| From 3fd1466f7772791b3b619a35e8f1b4126a63682d Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Thu, 12 Feb 2026 22:40:40 +0000 |
| Subject: xen-netback: reject zero-queue configuration from guest |
| |
| From: Ziyi Guo <n7l8m4@u.northwestern.edu> |
| |
| [ Upstream commit 6d1dc8014334c7fb25719999bca84d811e60a559 ] |
| |
| A malicious or buggy Xen guest can write "0" to the xenbus key |
| "multi-queue-num-queues". The connect() function in the backend only |
| validates the upper bound (requested_num_queues > xenvif_max_queues) |
| but not zero, allowing requested_num_queues=0 to reach |
| vzalloc(array_size(0, sizeof(struct xenvif_queue))), which triggers |
| WARN_ON_ONCE(!size) in __vmalloc_node_range(). |
| |
| On systems with panic_on_warn=1, this allows a guest-to-host denial |
| of service. |
| |
| The Xen network interface specification requires |
| the queue count to be "greater than zero". |
| |
| Add a zero check to match the validation already present |
| in xen-blkback, which has included this |
| guard since its multi-queue support was added. |
| |
| Fixes: 8d3d53b3e433 ("xen-netback: Add support for multiple queues") |
| Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu> |
| Reviewed-by: Juergen Gross <jgross@suse.com> |
| Link: https://patch.msgid.link/20260212224040.86674-1-n7l8m4@u.northwestern.edu |
| Signed-off-by: Paolo Abeni <pabeni@redhat.com> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/net/xen-netback/xenbus.c | 5 +++-- |
| 1 file changed, 3 insertions(+), 2 deletions(-) |
| |
| diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c |
| index a78a25b872409..61b547aab286a 100644 |
| --- a/drivers/net/xen-netback/xenbus.c |
| +++ b/drivers/net/xen-netback/xenbus.c |
| @@ -735,10 +735,11 @@ static void connect(struct backend_info *be) |
| */ |
| requested_num_queues = xenbus_read_unsigned(dev->otherend, |
| "multi-queue-num-queues", 1); |
| - if (requested_num_queues > xenvif_max_queues) { |
| + if (requested_num_queues > xenvif_max_queues || |
| + requested_num_queues == 0) { |
| /* buggy or malicious guest */ |
| xenbus_dev_fatal(dev, -EINVAL, |
| - "guest requested %u queues, exceeding the maximum of %u.", |
| + "guest requested %u queues, but valid range is 1 - %u.", |
| requested_num_queues, xenvif_max_queues); |
| return; |
| } |
| -- |
| 2.51.0 |
| |
