* [PATCH 1/2] vhost: discard too small descriptor chains
@ 2022-08-29 15:09 David Marchand
2022-08-29 15:09 ` [PATCH 2/2] vhost: fix header spanned across more than two descriptors David Marchand
0 siblings, 1 reply; 3+ messages in thread
From: David Marchand @ 2022-08-29 15:09 UTC (permalink / raw)
To: dev
Cc: Maxime Coquelin, stable, Chenbo Xia, Tiwei Bie, Flavio Leitner,
Yuan Wang, Xuan Ding
From: Maxime Coquelin <maxime.coquelin@redhat.com>
This patch discards descriptor chains which are smaller
than the Virtio-net header size, and ones that are equal.
Indeed, such descriptor chains sizes mean there is no
packet data.
This patch also has the advantage of requesting the exact
packets sizes for the mbufs.
CVE-2022-2132
Fixes: 62250c1d0978 ("vhost: extract split ring handling from Rx and Tx functions")
Fixes: c3ff0ac70acb ("vhost: improve performance by supporting large buffer")
Fixes: 84d5204310d7 ("vhost: support async dequeue for split ring")
Cc: stable@dpdk.org
Signed-off-by: Maxime Coquelin <maxime.coquelin@redhat.com>
Acked-by: Chenbo Xia <chenbo.xia@intel.com>
Reviewed-by: David Marchand <david.marchand@redhat.com>
---
lib/vhost/virtio_net.c | 26 ++++++++++++++++++++++++--
1 file changed, 24 insertions(+), 2 deletions(-)
diff --git a/lib/vhost/virtio_net.c b/lib/vhost/virtio_net.c
index 35fa4670fd..757d8dee17 100644
--- a/lib/vhost/virtio_net.c
+++ b/lib/vhost/virtio_net.c
@@ -2677,8 +2677,10 @@ desc_to_mbuf(struct virtio_net *dev, struct vhost_virtqueue *vq,
buf_iova = buf_vec[vec_idx].buf_iova;
buf_len = buf_vec[vec_idx].buf_len;
- if (unlikely(buf_len < dev->vhost_hlen && nr_vec <= 1))
- return -1;
+ /*
+ * The caller has checked the descriptors chain is larger than the
+ * header size.
+ */
if (virtio_net_with_host_offload(dev)) {
if (unlikely(buf_len < sizeof(struct virtio_net_hdr))) {
@@ -2922,6 +2924,14 @@ virtio_dev_tx_split(struct virtio_net *dev, struct vhost_virtqueue *vq,
update_shadow_used_ring_split(vq, head_idx, 0);
+ if (unlikely(buf_len <= dev->vhost_hlen)) {
+ dropped += 1;
+ i++;
+ break;
+ }
+
+ buf_len -= dev->vhost_hlen;
+
err = virtio_dev_pktmbuf_prep(dev, pkts[i], buf_len);
if (unlikely(err)) {
/*
@@ -3124,6 +3134,11 @@ vhost_dequeue_single_packed(struct virtio_net *dev,
VHOST_ACCESS_RO) < 0))
return -1;
+ if (unlikely(buf_len <= dev->vhost_hlen))
+ return -1;
+
+ buf_len -= dev->vhost_hlen;
+
if (unlikely(virtio_dev_pktmbuf_prep(dev, pkts, buf_len))) {
if (!allocerr_warned) {
VHOST_LOG_DATA(dev->ifname, ERR,
@@ -3448,6 +3463,13 @@ virtio_dev_tx_async_split(struct virtio_net *dev, struct vhost_virtqueue *vq,
break;
}
+ if (unlikely(buf_len <= dev->vhost_hlen)) {
+ dropped = true;
+ break;
+ }
+
+ buf_len -= dev->vhost_hlen;
+
err = virtio_dev_pktmbuf_prep(dev, pkt, buf_len);
if (unlikely(err)) {
/**
--
2.37.2
^ permalink raw reply [flat|nested] 3+ messages in thread
* [PATCH 2/2] vhost: fix header spanned across more than two descriptors
2022-08-29 15:09 [PATCH 1/2] vhost: discard too small descriptor chains David Marchand
@ 2022-08-29 15:09 ` David Marchand
2022-08-29 15:13 ` David Marchand
0 siblings, 1 reply; 3+ messages in thread
From: David Marchand @ 2022-08-29 15:09 UTC (permalink / raw)
To: dev; +Cc: Maxime Coquelin, stable, Chenbo Xia, Tiwei Bie
From: Maxime Coquelin <maxime.coquelin@redhat.com>
This patch aims at supporting the unlikely case where a
Virtio-net header is spanned across more than two
descriptors.
CVE-2022-2132
Fixes: fd68b4739d2c ("vhost: use buffer vectors in dequeue path")
Cc: stable@dpdk.org
Signed-off-by: Maxime Coquelin <maxime.coquelin@redhat.com>
Acked-by: Chenbo Xia <chenbo.xia@intel.com>
Reviewed-by: David Marchand <david.marchand@redhat.com>
---
lib/vhost/virtio_net.c | 45 +++++++++++++-----------------------------
1 file changed, 14 insertions(+), 31 deletions(-)
diff --git a/lib/vhost/virtio_net.c b/lib/vhost/virtio_net.c
index 757d8dee17..270c71a54e 100644
--- a/lib/vhost/virtio_net.c
+++ b/lib/vhost/virtio_net.c
@@ -2664,26 +2664,22 @@ desc_to_mbuf(struct virtio_net *dev, struct vhost_virtqueue *vq,
uint32_t buf_avail, buf_offset, buf_len;
uint64_t buf_addr, buf_iova;
uint32_t mbuf_avail, mbuf_offset;
+ uint32_t hdr_remain = dev->vhost_hlen;
uint32_t cpy_len;
struct rte_mbuf *cur = m, *prev = m;
struct virtio_net_hdr tmp_hdr;
struct virtio_net_hdr *hdr = NULL;
- /* A counter to avoid desc dead loop chain */
- uint16_t vec_idx = 0;
+ uint16_t vec_idx;
struct vhost_async *async = vq->async;
struct async_inflight_info *pkts_info;
- buf_addr = buf_vec[vec_idx].buf_addr;
- buf_iova = buf_vec[vec_idx].buf_iova;
- buf_len = buf_vec[vec_idx].buf_len;
-
/*
* The caller has checked the descriptors chain is larger than the
* header size.
*/
if (virtio_net_with_host_offload(dev)) {
- if (unlikely(buf_len < sizeof(struct virtio_net_hdr))) {
+ if (unlikely(buf_vec[0].buf_len < sizeof(struct virtio_net_hdr))) {
/*
* No luck, the virtio-net header doesn't fit
* in a contiguous virtual area.
@@ -2691,36 +2687,23 @@ desc_to_mbuf(struct virtio_net *dev, struct vhost_virtqueue *vq,
copy_vnet_hdr_from_desc(&tmp_hdr, buf_vec);
hdr = &tmp_hdr;
} else {
- hdr = (struct virtio_net_hdr *)((uintptr_t)buf_addr);
+ hdr = (struct virtio_net_hdr *)((uintptr_t)buf_vec[0].buf_addr);
}
}
- /*
- * A virtio driver normally uses at least 2 desc buffers
- * for Tx: the first for storing the header, and others
- * for storing the data.
- */
- if (unlikely(buf_len < dev->vhost_hlen)) {
- buf_offset = dev->vhost_hlen - buf_len;
- vec_idx++;
- buf_addr = buf_vec[vec_idx].buf_addr;
- buf_iova = buf_vec[vec_idx].buf_iova;
- buf_len = buf_vec[vec_idx].buf_len;
- buf_avail = buf_len - buf_offset;
- } else if (buf_len == dev->vhost_hlen) {
- if (unlikely(++vec_idx >= nr_vec))
- goto error;
- buf_addr = buf_vec[vec_idx].buf_addr;
- buf_iova = buf_vec[vec_idx].buf_iova;
- buf_len = buf_vec[vec_idx].buf_len;
+ for (vec_idx = 0; vec_idx < nr_vec; vec_idx++) {
+ if (buf_vec[vec_idx].buf_len > hdr_remain)
+ break;
- buf_offset = 0;
- buf_avail = buf_len;
- } else {
- buf_offset = dev->vhost_hlen;
- buf_avail = buf_vec[vec_idx].buf_len - dev->vhost_hlen;
+ hdr_remain -= buf_vec[vec_idx].buf_len;
}
+ buf_addr = buf_vec[vec_idx].buf_addr;
+ buf_iova = buf_vec[vec_idx].buf_iova;
+ buf_len = buf_vec[vec_idx].buf_len;
+ buf_offset = hdr_remain;
+ buf_avail = buf_vec[vec_idx].buf_len - hdr_remain;
+
PRINT_PACKET(dev,
(uintptr_t)(buf_addr + buf_offset),
(uint32_t)buf_avail, 0);
--
2.37.2
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH 2/2] vhost: fix header spanned across more than two descriptors
2022-08-29 15:09 ` [PATCH 2/2] vhost: fix header spanned across more than two descriptors David Marchand
@ 2022-08-29 15:13 ` David Marchand
0 siblings, 0 replies; 3+ messages in thread
From: David Marchand @ 2022-08-29 15:13 UTC (permalink / raw)
To: Maxime Coquelin; +Cc: dev, dpdk stable, Chenbo Xia, Tiwei Bie
On Mon, Aug 29, 2022 at 5:10 PM David Marchand
<david.marchand@redhat.com> wrote:
>
> From: Maxime Coquelin <maxime.coquelin@redhat.com>
>
> This patch aims at supporting the unlikely case where a
> Virtio-net header is spanned across more than two
> descriptors.
>
> CVE-2022-2132
> Fixes: fd68b4739d2c ("vhost: use buffer vectors in dequeue path")
> Cc: stable@dpdk.org
>
> Signed-off-by: Maxime Coquelin <maxime.coquelin@redhat.com>
> Acked-by: Chenbo Xia <chenbo.xia@intel.com>
> Reviewed-by: David Marchand <david.marchand@redhat.com>
Series applied, thanks.
--
David Marchand
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2022-08-29 15:13 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-08-29 15:09 [PATCH 1/2] vhost: discard too small descriptor chains David Marchand
2022-08-29 15:09 ` [PATCH 2/2] vhost: fix header spanned across more than two descriptors David Marchand
2022-08-29 15:13 ` David Marchand
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).