Re: [PATCH net] hv_netvsc: Stop PPI parsing on invalid metadata

[Hamza Mahfooz]

On Tue, Oct 27, 2026 at 09:47:22AM -0700, Erni Sri Satya Vennela wrote:
> rndis_get_ppi() uses continue when a per-packet information entry has an
> invalid size or offset, or cannot hold the requested metadata. However,
> the remaining length and entry pointer are only updated at the bottom
> of the loop. Each error path therefore retries the same invalid entry
> indefinitely, repeatedly logging the error and preventing receive
> processing from completing.
> 

If you have reproduced this, I would strongly suggest that you
Cc: stable this patch.

> Return NULL on these validation failures instead of continuing. This
> terminates the lookup when malformed metadata is encountered while
> preserving the existing behavior for valid entries.
> 
> Fixes: 44144185951a ("hv_netvsc: Add validation for untrusted Hyper-V values")
> Signed-off-by: Erni Sri Satya Vennela <ernis@xxxxxxxxxxxxxxxxxxx>
> Reviewed-by: Haiyang Zhang <haiyangz@xxxxxxxxxxxxx>
> Reviewed-by: Wei Liu <liuwe@xxxxxxxxxxxxx>
> ---
>  drivers/net/hyperv/rndis_filter.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c
> index 9b6c44979b4e..2c30abf9faf8 100644
> --- a/drivers/net/hyperv/rndis_filter.c
> +++ b/drivers/net/hyperv/rndis_filter.c
> @@ -401,12 +401,12 @@ static inline void *rndis_get_ppi(struct net_device *ndev,
>  		/* Validate ppi_offset and ppi_size */
>  		if (ppi->size > len) {
>  			netdev_err(ndev, "Invalid ppi size: %u\n", ppi->size);
> -			continue;
> +			return NULL;
>  		}
>  
>  		if (ppi->ppi_offset >= ppi->size) {
>  			netdev_err(ndev, "Invalid ppi_offset: %u\n", ppi->ppi_offset);
> -			continue;
> +			return NULL;
>  		}
>  
>  		if (ppi->type == type && ppi->internal == internal) {
> @@ -414,7 +414,7 @@ static inline void *rndis_get_ppi(struct net_device *ndev,
>  			if (ppi->size - ppi->ppi_offset < ppi_size) {
>  				netdev_err(ndev, "Invalid ppi: size %u ppi_offset %u\n",
>  					   ppi->size, ppi->ppi_offset);
> -				continue;
> +				return NULL;
>  			}
>  			return (void *)((ulong)ppi + ppi->ppi_offset);
>  		}
> 
> base-commit: f71ff7d406523748bfb8236830c7eaa6a308aaa1
> -- 
> 2.34.1
>