From: Maxime Coquelin <maxime.coquelin@redhat.com>
To: Yuanhan Liu <yuanhan.liu@linux.intel.com>, dev@dpdk.org
Cc: stable@dpdk.org
Subject: Re: [dpdk-dev] [PATCH 1/3] vhost: fix dead loop in enqueue path
Date: Mon, 23 Jan 2017 08:56:04 +0100 [thread overview]
Message-ID: <99093bd1-0970-b374-5261-7e91d33fe4b6@redhat.com> (raw)
In-Reply-To: <1485074820-8956-2-git-send-email-yuanhan.liu@linux.intel.com>
On 01/22/2017 09:46 AM, Yuanhan Liu wrote:
> If a malicious guest forges a dead loop desc chain (let desc->next point
> to itself) and desc->len is zero, this could lead to a dead loop in
> copy_mbuf_to_desc(following is a simplified code to show this issue
> clearly):
>
> while (mbuf_is_not_totally_consumed) {
> if (desc_avail == 0) {
> desc = &descs[desc->next];
> desc_avail = desc->len;
> }
>
> COPY(desc, mbuf, desc_avail);
> }
>
> I have actually fixed a same issue before: a436f53ebfeb ("vhost: avoid
> dead loop chain"); it fixes the dequeue path though, leaving the enqueue
> path still vulnerable.
>
> The fix is the same. Add a var nr_desc to avoid the dead loop.
>
> Fixes: f1a519ad981c ("vhost: fix enqueue/dequeue to handle chained vring descriptors")
>
> Cc: stable@dpdk.org
> Reported-by: Xieming Katty <katty.xieming@huawei.com>
> Signed-off-by: Yuanhan Liu <yuanhan.liu@linux.intel.com>
> ---
> lib/librte_vhost/virtio_net.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
Thanks for the fix:
Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com>
- Maxime
next prev parent reply other threads:[~2017-01-23 7:56 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-01-22 8:46 [dpdk-dev] [PATCH 0/3] few virtio/vhost fixes Yuanhan Liu
2017-01-22 8:46 ` [dpdk-dev] [PATCH 1/3] vhost: fix dead loop in enqueue path Yuanhan Liu
2017-01-23 7:56 ` Maxime Coquelin [this message]
2017-01-22 8:46 ` [dpdk-dev] [PATCH 2/3] vhost: fix long stall of vhost-user negotiation Yuanhan Liu
2017-01-23 8:25 ` Maxime Coquelin
2017-01-22 8:47 ` [dpdk-dev] [PATCH 3/3] net/virtio: fix crash when number of virtio devices > 1 Yuanhan Liu
2017-01-23 7:58 ` Maxime Coquelin
2017-01-23 10:57 ` [dpdk-dev] [PATCH 0/3] few virtio/vhost fixes Yuanhan Liu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=99093bd1-0970-b374-5261-7e91d33fe4b6@redhat.com \
--to=maxime.coquelin@redhat.com \
--cc=dev@dpdk.org \
--cc=stable@dpdk.org \
--cc=yuanhan.liu@linux.intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).