From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id AE228A0542 for ; Mon, 29 Aug 2022 17:10:05 +0200 (CEST) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 8A13C4069D; Mon, 29 Aug 2022 17:10:05 +0200 (CEST) Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by mails.dpdk.org (Postfix) with ESMTP id 75DAA4003C for ; Mon, 29 Aug 2022 17:10:04 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1661785803; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Ot8wbt7X0ODS7YDVjMkqP3DNCyT17iKaXGMGsYsie1M=; b=Ho1DIloDSUhQpfKKq//MsEQgR9+QG5Fd3JhZdfuqaf0ibyH/lI2vWcdKz+4zUscQ7hl9oK rW4z3ZUOHcIvO6LQBYzbHIfu4XMMaJT7Lw3KXBggN4jEKjHtXIXRTu9HNKy55wMU98WQNn BXiVfAV/S++aFns7PVl+m/FeEhEFk/s= Received: from mimecast-mx02.redhat.com (mx3-rdu2.redhat.com [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-307-VwepVixIPm-27OVCUVw-EA-1; Mon, 29 Aug 2022 11:10:01 -0400 X-MC-Unique: VwepVixIPm-27OVCUVw-EA-1 Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.rdu2.redhat.com [10.11.54.2]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 387E03C216C8; Mon, 29 Aug 2022 15:10:01 +0000 (UTC) Received: from fchome.redhat.com (unknown [10.40.193.251]) by smtp.corp.redhat.com (Postfix) with ESMTP id 5725740C141D; Mon, 29 Aug 2022 15:09:59 +0000 (UTC) From: David Marchand To: dev@dpdk.org Cc: Maxime Coquelin , stable@dpdk.org, Chenbo Xia , Tiwei Bie , Flavio Leitner , Yuan Wang , Xuan Ding Subject: [PATCH 1/2] vhost: discard too small descriptor chains Date: Mon, 29 Aug 2022 17:09:35 +0200 Message-Id: <20220829150936.1455069-1-david.marchand@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.84 on 10.11.54.2 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset="US-ASCII"; x-default=true X-BeenThere: stable@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: patches for DPDK stable branches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: stable-bounces@dpdk.org From: Maxime Coquelin This patch discards descriptor chains which are smaller than the Virtio-net header size, and ones that are equal. Indeed, such descriptor chains sizes mean there is no packet data. This patch also has the advantage of requesting the exact packets sizes for the mbufs. CVE-2022-2132 Fixes: 62250c1d0978 ("vhost: extract split ring handling from Rx and Tx functions") Fixes: c3ff0ac70acb ("vhost: improve performance by supporting large buffer") Fixes: 84d5204310d7 ("vhost: support async dequeue for split ring") Cc: stable@dpdk.org Signed-off-by: Maxime Coquelin Acked-by: Chenbo Xia Reviewed-by: David Marchand --- lib/vhost/virtio_net.c | 26 ++++++++++++++++++++++++-- 1 file changed, 24 insertions(+), 2 deletions(-) diff --git a/lib/vhost/virtio_net.c b/lib/vhost/virtio_net.c index 35fa4670fd..757d8dee17 100644 --- a/lib/vhost/virtio_net.c +++ b/lib/vhost/virtio_net.c @@ -2677,8 +2677,10 @@ desc_to_mbuf(struct virtio_net *dev, struct vhost_virtqueue *vq, buf_iova = buf_vec[vec_idx].buf_iova; buf_len = buf_vec[vec_idx].buf_len; - if (unlikely(buf_len < dev->vhost_hlen && nr_vec <= 1)) - return -1; + /* + * The caller has checked the descriptors chain is larger than the + * header size. + */ if (virtio_net_with_host_offload(dev)) { if (unlikely(buf_len < sizeof(struct virtio_net_hdr))) { @@ -2922,6 +2924,14 @@ virtio_dev_tx_split(struct virtio_net *dev, struct vhost_virtqueue *vq, update_shadow_used_ring_split(vq, head_idx, 0); + if (unlikely(buf_len <= dev->vhost_hlen)) { + dropped += 1; + i++; + break; + } + + buf_len -= dev->vhost_hlen; + err = virtio_dev_pktmbuf_prep(dev, pkts[i], buf_len); if (unlikely(err)) { /* @@ -3124,6 +3134,11 @@ vhost_dequeue_single_packed(struct virtio_net *dev, VHOST_ACCESS_RO) < 0)) return -1; + if (unlikely(buf_len <= dev->vhost_hlen)) + return -1; + + buf_len -= dev->vhost_hlen; + if (unlikely(virtio_dev_pktmbuf_prep(dev, pkts, buf_len))) { if (!allocerr_warned) { VHOST_LOG_DATA(dev->ifname, ERR, @@ -3448,6 +3463,13 @@ virtio_dev_tx_async_split(struct virtio_net *dev, struct vhost_virtqueue *vq, break; } + if (unlikely(buf_len <= dev->vhost_hlen)) { + dropped = true; + break; + } + + buf_len -= dev->vhost_hlen; + err = virtio_dev_pktmbuf_prep(dev, pkt, buf_len); if (unlikely(err)) { /** -- 2.37.2