From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mga07.intel.com (mga07.intel.com [134.134.136.100]) by dpdk.org (Postfix) with ESMTP id EBFEF5320; Sun, 22 Jan 2017 09:44:49 +0100 (CET) Received: from orsmga002.jf.intel.com ([10.7.209.21]) by orsmga105.jf.intel.com with ESMTP; 22 Jan 2017 00:44:47 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.33,268,1477983600"; d="scan'208";a="33807491" Received: from yliu-dev.sh.intel.com ([10.239.67.162]) by orsmga002.jf.intel.com with ESMTP; 22 Jan 2017 00:44:36 -0800 From: Yuanhan Liu To: dev@dpdk.org Cc: Yuanhan Liu , stable@dpdk.org Date: Sun, 22 Jan 2017 16:46:58 +0800 Message-Id: <1485074820-8956-2-git-send-email-yuanhan.liu@linux.intel.com> X-Mailer: git-send-email 1.9.0 In-Reply-To: <1485074820-8956-1-git-send-email-yuanhan.liu@linux.intel.com> References: <1485074820-8956-1-git-send-email-yuanhan.liu@linux.intel.com> Subject: [dpdk-dev] [PATCH 1/3] vhost: fix dead loop in enqueue path X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 22 Jan 2017 08:44:50 -0000 If a malicious guest forges a dead loop desc chain (let desc->next point to itself) and desc->len is zero, this could lead to a dead loop in copy_mbuf_to_desc(following is a simplified code to show this issue clearly): while (mbuf_is_not_totally_consumed) { if (desc_avail == 0) { desc = &descs[desc->next]; desc_avail = desc->len; } COPY(desc, mbuf, desc_avail); } I have actually fixed a same issue before: a436f53ebfeb ("vhost: avoid dead loop chain"); it fixes the dequeue path though, leaving the enqueue path still vulnerable. The fix is the same. Add a var nr_desc to avoid the dead loop. Fixes: f1a519ad981c ("vhost: fix enqueue/dequeue to handle chained vring descriptors") Cc: stable@dpdk.org Reported-by: Xieming Katty Signed-off-by: Yuanhan Liu --- lib/librte_vhost/virtio_net.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/lib/librte_vhost/virtio_net.c b/lib/librte_vhost/virtio_net.c index 595f67c..143c0fa 100644 --- a/lib/librte_vhost/virtio_net.c +++ b/lib/librte_vhost/virtio_net.c @@ -195,6 +195,8 @@ static inline int __attribute__((always_inline)) struct vring_desc *desc; uint64_t desc_addr; struct virtio_net_hdr_mrg_rxbuf virtio_hdr = {{0, 0, 0, 0, 0, 0}, 0}; + /* A counter to avoid desc dead loop chain */ + uint16_t nr_desc = 1; desc = &descs[desc_idx]; desc_addr = gpa_to_vva(dev, desc->addr); @@ -233,7 +235,7 @@ static inline int __attribute__((always_inline)) /* Room in vring buffer is not enough */ return -1; } - if (unlikely(desc->next >= size)) + if (unlikely(desc->next >= size || ++nr_desc > size)) return -1; desc = &descs[desc->next]; -- 1.9.0