = chain->n->guest_hdr_len;
+
+ /*
+ * Strip any trailing padding beyond the IP payload so that seg->size
+ * stays in sync with the IP length field used by the bounds check in
+ * virtio_net_rsc_coalesce_data(). virtio_net_rsc_sanity_check4/6()
+ * guarantees that ip_size <= size.
+ */
+ ip_size = hdr_len + sizeof(struct eth_header);
+ if (chain->proto == ETH_P_IP) {
+ struct ip_header *ip = (struct ip_header *)(buf + ip_size);
+ ip_size += htons(ip->ip_len);
+ } else {
+ struct ip6_header *ip6 = (struct ip6_header *)(buf + ip_size);
+ ip_size += sizeof(struct ip6_header)
+ + htons(ip6->ip6_ctlun.ip6_un1.ip6_un1_plen);
+ }
+
seg = g_new(VirtioNetRscSeg, 1);
seg->buf = g_malloc(hdr_len + sizeof(struct eth_header)
+ sizeof(struct ip6_header) + VIRTIO_NET_MAX_TCP_PAYLOAD);
- memcpy(seg->buf, buf, size);
- seg->size = size;
+ memcpy(seg->buf, buf, ip_size);
+ seg->size = ip_size;
seg->packets = 1;
seg->dup_ack = 0;
seg->is_coalesced = 0;
--
2.54.0
