From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mailout1.w1.samsung.com (mailout1.w1.samsung.com [210.118.77.11]) by dpdk.org (Postfix) with ESMTP id 041693977 for ; Fri, 15 Jul 2016 09:23:16 +0200 (CEST) Received: from eucpsbgm2.samsung.com (unknown [203.254.199.245]) by mailout1.w1.samsung.com (Oracle Communications Messaging Server 7.0.5.31.0 64bit (built May 5 2014)) with ESMTP id <0OAC00FHEHUP5400@mailout1.w1.samsung.com> for dev@dpdk.org; Fri, 15 Jul 2016 08:23:13 +0100 (BST) X-AuditID: cbfec7f5-f792a6d000001302-d8-57888f613fdc Received: from eusync4.samsung.com ( [203.254.199.214]) by eucpsbgm2.samsung.com (EUCPMTA) with SMTP id FB.BA.04866.16F88875; Fri, 15 Jul 2016 08:23:13 +0100 (BST) Received: from [106.109.129.180] by eusync4.samsung.com (Oracle Communications Messaging Server 7.0.5.31.0 64bit (built May 5 2014)) with ESMTPA id <0OAC00CT1HUOLY60@eusync4.samsung.com>; Fri, 15 Jul 2016 08:23:13 +0100 (BST) To: Yuanhan Liu References: <1463748604-27251-1-git-send-email-i.maximets@samsung.com> <1468484319-26906-1-git-send-email-i.maximets@samsung.com> <20160715061724.GD5146@yliu-dev.sh.intel.com> Cc: dev@dpdk.org, Huawei Xie , Rich Lane , Dyasly Sergey , Heetae Ahn , Jianfeng Tan , Stephen Hemminger , Thomas Monjalon From: Ilya Maximets Message-id: <57888F60.4090206@samsung.com> Date: Fri, 15 Jul 2016 10:23:12 +0300 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.8.0 MIME-version: 1.0 In-reply-to: <20160715061724.GD5146@yliu-dev.sh.intel.com> Content-type: text/plain; charset=windows-1252 Content-transfer-encoding: 7bit X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFvrMLMWRmVeSWpSXmKPExsVy+t/xa7qJ/R3hBo0X5S3efdrOZDHt8212 i/aZZ5ksrrT/ZLfonv2FzWLTu0msFpNnS1ksviNn8WXTdDaL6xMusDpweVzsv8Po8eDyTSaP XwuWsnos3vOSyWPeyUCPnpPzmDz6tqxiDGCP4rJJSc3JLEst0rdL4MpYtmsuc8EjuYqNhz8z NTC+l+hi5OSQEDCReHh2KSOELSZx4d56ti5GLg4hgaWMEhMPTmKCcF4wSqx4vZ4ZpEpYwFVi wY1+VhBbREBX4umcdawQRZsZJW42N7ODOMwCG5kkZp9bzg5SxSagI3Fq9RGwHbwCWhLPD3wA i7MIqEr0bbgENlVUIEJi1vYfTBA1ghI/Jt9jAbE5Bawk9k+bDxTnABqqJ3H/ohZImFlAXmLz mrfMExgFZiHpmIVQNQtJ1QJG5lWMoqmlyQXFSem5RnrFibnFpXnpesn5uZsYIVHxdQfj0mNW hxgFOBiVeHh3HGoPF2JNLCuuzD3EKMHBrCTC69bTES7Em5JYWZValB9fVJqTWnyIUZqDRUmc d+au9yFCAumJJanZqakFqUUwWSYOTqkGxou7bOWenjMJFV7Q0T2H7fzUrKQ7ug63Tm6fX/36 0/kXiy5O1922puU3W9mlmCV9fHm7rPa8bij5lyjgfeenkd78zqtWkm0qsZw5ZxM/bl4+v600 aMnU52KtetFfKzdzaPPsij0q07dU/8X6iBN3O58sXdbc8Vzpi1Xzta9sElWPIhVyM187WCmx FGckGmoxFxUnAgAvYDADhgIAAA== Subject: Re: [dpdk-dev] [PATCH v2] vhost: fix segfault on bad descriptor address X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: patches and discussions about DPDK List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Jul 2016 07:23:16 -0000 On 15.07.2016 09:17, Yuanhan Liu wrote: > On Thu, Jul 14, 2016 at 11:18:39AM +0300, Ilya Maximets wrote: >> In current implementation vhost will crash with segmentation fault >> if malicious or buggy virtio application breaks addresses of descriptors. >> >> Before commit 0823c1cb0a73 this crash was reproducible even with >> normal DPDK application that tries to change number of virtqueues >> dynamically inside VM. >> >> Fix that by checking addresses of descriptors before using. >> >> Also fixed return value on error for 'copy_mbuf_to_desc_mergeable()' >> from '-1' to '0' because it returns unsigned value and it means >> number of used descriptors. > > Yeah, that's a good fix. Thanks. > > Maybe you'd better make it a standalone patch. Ok. Maybe I should split this patch in two: 1. Fix return value + using of this value (vq->last_used_idx += nr_used;) 2. Check addresses of descriptors. What do you think? >> Signed-off-by: Ilya Maximets >> --- >> Version 2: >> * Rebased on top of current master. >> * host's address now checked in meargeable case, >> because needed refactoring already done. >> * Commit-message changed because old issue with >> virtio reload accidentially fixed by commit >> 0823c1cb0a73. >> >> lib/librte_vhost/vhost_rxtx.c | 28 +++++++++++++++++++++------- >> 1 file changed, 21 insertions(+), 7 deletions(-) >> >> diff --git a/lib/librte_vhost/vhost_rxtx.c b/lib/librte_vhost/vhost_rxtx.c >> index 15ca956..31e8b58 100644 >> --- a/lib/librte_vhost/vhost_rxtx.c >> +++ b/lib/librte_vhost/vhost_rxtx.c >> @@ -147,10 +147,10 @@ copy_mbuf_to_desc(struct virtio_net *dev, struct vhost_virtqueue *vq, >> struct virtio_net_hdr_mrg_rxbuf virtio_hdr = {{0, 0, 0, 0, 0, 0}, 0}; >> >> desc = &vq->desc[desc_idx]; >> - if (unlikely(desc->len < dev->vhost_hlen)) >> + desc_addr = gpa_to_vva(dev, desc->addr); >> + if (unlikely(desc->len < dev->vhost_hlen || !desc_addr)) >> return -1; > > So, you discards the workaround from Rich? I can apply it, if you wish. Should I? >> >> - desc_addr = gpa_to_vva(dev, desc->addr); >> rte_prefetch0((void *)(uintptr_t)desc_addr); >> >> virtio_enqueue_offload(m, &virtio_hdr.hdr); >> @@ -182,7 +182,10 @@ copy_mbuf_to_desc(struct virtio_net *dev, struct vhost_virtqueue *vq, >> return -1; >> >> desc = &vq->desc[desc->next]; >> - desc_addr = gpa_to_vva(dev, desc->addr); >> + desc_addr = gpa_to_vva(dev, desc->addr); >> + if (unlikely(!desc_addr)) >> + return -1; >> + >> desc_offset = 0; >> desc_avail = desc->len; >> } >> @@ -387,10 +390,10 @@ copy_mbuf_to_desc_mergeable(struct virtio_net *dev, struct vhost_virtqueue *vq, >> LOG_DEBUG(VHOST_DATA, "(%d) current index %d | end index %d\n", >> dev->vid, cur_idx, end_idx); >> >> - if (buf_vec[vec_idx].buf_len < dev->vhost_hlen) >> - return -1; >> - >> desc_addr = gpa_to_vva(dev, buf_vec[vec_idx].buf_addr); >> + if (buf_vec[vec_idx].buf_len < dev->vhost_hlen || !desc_addr) >> + return 0; >> + >> rte_prefetch0((void *)(uintptr_t)desc_addr); >> >> virtio_hdr.num_buffers = end_idx - start_idx; >> @@ -425,6 +428,8 @@ copy_mbuf_to_desc_mergeable(struct virtio_net *dev, struct vhost_virtqueue *vq, >> >> vec_idx++; >> desc_addr = gpa_to_vva(dev, buf_vec[vec_idx].buf_addr); >> + if (unlikely(!desc_addr)) >> + return 0; >> >> /* Prefetch buffer address. */ >> rte_prefetch0((void *)(uintptr_t)desc_addr); >> @@ -507,7 +512,7 @@ virtio_dev_merge_rx(struct virtio_net *dev, uint16_t queue_id, >> *(volatile uint16_t *)&vq->used->idx += nr_used; >> vhost_log_used_vring(dev, vq, offsetof(struct vring_used, idx), >> sizeof(vq->used->idx)); >> - vq->last_used_idx = end; >> + vq->last_used_idx += nr_used; > > Ditto, this may deserve another patch, too. > > --yliu > >