LLQ stride accounting inverted: ena_com.c:657 assigns descs_per_entry backwards (SINGLE→entry/64, MULTIPLE→1) contradicting the vendor enum semantics and ena_eth_com.c:202 — free-space guard undercounts for SINGLE-stride LLQs and lets the tail lap outstanding descriptors
Summary
Config site and runtime site define per-line descriptor capacity oppositely (sanity-confirmed by direct read); have_enough_space uses the inverted value so on SINGLE-stride devices the guard permits ~2x the real lines - SQ tail laps next_to_comp and in-flight descriptor lines are overwritten (masked in-bounds: device-contract corruption, not guest OOB). Orchestrator-verified inversion. Two-line swap fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4757 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 1.2 KB | view raw |
Fix verification
not_testableConfirmed kernel references
Detail
Exploit chain
SINGLE-stride LLQ device + burst of fragmented mbufs -> have_enough_space permits ~2x the available lines -> tail overwrites unfetched descriptor lines of in-flight packets -> tx corruption/resets
Evidence (decisive lines)
findings/poc/DF-4757/ (this verdict; source excerpts in reviewer notes)
Verdict
Branch inversion confirmed by direct source read (orchestrator sanity-check): ena_com.c:657-661 assigns SINGLE_DESC_PER_ENTRY -> desc_list_entry_size/64 while the runtime walk ena_eth_com.c:202-206 gives SINGLE -> 1 (and MULTIPLE -> entry/64), matching vendor enum docs; ena_com_sq_have_enough_space consumes the inverted config so on SINGLE-stride LLQ devices the free-space guard undercounts ~2x and the SQ tail can lap outstanding descriptor lines (masked in-bounds writes - device-contract corruption, not guest OOB). Requires an ENA device advertising SINGLE-stride LLQ; none on the QEMU guest. Two-line swap fix.
No comments yet.