From mboxrd@z Thu Jan 1 00:00:00 1970
Return-Path: <stable-bounces@dpdk.org>
Received: from dpdk.org (dpdk.org [92.243.14.124])
by inbox.dpdk.org (Postfix) with ESMTP id A2283A04C5
for <public@inbox.dpdk.org>; Thu, 14 Nov 2019 16:16:12 +0100 (CET)
Received: from [92.243.14.124] (localhost [127.0.0.1])
by dpdk.org (Postfix) with ESMTP id 6D1362AB;
Thu, 14 Nov 2019 16:16:12 +0100 (CET)
Received: from us-smtp-1.mimecast.com (us-smtp-delivery-1.mimecast.com
[205.139.110.120]) by dpdk.org (Postfix) with ESMTP id B22B42AB
for <stable@dpdk.org>; Thu, 14 Nov 2019 16:16:11 +0100 (CET)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com;
s=mimecast20190719; t=1573744571;
h=from:from:reply-to:subject:subject:date:date:message-id:message-id:
to:to:cc:cc:mime-version:mime-version:content-type:content-type:
content-transfer-encoding:content-transfer-encoding;
bh=dwL0ij3AZuOkRPc34w5eyRh3tM4lnRvbFTY4e8/NLrQ=;
b=GZX2Vw87w8+cICRJzu+d0DCQMtEy+ppDBJxQ9YGTCKGBPguMkZn5LIOnwhRxD0LSYMMhai
sLrgYA2r3x2jJdSEPP52bTayQEEfReeeF7QkNMsWczUQOZJ/wjHMw5k1QrdHXX5MB0hX7T
SgP9ViD7692sCe2BFwhwdzyZodxcdtc=
Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com
[209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id
us-mta-200-l1z4mx3vMeu-b5qeEqWmiQ-1; Thu, 14 Nov 2019 10:16:08 -0500
Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.phx2.redhat.com
[10.5.11.14])
(using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
(No client certificate requested)
by mimecast-mx01.redhat.com (Postfix) with ESMTPS id D4780F65A0;
Thu, 14 Nov 2019 15:16:06 +0000 (UTC)
Received: from localhost.localdomain (ovpn-112-32.ams2.redhat.com
[10.36.112.32])
by smtp.corp.redhat.com (Postfix) with ESMTP id 5F6335DF3A;
Thu, 14 Nov 2019 15:16:05 +0000 (UTC)
From: Maxime Coquelin <maxime.coquelin@redhat.com>
To: stable@dpdk.org,
tiwei.bie@intel.com
Cc: Zhike Wang <wangzk320@163.com>,
Maxime Coquelin <maxime.coquelin@redhat.com>
Date: Thu, 14 Nov 2019 16:16:01 +0100
Message-Id: <20191114151601.27308-1-maxime.coquelin@redhat.com>
MIME-Version: 1.0
X-Scanned-By: MIMEDefang 2.79 on 10.5.11.14
X-MC-Unique: l1z4mx3vMeu-b5qeEqWmiQ-1
X-Mimecast-Spam-Score: 0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: quoted-printable
Subject: [dpdk-stable] [16.11 LTS PATCH] vhost: fix vring requests
validation broken if no FD
X-BeenThere: stable@dpdk.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: patches for DPDK stable branches <stable.dpdk.org>
List-Unsubscribe: <https://mails.dpdk.org/options/stable>,
<mailto:stable-request@dpdk.org?subject=unsubscribe>
List-Archive: <http://mails.dpdk.org/archives/stable/>
List-Post: <mailto:stable@dpdk.org>
List-Help: <mailto:stable-request@dpdk.org?subject=help>
List-Subscribe: <https://mails.dpdk.org/listinfo/stable>,
<mailto:stable-request@dpdk.org?subject=subscribe>
Errors-To: stable-bounces@dpdk.org
Sender: "stable" <stable-bounces@dpdk.org>
From: Zhike Wang <wangzk320@163.com>
When VHOST_USER_VRING_NOFD_MASK is set, the fd_num is 0,
so validate_msg_fds() will return error. In this case,
the negotiation of vring message between vhost user front end and
back end would fail, and as a result, vhost user link could NOT be up.
How to reproduce:
1.Run dpdk testpmd insides VM, which locates at host with ovs+dpdk.
2.Notice that inside ovs there are endless logs regarding failure to
handle VHOST_USER_SET_VRING_CALL, and link of vm could NOT be up.
Fixes: 1bf11cfb7c7c ("vhost: fix possible denial of service by leaking FDs"=
)
Cc: stable@dpdk.org
Signed-off-by: Zhike Wang <wangzk320@163.com>
Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com>
---
Backport not tested yet.
lib/librte_vhost/vhost_user.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/lib/librte_vhost/vhost_user.c b/lib/librte_vhost/vhost_user.c
index a6ab131543..5aeb0c1691 100644
--- a/lib/librte_vhost/vhost_user.c
+++ b/lib/librte_vhost/vhost_user.c
@@ -1078,6 +1078,7 @@ vhost_user_msg_handler(int vid, int fd)
=09struct VhostUserMsg msg;
=09int ret;
=09int unlock_required =3D 0;
+=09int expected_fds;
=20
=09dev =3D get_device(vid);
=09if (dev =3D=3D NULL)
@@ -1236,12 +1237,16 @@ vhost_user_msg_handler(int vid, int fd)
=09=09break;
=20
=09case VHOST_USER_SET_VRING_KICK:
-=09=09if (validate_msg_fds(&msg, 1) !=3D 0)
+=09=09expected_fds =3D
+=09=09=09(msg.payload.u64 & VHOST_USER_VRING_NOFD_MASK) ? 0 : 1;
+=09=09if (validate_msg_fds(&msg, expected_fds) !=3D 0)
=09=09=09return -1;
=20
=09=09ret =3D vhost_user_set_vring_kick(dev, &msg);
=09=09break;
=09case VHOST_USER_SET_VRING_CALL:
+=09=09expected_fds =3D
+=09=09=09(msg.payload.u64 & VHOST_USER_VRING_NOFD_MASK) ? 0 : 1;
=09=09if (validate_msg_fds(&msg, 1) !=3D 0)
=09=09=09return -1;
=20
@@ -1249,6 +1254,8 @@ vhost_user_msg_handler(int vid, int fd)
=09=09break;
=20
=09case VHOST_USER_SET_VRING_ERR:
+=09=09expected_fds =3D
+=09=09=09(msg.payload.u64 & VHOST_USER_VRING_NOFD_MASK) ? 0 : 1;
=09=09if (validate_msg_fds(&msg, 1) !=3D 0)
=09=09=09return -1;
=20
--=20
2.21.0