From: "Wang, Xiao W" <xiao.w.wang@intel.com>
To: "Ananyev, Konstantin" <konstantin.ananyev@intel.com>,
David Marchand <david.marchand@redhat.com>
Cc: "Xia, Chenbo" <chenbo.xia@intel.com>,
Maxime Coquelin <maxime.coquelin@redhat.com>,
"Liu, Yong" <yong.liu@intel.com>, dev <dev@dpdk.org>,
dpdk stable <stable@dpdk.org>
Subject: Re: [dpdk-dev] [dpdk-stable] [PATCH v2] vhost: add header check in dequeue offload
Date: Tue, 16 Mar 2021 09:13:25 +0000 [thread overview]
Message-ID: <BN8PR11MB379581A6467039E5D9DA2730B86B9@BN8PR11MB3795.namprd11.prod.outlook.com> (raw)
In-Reply-To: <DM6PR11MB4491E39AC07D9328852492EB9A6C9@DM6PR11MB4491.namprd11.prod.outlook.com>
Hi,
Comments inline.
BRs,
Xiao
> -----Original Message-----
> From: Ananyev, Konstantin <konstantin.ananyev@intel.com>
> Sent: Tuesday, March 16, 2021 2:53 AM
> To: David Marchand <david.marchand@redhat.com>; Wang, Xiao W
> <xiao.w.wang@intel.com>
> Cc: Xia, Chenbo <chenbo.xia@intel.com>; Maxime Coquelin
> <maxime.coquelin@redhat.com>; Liu, Yong <yong.liu@intel.com>; dev
> <dev@dpdk.org>; dpdk stable <stable@dpdk.org>
> Subject: RE: [dpdk-stable] [PATCH v2] vhost: add header check in dequeue
> offload
>
>
>
> > -----Original Message-----
> > From: David Marchand <david.marchand@redhat.com>
> > Sent: Monday, March 15, 2021 4:17 PM
> > To: Wang, Xiao W <xiao.w.wang@intel.com>
> > Cc: Xia, Chenbo <chenbo.xia@intel.com>; Maxime Coquelin
> <maxime.coquelin@redhat.com>; Liu, Yong <yong.liu@intel.com>; dev
> > <dev@dpdk.org>; Ananyev, Konstantin <konstantin.ananyev@intel.com>;
> dpdk stable <stable@dpdk.org>
> > Subject: Re: [dpdk-stable] [PATCH v2] vhost: add header check in dequeue
> offload
> >
> > On Mon, Mar 15, 2021 at 4:52 PM Xiao Wang <xiao.w.wang@intel.com>
> wrote:
> > >
> > > When parsing the virtio net header and packet header for dequeue
> offload,
> > > we need to perform sanity check on the packet header to ensure:
> > > - No out-of-boundary memory access.
> > > - The packet header and virtio_net header are valid and aligned.
> > >
> > > Fixes: d0cf91303d73 ("vhost: add Tx offload capabilities")
> > > Cc: stable@dpdk.org
> > >
> > > Signed-off-by: Xiao Wang <xiao.w.wang@intel.com>
> > > ---
> > > v2:
> > > Allow empty L4 payload for cksum offload.
> > > ---
> > > lib/librte_vhost/virtio_net.c | 49
> +++++++++++++++++++++++++++++++++++++------
> > > 1 file changed, 43 insertions(+), 6 deletions(-)
> > >
> > > diff --git a/lib/librte_vhost/virtio_net.c b/lib/librte_vhost/virtio_net.c
> > > index 583bf379c6..53a8ff2898 100644
> > > --- a/lib/librte_vhost/virtio_net.c
> > > +++ b/lib/librte_vhost/virtio_net.c
> > > @@ -1821,44 +1821,64 @@ virtio_net_with_host_offload(struct
> virtio_net *dev)
> > > return false;
> > > }
> > >
> > > -static void
> > > -parse_ethernet(struct rte_mbuf *m, uint16_t *l4_proto, void
> **l4_hdr)
> > > +static int
> > > +parse_ethernet(struct rte_mbuf *m, uint16_t *l4_proto, void
> **l4_hdr,
> > > + uint16_t *len)
> > > {
> > > struct rte_ipv4_hdr *ipv4_hdr;
> > > struct rte_ipv6_hdr *ipv6_hdr;
> > > void *l3_hdr = NULL;
> > > struct rte_ether_hdr *eth_hdr;
> > > uint16_t ethertype;
> > > + uint16_t data_len = m->data_len;
> >
> > >
> > > eth_hdr = rte_pktmbuf_mtod(m, struct rte_ether_hdr *);
> > >
> > > + if (data_len <= sizeof(struct rte_ether_hdr))
> > > + return -EINVAL;
> >
> > On principle, the check should happen before calling rte_pktmbuf_mtod,
> > like what rte_pktmbuf_read does.
Yes, I agree. Will fix it in v3.
> >
> > Looking at the rest of the patch, does this helper function only
> > handle mono segment mbufs?
> > My reading of copy_desc_to_mbuf() was that it could generate multi
> > segments mbufs...
copy_desc_to_mbuf() could generate multi seg mbufs, and the whole packet would be copied into these multi-mbufs when packet size is larger than mbuf's capacity.
Anyway, one mbuf's capacity is big enough for holding the L2/L3/L4 header.
> >
> >
> > [snip]
> >
> > > case RTE_ETHER_TYPE_IPV4:
> > > + if (data_len <= sizeof(struct rte_ipv4_hdr))
> > > + return -EINVAL;
> > > ipv4_hdr = l3_hdr;
> > > *l4_proto = ipv4_hdr->next_proto_id;
> > > m->l3_len = rte_ipv4_hdr_len(ipv4_hdr);
> > > + if (data_len <= m->l3_len) {
> > > + m->l3_len = 0;
> > > + return -EINVAL;
> > > + }
> >
> > ... so here, comparing l3 length to only the first segment length
> > (data_len) would be invalid.
> >
> > If this helper must deal with multi segments, why not use
> rte_pktmbuf_read?
> > This function returns access to mbuf data after checking offset and
> > length are contiguous, else copy the needed data in a passed buffer.
>
> From my understanding, yes multi-seg is allowed, but an expectation
> Is that at least packet header (l2/l3/l4?) will always reside in first segment.
Yeah, I think so.
Thanks for all the comments,
-Xiao
>
> >
> >
> > > *l4_hdr = (char *)l3_hdr + m->l3_len;
> > > m->ol_flags |= PKT_TX_IPV4;
> > > + data_len -= m->l3_len;
> > > break;
> >
> >
> > --
> > David Marchand
next prev parent reply other threads:[~2021-03-16 9:13 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-03-11 6:38 [dpdk-dev] [PATCH] " Xiao Wang
2021-03-11 10:38 ` Ananyev, Konstantin
2021-03-12 15:19 ` Wang, Xiao W
2021-03-15 15:32 ` [dpdk-dev] [PATCH v2] " Xiao Wang
2021-03-15 16:17 ` [dpdk-dev] [dpdk-stable] " David Marchand
2021-03-15 18:53 ` Ananyev, Konstantin
2021-03-16 9:13 ` Wang, Xiao W [this message]
2021-03-17 6:31 ` [dpdk-dev] [PATCH v3] " Xiao Wang
2021-04-01 12:04 ` David Marchand
2021-04-02 8:38 ` Wang, Xiao W
2021-04-12 9:08 ` Wang, Xiao W
2021-04-12 9:33 ` David Marchand
2021-04-13 14:30 ` Maxime Coquelin
2021-05-08 5:54 ` Wang, Xiao W
2021-06-15 6:35 ` [dpdk-dev] [PATCH v4] vhost: check header for legacy " Xiao Wang
2021-06-15 7:57 ` David Marchand
2021-06-16 14:33 ` Wang, Xiao W
2021-06-21 8:21 ` [dpdk-dev] [PATCH v5] " Xiao Wang
2021-07-13 9:34 ` Maxime Coquelin
2021-07-20 2:43 ` Xia, Chenbo
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=BN8PR11MB379581A6467039E5D9DA2730B86B9@BN8PR11MB3795.namprd11.prod.outlook.com \
--to=xiao.w.wang@intel.com \
--cc=chenbo.xia@intel.com \
--cc=david.marchand@redhat.com \
--cc=dev@dpdk.org \
--cc=konstantin.ananyev@intel.com \
--cc=maxime.coquelin@redhat.com \
--cc=stable@dpdk.org \
--cc=yong.liu@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).