From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mga09.intel.com (mga09.intel.com [134.134.136.24]) by dpdk.org (Postfix) with ESMTP id 367661B439; Fri, 4 Jan 2019 05:09:23 +0100 (CET) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga005.jf.intel.com ([10.7.209.41]) by orsmga102.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 03 Jan 2019 20:09:22 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.56,437,1539673200"; d="scan'208";a="288727291" Received: from dpdk-tbie.sh.intel.com ([10.67.104.173]) by orsmga005.jf.intel.com with ESMTP; 03 Jan 2019 20:09:21 -0800 From: Tiwei Bie To: maxime.coquelin@redhat.com, zhihong.wang@intel.com, dev@dpdk.org Cc: stable@dpdk.org Date: Fri, 4 Jan 2019 12:06:41 +0800 Message-Id: <20190104040642.27463-6-tiwei.bie@intel.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20190104040642.27463-1-tiwei.bie@intel.com> References: <20190104040642.27463-1-tiwei.bie@intel.com> Subject: [dpdk-dev] [PATCH 5/6] vhost: fix possible dead loop in vector filling X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 04 Jan 2019 04:09:23 -0000 Fix a possible dead loop which may happen, e.g. when driver created a loop in the desc list and lens in descs are zero. Fixes: fd68b4739d2c ("vhost: use buffer vectors in dequeue path") Fixes: 2f3225a7d69b ("vhost: add vector filling support for packed ring") Cc: stable@dpdk.org Signed-off-by: Tiwei Bie --- lib/librte_vhost/virtio_net.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/lib/librte_vhost/virtio_net.c b/lib/librte_vhost/virtio_net.c index d64c355b9..0893a1d04 100644 --- a/lib/librte_vhost/virtio_net.c +++ b/lib/librte_vhost/virtio_net.c @@ -309,6 +309,7 @@ fill_vec_buf_split(struct virtio_net *dev, struct vhost_virtqueue *vq, uint16_t vec_id = *vec_idx; uint32_t len = 0; uint64_t dlen; + uint32_t nr_descs = vq->size; struct vring_desc *descs = vq->desc; struct vring_desc *idesc = NULL; @@ -319,6 +320,10 @@ fill_vec_buf_split(struct virtio_net *dev, struct vhost_virtqueue *vq, if (vq->desc[idx].flags & VRING_DESC_F_INDIRECT) { dlen = vq->desc[idx].len; + nr_descs = dlen / sizeof(struct vring_desc); + if (unlikely(nr_descs > vq->size)) + return -1; + descs = (struct vring_desc *)(uintptr_t) vhost_iova_to_vva(dev, vq, vq->desc[idx].addr, &dlen, @@ -348,6 +353,11 @@ fill_vec_buf_split(struct virtio_net *dev, struct vhost_virtqueue *vq, return -1; } + if (unlikely(nr_descs-- == 0)) { + free_ind_table(idesc); + return -1; + } + len += descs[idx].len; if (unlikely(map_one_desc(dev, vq, buf_vec, &vec_id, @@ -510,6 +520,9 @@ fill_vec_buf_packed(struct virtio_net *dev, struct vhost_virtqueue *vq, if (unlikely(vec_id >= BUF_VECTOR_MAX)) return -1; + if (unlikely(*desc_count >= vq->size)) + return -1; + *desc_count += 1; *buf_id = descs[avail_idx].id; -- 2.17.1