* [dpdk-stable] [PATCH 19.11] vhost: check header for legacy dequeue offload
@ 2021-08-13 13:58 Xiao Wang
0 siblings, 0 replies; only message in thread
From: Xiao Wang @ 2021-08-13 13:58 UTC (permalink / raw)
To: stable; +Cc: christian.ehrhardt, Xiao Wang
[ upstream commit 706ba48665844b859fcf0bd9526ec5da28b915da ]
When parsing the virtio net header and packet header for dequeue offload,
we need to perform sanity check on the packet header to ensure:
- No out-of-boundary memory access.
- The packet header and virtio_net header are valid and aligned.
Fixes: d0cf91303d73 ("vhost: add Tx offload capabilities")
Signed-off-by: Xiao Wang <xiao.w.wang@intel.com>
Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com>
---
lib/librte_vhost/virtio_net.c | 117 ++++++++++++++++++++++++++++++++----------
1 file changed, 89 insertions(+), 28 deletions(-)
diff --git a/lib/librte_vhost/virtio_net.c b/lib/librte_vhost/virtio_net.c
index 62b7bbda96..be3ded2500 100644
--- a/lib/librte_vhost/virtio_net.c
+++ b/lib/librte_vhost/virtio_net.c
@@ -1258,14 +1258,17 @@ virtio_net_with_host_offload(struct virtio_net *dev)
return false;
}
-static void
-parse_ethernet(struct rte_mbuf *m, uint16_t *l4_proto, void **l4_hdr)
+static int
+parse_headers(struct rte_mbuf *m, uint8_t *l4_proto)
{
struct rte_ipv4_hdr *ipv4_hdr;
struct rte_ipv6_hdr *ipv6_hdr;
- void *l3_hdr = NULL;
struct rte_ether_hdr *eth_hdr;
uint16_t ethertype;
+ uint16_t data_len = rte_pktmbuf_data_len(m);
+
+ if (data_len < sizeof(struct rte_ether_hdr))
+ return -EINVAL;
eth_hdr = rte_pktmbuf_mtod(m, struct rte_ether_hdr *);
@@ -1273,6 +1276,10 @@ parse_ethernet(struct rte_mbuf *m, uint16_t *l4_proto, void **l4_hdr)
ethertype = rte_be_to_cpu_16(eth_hdr->ether_type);
if (ethertype == RTE_ETHER_TYPE_VLAN) {
+ if (data_len < sizeof(struct rte_ether_hdr) +
+ sizeof(struct rte_vlan_hdr))
+ goto error;
+
struct rte_vlan_hdr *vlan_hdr =
(struct rte_vlan_hdr *)(eth_hdr + 1);
@@ -1280,73 +1287,121 @@ parse_ethernet(struct rte_mbuf *m, uint16_t *l4_proto, void **l4_hdr)
ethertype = rte_be_to_cpu_16(vlan_hdr->eth_proto);
}
- l3_hdr = (char *)eth_hdr + m->l2_len;
-
switch (ethertype) {
case RTE_ETHER_TYPE_IPV4:
- ipv4_hdr = l3_hdr;
- *l4_proto = ipv4_hdr->next_proto_id;
+ if (data_len < m->l2_len + sizeof(struct rte_ipv4_hdr))
+ goto error;
+ ipv4_hdr = rte_pktmbuf_mtod_offset(m, struct rte_ipv4_hdr *,
+ m->l2_len);
m->l3_len = (ipv4_hdr->version_ihl & 0x0f) * 4;
- *l4_hdr = (char *)l3_hdr + m->l3_len;
+ if (data_len < m->l2_len + m->l3_len)
+ goto error;
m->ol_flags |= PKT_TX_IPV4;
+ *l4_proto = ipv4_hdr->next_proto_id;
break;
case RTE_ETHER_TYPE_IPV6:
- ipv6_hdr = l3_hdr;
- *l4_proto = ipv6_hdr->proto;
+ if (data_len < m->l2_len + sizeof(struct rte_ipv6_hdr))
+ goto error;
+ ipv6_hdr = rte_pktmbuf_mtod_offset(m, struct rte_ipv6_hdr *,
+ m->l2_len);
m->l3_len = sizeof(struct rte_ipv6_hdr);
- *l4_hdr = (char *)l3_hdr + m->l3_len;
m->ol_flags |= PKT_TX_IPV6;
+ *l4_proto = ipv6_hdr->proto;
break;
default:
- m->l3_len = 0;
- *l4_proto = 0;
- *l4_hdr = NULL;
+ /* a valid L3 header is needed for further L4 parsing */
+ goto error;
+ }
+
+ /* both CSUM and GSO need a valid L4 header */
+ switch (*l4_proto) {
+ case IPPROTO_TCP:
+ if (data_len < m->l2_len + m->l3_len +
+ sizeof(struct rte_tcp_hdr))
+ goto error;
+ break;
+ case IPPROTO_UDP:
+ if (data_len < m->l2_len + m->l3_len +
+ sizeof(struct rte_udp_hdr))
+ goto error;
break;
+ case IPPROTO_SCTP:
+ if (data_len < m->l2_len + m->l3_len +
+ sizeof(struct rte_sctp_hdr))
+ goto error;
+ break;
+ default:
+ goto error;
}
+
+ return 0;
+
+error:
+ m->l2_len = 0;
+ m->l3_len = 0;
+ m->ol_flags = 0;
+ return -EINVAL;
}
static __rte_always_inline void
vhost_dequeue_offload(struct virtio_net_hdr *hdr, struct rte_mbuf *m)
{
- uint16_t l4_proto = 0;
- void *l4_hdr = NULL;
+ uint8_t l4_proto = 0;
struct rte_tcp_hdr *tcp_hdr = NULL;
+ uint16_t tcp_len;
+ uint16_t data_len = rte_pktmbuf_data_len(m);
if (hdr->flags == 0 && hdr->gso_type == VIRTIO_NET_HDR_GSO_NONE)
return;
- parse_ethernet(m, &l4_proto, &l4_hdr);
+ if (parse_headers(m, &l4_proto) < 0)
+ return;
+
if (hdr->flags == VIRTIO_NET_HDR_F_NEEDS_CSUM) {
if (hdr->csum_start == (m->l2_len + m->l3_len)) {
switch (hdr->csum_offset) {
case (offsetof(struct rte_tcp_hdr, cksum)):
- if (l4_proto == IPPROTO_TCP)
- m->ol_flags |= PKT_TX_TCP_CKSUM;
+ if (l4_proto != IPPROTO_TCP)
+ goto error;
+ m->ol_flags |= PKT_TX_TCP_CKSUM;
break;
case (offsetof(struct rte_udp_hdr, dgram_cksum)):
- if (l4_proto == IPPROTO_UDP)
- m->ol_flags |= PKT_TX_UDP_CKSUM;
+ if (l4_proto != IPPROTO_UDP)
+ goto error;
+ m->ol_flags |= PKT_TX_UDP_CKSUM;
break;
case (offsetof(struct rte_sctp_hdr, cksum)):
- if (l4_proto == IPPROTO_SCTP)
- m->ol_flags |= PKT_TX_SCTP_CKSUM;
+ if (l4_proto != IPPROTO_SCTP)
+ goto error;
+ m->ol_flags |= PKT_TX_SCTP_CKSUM;
break;
default:
- break;
+ goto error;
}
+ } else {
+ goto error;
}
}
- if (l4_hdr && hdr->gso_type != VIRTIO_NET_HDR_GSO_NONE) {
+ if (hdr->gso_type != VIRTIO_NET_HDR_GSO_NONE) {
switch (hdr->gso_type & ~VIRTIO_NET_HDR_GSO_ECN) {
case VIRTIO_NET_HDR_GSO_TCPV4:
case VIRTIO_NET_HDR_GSO_TCPV6:
- tcp_hdr = l4_hdr;
+ if (l4_proto != IPPROTO_TCP)
+ goto error;
+ tcp_hdr = rte_pktmbuf_mtod_offset(m,
+ struct rte_tcp_hdr *,
+ m->l2_len + m->l3_len);
+ tcp_len = (tcp_hdr->data_off & 0xf0) >> 2;
+ if (data_len < m->l2_len + m->l3_len + tcp_len)
+ goto error;
m->ol_flags |= PKT_TX_TCP_SEG;
m->tso_segsz = hdr->gso_size;
- m->l4_len = (tcp_hdr->data_off & 0xf0) >> 2;
+ m->l4_len = tcp_len;
break;
case VIRTIO_NET_HDR_GSO_UDP:
+ if (l4_proto != IPPROTO_UDP)
+ goto error;
m->ol_flags |= PKT_TX_UDP_SEG;
m->tso_segsz = hdr->gso_size;
m->l4_len = sizeof(struct rte_udp_hdr);
@@ -1354,9 +1409,15 @@ vhost_dequeue_offload(struct virtio_net_hdr *hdr, struct rte_mbuf *m)
default:
RTE_LOG(WARNING, VHOST_DATA,
"unsupported gso type %u.\n", hdr->gso_type);
- break;
+ goto error;
}
}
+ return;
+
+error:
+ m->l2_len = 0;
+ m->l3_len = 0;
+ m->ol_flags = 0;
}
static __rte_noinline void
--
2.15.1
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2021-08-13 5:56 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-08-13 13:58 [dpdk-stable] [PATCH 19.11] vhost: check header for legacy dequeue offload Xiao Wang
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).