CVE-2024-58099

In the Linux kernel, the following vulnerability has been resolved:

vmxnet3: Fix packet corruption in vmxnet3_xdp_xmit_frame

Andrew and Nikolay reported connectivity issues with Cilium's service

load-balancing in case of vmxnet3.

If a BPF program for native XDP adds an encapsulation header such as

IPIP and transmits the packet out the same interface, then in case

of vmxnet3 a corrupted packet is being sent and subsequently dropped

on the path.

vmxnet3_xdp_xmit_frame() which is called e.g. via vmxnet3_run_xdp()

through vmxnet3_xdp_xmit_back() calculates an incorrect DMA address:

page = virt_to_page(xdpf->data);

tbi->dma_addr = page_pool_get_dma_addr(page) +

VMXNET3_XDP_HEADROOM;

dma_sync_single_for_device(&adapter->pdev->dev,

tbi->dma_addr, buf_size,

DMA_TO_DEVICE);

The above assumes a fixed offset (VMXNET3_XDP_HEADROOM), but the XDP

BPF program could have moved xdp->data. While the passed buf_size is

correct (xdpf->len), the dma_addr needs to have a dynamic offset which

can be calculated as xdpf->data - (void *)xdpf, that is, xdp->data -

xdp->data_hard_start.