From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mga02.intel.com (mga02.intel.com [134.134.136.20]) by dpdk.org (Postfix) with ESMTP id B95EBC3C0 for ; Thu, 18 Feb 2016 14:48:55 +0100 (CET) Received: from fmsmga003.fm.intel.com ([10.253.24.29]) by orsmga101.jf.intel.com with ESMTP; 18 Feb 2016 05:48:55 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.22,465,1449561600"; d="scan'208";a="655017176" Received: from yliu-dev.sh.intel.com ([10.239.66.49]) by FMSMGA003.fm.intel.com with ESMTP; 18 Feb 2016 05:48:54 -0800 From: Yuanhan Liu To: dev@dpdk.org Date: Thu, 18 Feb 2016 21:49:12 +0800 Message-Id: <1455803352-5518-8-git-send-email-yuanhan.liu@linux.intel.com> X-Mailer: git-send-email 1.9.0 In-Reply-To: <1455803352-5518-1-git-send-email-yuanhan.liu@linux.intel.com> References: <1449122773-25510-1-git-send-email-yuanhan.liu@linux.intel.com> <1455803352-5518-1-git-send-email-yuanhan.liu@linux.intel.com> Cc: "Michael S. Tsirkin" , Victor Kaplansky Subject: [dpdk-dev] [PATCH v2 7/7] vhost: do sanity check for desc->next X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: patches and discussions about DPDK List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Feb 2016 13:48:56 -0000 A malicious guest may easily forge some illegal vring desc buf. To make our vhost robust, we need make sure desc->next will not go beyond the vq->desc[] array. Suggested-by: Rich Lane Signed-off-by: Yuanhan Liu --- lib/librte_vhost/vhost_rxtx.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/lib/librte_vhost/vhost_rxtx.c b/lib/librte_vhost/vhost_rxtx.c index c2adcd9..b0c0c94 100644 --- a/lib/librte_vhost/vhost_rxtx.c +++ b/lib/librte_vhost/vhost_rxtx.c @@ -148,6 +148,8 @@ copy_mbuf_to_desc(struct virtio_net *dev, struct vhost_virtqueue *vq, /* Room in vring buffer is not enough */ return -1; } + if (unlikely(desc->next >= vq->size)) + return -1; desc = &vq->desc[desc->next]; desc_addr = gpa_to_vva(dev, desc->addr); @@ -302,7 +304,7 @@ fill_vec_buf(struct vhost_virtqueue *vq, uint32_t avail_idx, uint32_t len = *allocated; while (1) { - if (vec_id >= BUF_VECTOR_MAX) + if (unlikely(vec_id >= BUF_VECTOR_MAX || idx >= vq->size)) return -1; len += vq->desc[idx].len; @@ -671,6 +673,8 @@ copy_desc_to_mbuf(struct virtio_net *dev, struct vhost_virtqueue *vq, while (desc_avail || (desc->flags & VRING_DESC_F_NEXT) != 0) { /* This desc reachs to its end, get the next one */ if (desc_avail == 0) { + if (unlikely(desc->next >= vq->size)) + goto fail; desc = &vq->desc[desc->next]; desc_addr = gpa_to_vva(dev, desc->addr); @@ -691,9 +695,7 @@ copy_desc_to_mbuf(struct virtio_net *dev, struct vhost_virtqueue *vq, if (unlikely(!cur)) { RTE_LOG(ERR, VHOST_DATA, "Failed to " "allocate memory for mbuf.\n"); - if (head) - rte_pktmbuf_free(head); - return NULL; + goto fail; } if (!head) { head = cur; @@ -729,6 +731,11 @@ copy_desc_to_mbuf(struct virtio_net *dev, struct vhost_virtqueue *vq, } return head; + +fail: + if (head) + rte_pktmbuf_free(head); + return NULL; } uint16_t -- 1.9.0