patches for DPDK stable branches
 help / color / mirror / Atom feed
* [PATCH 1/1] vhost: fix a double fetch when dequeue offloading
@ 2024-12-19  6:38 Yunjian Wang
  2024-12-19  8:24 ` David Marchand
                   ` (3 more replies)
  0 siblings, 4 replies; 10+ messages in thread
From: Yunjian Wang @ 2024-12-19  6:38 UTC (permalink / raw)
  To: dev
  Cc: maxime.coquelin, chenbox, jerry.lilijun, xiawei40, wangzengyuan,
	Yunjian Wang, stable

The hdr->csum_start does two successive reads from user space to read a
variable length data structure. The result overflow if the data structure
changes between the two reads.

To fix this, we can prevent double fetch issue by copying virtio_hdr to
the temporary variable.

Fixes: 4dc4e33ffa10 ("net/virtio: fix Rx checksum calculation")
Cc: stable@dpdk.org

Signed-off-by: Yunjian Wang <wangyunjian@huawei.com>
---
 lib/vhost/virtio_net.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/lib/vhost/virtio_net.c b/lib/vhost/virtio_net.c
index 69901ab3b5..5c40ae7069 100644
--- a/lib/vhost/virtio_net.c
+++ b/lib/vhost/virtio_net.c
@@ -2914,10 +2914,12 @@ desc_to_mbuf(struct virtio_net *dev, struct vhost_virtqueue *vq,
 			 * in a contiguous virtual area.
 			 */
 			copy_vnet_hdr_from_desc(&tmp_hdr, buf_vec);
-			hdr = &tmp_hdr;
 		} else {
-			hdr = (struct virtio_net_hdr *)((uintptr_t)buf_vec[0].buf_addr);
+			rte_memcpy((void *)(uintptr_t)&tmp_hdr,
+				(void *)(uintptr_t)buf_vec[0].buf_addr,
+				sizeof(struct virtio_net_hdr));
 		}
+		hdr = &tmp_hdr;
 	}
 
 	for (vec_idx = 0; vec_idx < nr_vec; vec_idx++) {
@@ -3363,7 +3365,7 @@ virtio_dev_tx_batch_packed(struct virtio_net *dev,
 {
 	uint16_t avail_idx = vq->last_avail_idx;
 	uint32_t buf_offset = sizeof(struct virtio_net_hdr_mrg_rxbuf);
-	struct virtio_net_hdr *hdr;
+	struct virtio_net_hdr hdr;
 	uintptr_t desc_addrs[PACKED_BATCH_SIZE];
 	uint16_t ids[PACKED_BATCH_SIZE];
 	uint16_t i;
@@ -3382,8 +3384,9 @@ virtio_dev_tx_batch_packed(struct virtio_net *dev,
 
 	if (virtio_net_with_host_offload(dev)) {
 		vhost_for_each_try_unroll(i, 0, PACKED_BATCH_SIZE) {
-			hdr = (struct virtio_net_hdr *)(desc_addrs[i]);
-			vhost_dequeue_offload(dev, hdr, pkts[i], legacy_ol_flags);
+			rte_memcpy((void *)(uintptr_t)&hdr,
+				(void *)(uintptr_t)desc_addrs[i], sizeof(struct virtio_net_hdr));
+			vhost_dequeue_offload(dev, &hdr, pkts[i], legacy_ol_flags);
 		}
 	}
 
-- 
2.33.0


^ permalink raw reply	[flat|nested] 10+ messages in thread

end of thread, other threads:[~2024-12-23  2:45 UTC | newest]

Thread overview: 10+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-12-19  6:38 [PATCH 1/1] vhost: fix a double fetch when dequeue offloading Yunjian Wang
2024-12-19  8:24 ` David Marchand
2024-12-19 11:02   ` Wangyunjian(wangyunjian,TongTu)
2024-12-19 16:15 ` Stephen Hemminger
2024-12-20  2:17   ` Wangyunjian(wangyunjian,TongTu)
2024-12-20  4:59     ` Stephen Hemminger
2024-12-20  3:49 ` [PATCH v2 " Yunjian Wang
2024-12-20 17:10   ` Stephen Hemminger
2024-12-20 16:35 ` [PATCH " Stephen Hemminger
2024-12-23  2:45   ` Wangyunjian(wangyunjian,TongTu)

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).