From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id A9A58A0547; Fri, 12 Mar 2021 16:19:28 +0100 (CET) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 3F5C5160863; Fri, 12 Mar 2021 16:19:28 +0100 (CET) Received: from mga12.intel.com (mga12.intel.com [192.55.52.136]) by mails.dpdk.org (Postfix) with ESMTP id E3791406FF; Fri, 12 Mar 2021 16:19:24 +0100 (CET) IronPort-SDR: 7mmmD8m7UB6rWrP091k/Gt0v9QlW40G5qUmHtitW2EFxF3mQdHF/EfgZrgKKh1VN3p0UMpG58p iaWE60FvC+3Q== X-IronPort-AV: E=McAfee;i="6000,8403,9921"; a="168117023" X-IronPort-AV: E=Sophos;i="5.81,243,1610438400"; d="scan'208";a="168117023" Received: from fmsmga005.fm.intel.com ([10.253.24.32]) by fmsmga106.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 12 Mar 2021 07:19:24 -0800 IronPort-SDR: Pi9z9PRu2bjxf+mNBFFQtL5RwMRFYhnw8Kkg2uAUsYL0q6ykaA59T67GzDM3FDeYwMzYt8mp6H sH1deF3lWoSw== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.81,243,1610438400"; d="scan'208";a="603957553" Received: from orsmsx603.amr.corp.intel.com ([10.22.229.16]) by fmsmga005.fm.intel.com with ESMTP; 12 Mar 2021 07:19:24 -0800 Received: from orsmsx608.amr.corp.intel.com (10.22.229.21) by ORSMSX603.amr.corp.intel.com (10.22.229.16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2106.2; Fri, 12 Mar 2021 07:19:23 -0800 Received: from orsmsx608.amr.corp.intel.com (10.22.229.21) by ORSMSX608.amr.corp.intel.com (10.22.229.21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2106.2; Fri, 12 Mar 2021 07:19:23 -0800 Received: from orsedg603.ED.cps.intel.com (10.7.248.4) by orsmsx608.amr.corp.intel.com (10.22.229.21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2106.2 via Frontend Transport; Fri, 12 Mar 2021 07:19:23 -0800 Received: from NAM12-BN8-obe.outbound.protection.outlook.com (104.47.55.168) by edgegateway.intel.com (134.134.137.100) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.1.2106.2; Fri, 12 Mar 2021 07:19:22 -0800 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=UI6wxEMJS8s6O5djaOa/rfMpEnsLhE4WA4d/F0iE5f4i77uZals+33EOriuzPEDwgJzL90eRbqCSZEfpJsl/wtwl6QbdBugJjefJUFoI5oZWGjtX+A8qPpSpxGHawFs6HVj01RoOVGXENLF/bij03xn5aIp+KlVrwVKK8/7hs7kSp/POz4f+c4vqRBCwau8VV3sjD7/WMwiaMFDHtyTFtHPg6yQBDiWErMb/BnGXmBGFvscaC5T6QYC7BGMFjYqTgw5AV4IpTHw+UIecAEKa9BFEJMfdbhR3EuMdBj1egD9Y05pzo82bAeSTAFJn3oriWTLI/7tMTaenV8yDsYl6Cg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=OQxiCv7Y6WDw+45zvKKZdGY0ChKfFy5/QwGk2/6WqAA=; b=Ztbx1wUZBpmSs0JVaZ0n2zGOc//KVAqhL6USS1FcNqKX7IN3ktMvC499IaFK4YKKNAPH9SOz3yGXxZm8iaGYAEsKaO1vfB85AorJYqJqqhzs8R2XJkk/rGhOAb94zW0lBqOxCWLMA5L2pfiIB6KLIKLDEshP/pzmhOlKZiQ1NszvtfM3DTAxaZHTlo+lbLA4ftVLYYxZ0/VbEYLfOw5jPByyKpysDiU3v1ERUshgam9hvXmkB7WTLKie20sogtdUFeONPGOp3y0TUxPpPw0rwGvA/4UbGP/CBhQq/iIKNY1DL03VR9ZGQ71unC4CzMoJ5e9HSo5YqwyUe1Ne9aTVFw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=intel.com; dmarc=pass action=none header.from=intel.com; dkim=pass header.d=intel.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=intel.onmicrosoft.com; s=selector2-intel-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=OQxiCv7Y6WDw+45zvKKZdGY0ChKfFy5/QwGk2/6WqAA=; b=azsjnp9+QqlgxSO1ry0aDyqbIGOiTaLLMdYQdG2TCUKRFDGwQcyJ2r7YuTyK6ZQA0b09Mte/LC5NptJ0tykS3Z5njF3fI0tXGnymWo2ut2MaLvNNNtKWdE6SXnvqlk5D3qtx0inxf0VNdXF7OqrvznJ0fOIlzAQO6wmiiFGsVac= Received: from BN8PR11MB3795.namprd11.prod.outlook.com (2603:10b6:408:82::31) by BN6PR1101MB2180.namprd11.prod.outlook.com (2603:10b6:405:58::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3912.17; Fri, 12 Mar 2021 15:19:15 +0000 Received: from BN8PR11MB3795.namprd11.prod.outlook.com ([fe80::ec6a:25a8:8c59:89e]) by BN8PR11MB3795.namprd11.prod.outlook.com ([fe80::ec6a:25a8:8c59:89e%2]) with mapi id 15.20.3912.031; Fri, 12 Mar 2021 15:19:15 +0000 From: "Wang, Xiao W" To: "Ananyev, Konstantin" , "Xia, Chenbo" , "maxime.coquelin@redhat.com" CC: "Liu, Yong" , "dev@dpdk.org" , "stable@dpdk.org" Thread-Topic: [dpdk-dev] [PATCH] vhost: add header check in dequeue offload Thread-Index: AQHXFkPndLud4Gtx/UKM1rfBnxqDfKp+mM0AgAHdoDA= Date: Fri, 12 Mar 2021 15:19:15 +0000 Message-ID: References: <20210311063827.55394-1-xiao.w.wang@intel.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: dlp-reaction: no-action dlp-version: 11.5.1.3 dlp-product: dlpe-windows authentication-results: intel.com; dkim=none (message not signed) header.d=none;intel.com; dmarc=none action=none header.from=intel.com; x-originating-ip: [112.65.8.174] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 311eef60-0d5a-4169-3706-08d8e56a331b x-ms-traffictypediagnostic: BN6PR1101MB2180: x-ld-processed: 46c98d88-e344-4ed4-8496-4ed7712e255d,ExtAddr x-ms-exchange-transport-forked: True x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8882; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: 41h+vmlg8jTqq4eMKED2SCHjF1eSLePZHkZG8NgBTQU+GDb/x+hdWDm9nhk4OkVUIcNKcCFbbeGtjUNRpTqivpmfZ7m5xP3QPj48Q1hUudqV04gerSyKQcYGvRdvzJxBagpdLatjXTocken4uH71sZAeaw+72B8MdvSJ9JHpJ6JQCqiwTmlxqi34Gn2pG0An6LJKLawXBuzD1pxsVwsftvuzaWuIGpnv4fswBZ0QK/0Sgo5t4jyU6lNCx2B4RevW3WDbXZuMiAlAJaZ1i52yk8EOBqoUFUSdmABbtEMhswGh/OdvkWPH93rPEzFozKfeEYYncTwKGKP4bvabkHH+anv+95ddtTMsQQ3GyBvXVMWT2fRbQuSOybKnpjubg8sDuOlfdegE2Io4sXlENY2GmGiqwZlF5zEeG3SBVr6ZBvE09Vf6lbYLqNTyCz65E7vBMyTeHPahBdNSE+ARcIfNwiZlpUzCcW06i/SGYerxlFmS0rrQHu3TE40MFZODlOCGrNu7CYzSCxzRUBzdXNwReg== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BN8PR11MB3795.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFS:(396003)(346002)(136003)(366004)(39860400002)(376002)(66446008)(71200400001)(478600001)(66476007)(66946007)(76116006)(9686003)(4326008)(64756008)(54906003)(8676002)(7696005)(66556008)(55016002)(2906002)(83380400001)(26005)(52536014)(86362001)(186003)(5660300002)(33656002)(53546011)(8936002)(316002)(6506007)(110136005); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: =?Windows-1252?Q?3dvpQ0KO8CnP+yrlO81eZD9qRFW5dXA2APHsq6ZBfmwHjGw6vFnhO4N5?= =?Windows-1252?Q?fpsawvRNwQ4Sj1TlM8WiC3asXHsKd4iZemCU8NhRNZmnkPZPzLVHe9Sv?= =?Windows-1252?Q?UpBzGfe1yUcqNgXaYD8WE49vaaRP/LZZjpa9g5NEnm2RwihiRIEEy4hN?= =?Windows-1252?Q?dH+ULMvq9UAB7+tKBbes9+nNbGBMD3cSiIbQTn5sg2a0WAmY4akO3DNt?= =?Windows-1252?Q?hFDwn4/xnpKhZcmAVJ035JoXALRMJS0/owZdLhb4CK03ZBuVHo2QxdGi?= =?Windows-1252?Q?VfIGcgMRehAdl/r+mPd1yD87Te29LT5hWDfwjF9atrMnVQF5lpKsA1zo?= =?Windows-1252?Q?ydSoLccqQaouI6SFQthNH7lBKeChFPKpqpvwZob77M4AEJemDrSUAZc7?= =?Windows-1252?Q?cbJyjsJh9idPkvUeRljzTv3uH/+dadvd+/hEjY7627xqAaroWZnuEREA?= =?Windows-1252?Q?0C1DTkgBH7l6hjPue+ae07Ux1yT5/umlFcfVEa7DIVT7EQUYHQsf6AfU?= =?Windows-1252?Q?JptYnGulZ4miD06V8hSx/Srvc+U0sYTafGXb1YDKGved8c42aSiLjnVo?= =?Windows-1252?Q?0nkWi8RmYVJ1jUA8CnMfnda+PCCOBfmyHMicRq9iosUkEHsfNsH5X4hU?= =?Windows-1252?Q?9crcjxeEpqFzHtIcT7A4Wx0Q0hsx93ppoW0xlb9Fv1wp7WZxANz0F7bw?= =?Windows-1252?Q?zdQ7a24LT6hbxmxkFSGMgkX745xVYqdatkhZPtj6O4J/UzfZ/1CTq6+/?= =?Windows-1252?Q?+3zAmqIzQTvnj8tAuvXFFJN5GMRWGyCqeB6DHhsyOaTTLlBrlGjm4ee/?= =?Windows-1252?Q?bY+z+yRQo4Be3x1MMwXOgP3/dRWz82J7wLkO35mBDp3y14lUWa8wSziK?= =?Windows-1252?Q?45/+86RDbWG2uVKYAYFDct1bcEi8Tz3fYDPb6tlIuYhmMz1xcTk6L332?= =?Windows-1252?Q?mH0XQwSpk+GrE2dl1V7QttGHsU6nJnSK5Zs7Q7i+ZsCjBd2wDXcBfNhV?= =?Windows-1252?Q?Zwa3M9sVRJgW6JdG+QD2Kr/5x52uPR8b/apYQvpIF7AsgsBwGEgtBjc9?= =?Windows-1252?Q?eb8/AKTJG4dyNxnXtc9DSAjpt/veAKDdcPM2g68L3jfbZIj4EW6UBEuT?= =?Windows-1252?Q?SSuNGhac2aVkQ5T7ky+iHbZtabsnq2ECFPXhQMDnstmEdJwHbEuSRckZ?= =?Windows-1252?Q?DXLM8QcNix6iULDUyEu/fWHQRpY7OIGavJ2jpADzaLK+vdy2AkG+WzGQ?= =?Windows-1252?Q?C/wqTRP1ltZhJBFtVu4at3x+u/gRxlkQ/lDkOAb+ou4hc1s+zhjq7+3n?= =?Windows-1252?Q?VGe6r9SYAp3RyqegBgUCV0tcgBzFiSIIkR9onZehXJEUEtk6/KTAWGwO?= =?Windows-1252?Q?VG1CuPpqQt9wx3uWkOZP/KIqCbOuvfCX5bU=3D?= Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: BN8PR11MB3795.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 311eef60-0d5a-4169-3706-08d8e56a331b X-MS-Exchange-CrossTenant-originalarrivaltime: 12 Mar 2021 15:19:15.8201 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 46c98d88-e344-4ed4-8496-4ed7712e255d X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: itn2BnB4QdlmCY+zSc2LsUFN/Hh0kbAGByxeZaN70FZQKqSGzkEqt5eh3SyILyq7zWBsD4h2HohkH8VgpedCow== X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN6PR1101MB2180 X-OriginatorOrg: intel.com Subject: Re: [dpdk-dev] [PATCH] vhost: add header check in dequeue offload X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" Hi Konstantin, Comments inline. BRs, Xiao > -----Original Message----- > From: Ananyev, Konstantin > Sent: Thursday, March 11, 2021 6:38 PM > To: Wang, Xiao W ; Xia, Chenbo > ; maxime.coquelin@redhat.com > Cc: Liu, Yong ; dev@dpdk.org; Wang, Xiao W > ; stable@dpdk.org > Subject: RE: [dpdk-dev] [PATCH] vhost: add header check in dequeue > offload >=20 >=20 >=20 > > > > When parsing the virtio net header and packet header for dequeue > offload, > > we need to perform sanity check on the packet header to ensure: > > - No out-of-boundary memory access. > > - The packet header and virtio_net header are valid and aligned. > > > > Fixes: d0cf91303d73 ("vhost: add Tx offload capabilities") > > Cc: stable@dpdk.org > > > > Signed-off-by: Xiao Wang > > --- > > lib/librte_vhost/virtio_net.c | 49 > +++++++++++++++++++++++++++++++++++++------ > > 1 file changed, 43 insertions(+), 6 deletions(-) > > > > diff --git a/lib/librte_vhost/virtio_net.c b/lib/librte_vhost/virtio_ne= t.c > > index 583bf379c6..0fba0053a3 100644 > > --- a/lib/librte_vhost/virtio_net.c > > +++ b/lib/librte_vhost/virtio_net.c > > @@ -1821,44 +1821,64 @@ virtio_net_with_host_offload(struct > virtio_net *dev) > > return false; > > } > > > > -static void > > -parse_ethernet(struct rte_mbuf *m, uint16_t *l4_proto, void **l4_hdr) > > +static int > > +parse_ethernet(struct rte_mbuf *m, uint16_t *l4_proto, void **l4_hdr, > > + uint16_t *len) > > { > > struct rte_ipv4_hdr *ipv4_hdr; > > struct rte_ipv6_hdr *ipv6_hdr; > > void *l3_hdr =3D NULL; > > struct rte_ether_hdr *eth_hdr; > > uint16_t ethertype; > > + uint16_t data_len =3D m->data_len; > > > > eth_hdr =3D rte_pktmbuf_mtod(m, struct rte_ether_hdr *); > > > > + if (data_len <=3D sizeof(struct rte_ether_hdr)) > > + return -EINVAL; > > + > > m->l2_len =3D sizeof(struct rte_ether_hdr); > > ethertype =3D rte_be_to_cpu_16(eth_hdr->ether_type); > > + data_len -=3D sizeof(struct rte_ether_hdr); > > > > if (ethertype =3D=3D RTE_ETHER_TYPE_VLAN) { > > + if (data_len <=3D sizeof(struct rte_vlan_hdr)) > > + return -EINVAL; > > + > > struct rte_vlan_hdr *vlan_hdr =3D > > (struct rte_vlan_hdr *)(eth_hdr + 1); > > > > m->l2_len +=3D sizeof(struct rte_vlan_hdr); > > ethertype =3D rte_be_to_cpu_16(vlan_hdr->eth_proto); > > + data_len -=3D sizeof(struct rte_vlan_hdr); > > } > > > > l3_hdr =3D (char *)eth_hdr + m->l2_len; > > > > switch (ethertype) { > > case RTE_ETHER_TYPE_IPV4: > > + if (data_len <=3D sizeof(struct rte_ipv4_hdr)) > > + return -EINVAL; > > ipv4_hdr =3D l3_hdr; > > *l4_proto =3D ipv4_hdr->next_proto_id; > > m->l3_len =3D rte_ipv4_hdr_len(ipv4_hdr); > > + if (data_len <=3D m->l3_len) { > > + m->l3_len =3D 0; > > + return -EINVAL; > > + } > > *l4_hdr =3D (char *)l3_hdr + m->l3_len; > > m->ol_flags |=3D PKT_TX_IPV4; > > + data_len -=3D m->l3_len; > > break; > > case RTE_ETHER_TYPE_IPV6: > > + if (data_len <=3D sizeof(struct rte_ipv6_hdr)) > > + return -EINVAL; > > ipv6_hdr =3D l3_hdr; > > *l4_proto =3D ipv6_hdr->proto; > > m->l3_len =3D sizeof(struct rte_ipv6_hdr); > > *l4_hdr =3D (char *)l3_hdr + m->l3_len; > > m->ol_flags |=3D PKT_TX_IPV6; > > + data_len -=3D m->l3_len; > > break; > > default: > > m->l3_len =3D 0; > > @@ -1866,6 +1886,9 @@ parse_ethernet(struct rte_mbuf *m, uint16_t > *l4_proto, void **l4_hdr) > > *l4_hdr =3D NULL; > > break; > > } > > + > > + *len =3D data_len; > > + return 0; > > } > > > > static __rte_always_inline void > > @@ -1874,24 +1897,30 @@ vhost_dequeue_offload(struct virtio_net_hdr > *hdr, struct rte_mbuf *m) > > uint16_t l4_proto =3D 0; > > void *l4_hdr =3D NULL; > > struct rte_tcp_hdr *tcp_hdr =3D NULL; > > + uint16_t len =3D 0; > > > > if (hdr->flags =3D=3D 0 && hdr->gso_type =3D=3D > VIRTIO_NET_HDR_GSO_NONE) > > return; > > > > - parse_ethernet(m, &l4_proto, &l4_hdr); > > + if (parse_ethernet(m, &l4_proto, &l4_hdr, &len) < 0) > > + return; > > + > > if (hdr->flags =3D=3D VIRTIO_NET_HDR_F_NEEDS_CSUM) { > > if (hdr->csum_start =3D=3D (m->l2_len + m->l3_len)) { > > switch (hdr->csum_offset) { > > case (offsetof(struct rte_tcp_hdr, cksum)): > > - if (l4_proto =3D=3D IPPROTO_TCP) > > + if (l4_proto =3D=3D IPPROTO_TCP && > > + len > sizeof(struct rte_tcp_hdr)) >=20 > Shouldn't it be '>=3D' here? You are right, there're packets with no payload. I just did an experiment w= here I send a tcp packet with only headers from guest using scapy and vhost= side get 54 Bytes (14+20+20), there's no padding. I would fix this issue also for udp and sctp. Thanks for the comment. -Xiao