From: "Ananyev, Konstantin" <konstantin.ananyev@intel.com> To: "Wang, Xiao W" <xiao.w.wang@intel.com>, "Xia, Chenbo" <chenbo.xia@intel.com>, "maxime.coquelin@redhat.com" <maxime.coquelin@redhat.com> Cc: "Liu, Yong" <yong.liu@intel.com>, "dev@dpdk.org" <dev@dpdk.org>, "Wang, Xiao W" <xiao.w.wang@intel.com>, "stable@dpdk.org" <stable@dpdk.org> Subject: Re: [dpdk-stable] [dpdk-dev] [PATCH] vhost: add header check in dequeue offload Date: Thu, 11 Mar 2021 10:38:26 +0000 Message-ID: <DM6PR11MB449184C89B13FDB1921B7E9C9A909@DM6PR11MB4491.namprd11.prod.outlook.com> (raw) In-Reply-To: <20210311063827.55394-1-xiao.w.wang@intel.com> > > When parsing the virtio net header and packet header for dequeue offload, > we need to perform sanity check on the packet header to ensure: > - No out-of-boundary memory access. > - The packet header and virtio_net header are valid and aligned. > > Fixes: d0cf91303d73 ("vhost: add Tx offload capabilities") > Cc: stable@dpdk.org > > Signed-off-by: Xiao Wang <xiao.w.wang@intel.com> > --- > lib/librte_vhost/virtio_net.c | 49 +++++++++++++++++++++++++++++++++++++------ > 1 file changed, 43 insertions(+), 6 deletions(-) > > diff --git a/lib/librte_vhost/virtio_net.c b/lib/librte_vhost/virtio_net.c > index 583bf379c6..0fba0053a3 100644 > --- a/lib/librte_vhost/virtio_net.c > +++ b/lib/librte_vhost/virtio_net.c > @@ -1821,44 +1821,64 @@ virtio_net_with_host_offload(struct virtio_net *dev) > return false; > } > > -static void > -parse_ethernet(struct rte_mbuf *m, uint16_t *l4_proto, void **l4_hdr) > +static int > +parse_ethernet(struct rte_mbuf *m, uint16_t *l4_proto, void **l4_hdr, > + uint16_t *len) > { > struct rte_ipv4_hdr *ipv4_hdr; > struct rte_ipv6_hdr *ipv6_hdr; > void *l3_hdr = NULL; > struct rte_ether_hdr *eth_hdr; > uint16_t ethertype; > + uint16_t data_len = m->data_len; > > eth_hdr = rte_pktmbuf_mtod(m, struct rte_ether_hdr *); > > + if (data_len <= sizeof(struct rte_ether_hdr)) > + return -EINVAL; > + > m->l2_len = sizeof(struct rte_ether_hdr); > ethertype = rte_be_to_cpu_16(eth_hdr->ether_type); > + data_len -= sizeof(struct rte_ether_hdr); > > if (ethertype == RTE_ETHER_TYPE_VLAN) { > + if (data_len <= sizeof(struct rte_vlan_hdr)) > + return -EINVAL; > + > struct rte_vlan_hdr *vlan_hdr = > (struct rte_vlan_hdr *)(eth_hdr + 1); > > m->l2_len += sizeof(struct rte_vlan_hdr); > ethertype = rte_be_to_cpu_16(vlan_hdr->eth_proto); > + data_len -= sizeof(struct rte_vlan_hdr); > } > > l3_hdr = (char *)eth_hdr + m->l2_len; > > switch (ethertype) { > case RTE_ETHER_TYPE_IPV4: > + if (data_len <= sizeof(struct rte_ipv4_hdr)) > + return -EINVAL; > ipv4_hdr = l3_hdr; > *l4_proto = ipv4_hdr->next_proto_id; > m->l3_len = rte_ipv4_hdr_len(ipv4_hdr); > + if (data_len <= m->l3_len) { > + m->l3_len = 0; > + return -EINVAL; > + } > *l4_hdr = (char *)l3_hdr + m->l3_len; > m->ol_flags |= PKT_TX_IPV4; > + data_len -= m->l3_len; > break; > case RTE_ETHER_TYPE_IPV6: > + if (data_len <= sizeof(struct rte_ipv6_hdr)) > + return -EINVAL; > ipv6_hdr = l3_hdr; > *l4_proto = ipv6_hdr->proto; > m->l3_len = sizeof(struct rte_ipv6_hdr); > *l4_hdr = (char *)l3_hdr + m->l3_len; > m->ol_flags |= PKT_TX_IPV6; > + data_len -= m->l3_len; > break; > default: > m->l3_len = 0; > @@ -1866,6 +1886,9 @@ parse_ethernet(struct rte_mbuf *m, uint16_t *l4_proto, void **l4_hdr) > *l4_hdr = NULL; > break; > } > + > + *len = data_len; > + return 0; > } > > static __rte_always_inline void > @@ -1874,24 +1897,30 @@ vhost_dequeue_offload(struct virtio_net_hdr *hdr, struct rte_mbuf *m) > uint16_t l4_proto = 0; > void *l4_hdr = NULL; > struct rte_tcp_hdr *tcp_hdr = NULL; > + uint16_t len = 0; > > if (hdr->flags == 0 && hdr->gso_type == VIRTIO_NET_HDR_GSO_NONE) > return; > > - parse_ethernet(m, &l4_proto, &l4_hdr); > + if (parse_ethernet(m, &l4_proto, &l4_hdr, &len) < 0) > + return; > + > if (hdr->flags == VIRTIO_NET_HDR_F_NEEDS_CSUM) { > if (hdr->csum_start == (m->l2_len + m->l3_len)) { > switch (hdr->csum_offset) { > case (offsetof(struct rte_tcp_hdr, cksum)): > - if (l4_proto == IPPROTO_TCP) > + if (l4_proto == IPPROTO_TCP && > + len > sizeof(struct rte_tcp_hdr)) Shouldn't it be '>=' here? > m->ol_flags |= PKT_TX_TCP_CKSUM; > break; > case (offsetof(struct rte_udp_hdr, dgram_cksum)): > - if (l4_proto == IPPROTO_UDP) > + if (l4_proto == IPPROTO_UDP && > + len > sizeof(struct rte_udp_hdr)) > m->ol_flags |= PKT_TX_UDP_CKSUM; > break; > case (offsetof(struct rte_sctp_hdr, cksum)): > - if (l4_proto == IPPROTO_SCTP) > + if (l4_proto == IPPROTO_SCTP && > + len > sizeof(struct rte_sctp_hdr)) > m->ol_flags |= PKT_TX_SCTP_CKSUM; > break; > default: > @@ -1904,12 +1933,20 @@ vhost_dequeue_offload(struct virtio_net_hdr *hdr, struct rte_mbuf *m) > switch (hdr->gso_type & ~VIRTIO_NET_HDR_GSO_ECN) { > case VIRTIO_NET_HDR_GSO_TCPV4: > case VIRTIO_NET_HDR_GSO_TCPV6: > + if (l4_proto != IPPROTO_TCP || > + len <= sizeof(struct rte_tcp_hdr)) > + break; > tcp_hdr = l4_hdr; > + if (len <= (tcp_hdr->data_off & 0xf0) >> 2) > + break; > m->ol_flags |= PKT_TX_TCP_SEG; > m->tso_segsz = hdr->gso_size; > m->l4_len = (tcp_hdr->data_off & 0xf0) >> 2; > break; > case VIRTIO_NET_HDR_GSO_UDP: > + if (l4_proto != IPPROTO_UDP || > + len <= sizeof(struct rte_udp_hdr)) > + break; > m->ol_flags |= PKT_TX_UDP_SEG; > m->tso_segsz = hdr->gso_size; > m->l4_len = sizeof(struct rte_udp_hdr); > -- > 2.15.1
next prev parent reply other threads:[~2021-03-11 10:38 UTC|newest] Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top 2021-03-11 6:38 [dpdk-stable] " Xiao Wang 2021-03-11 10:38 ` Ananyev, Konstantin [this message] 2021-03-12 15:19 ` [dpdk-stable] [dpdk-dev] " Wang, Xiao W 2021-03-15 15:32 ` [dpdk-stable] [PATCH v2] " Xiao Wang 2021-03-15 16:17 ` David Marchand 2021-03-15 18:53 ` Ananyev, Konstantin 2021-03-16 9:13 ` Wang, Xiao W 2021-03-17 6:31 ` [dpdk-stable] [PATCH v3] " Xiao Wang 2021-04-01 12:04 ` David Marchand 2021-04-02 8:38 ` Wang, Xiao W 2021-04-12 9:08 ` Wang, Xiao W 2021-04-12 9:33 ` David Marchand 2021-04-13 14:30 ` Maxime Coquelin 2021-05-08 5:54 ` Wang, Xiao W 2021-06-15 6:35 ` [dpdk-stable] [PATCH v4] vhost: check header for legacy " Xiao Wang 2021-06-15 7:57 ` [dpdk-stable] [dpdk-dev] " David Marchand 2021-06-16 14:33 ` Wang, Xiao W 2021-06-21 8:21 ` [dpdk-stable] [PATCH v5] " Xiao Wang 2021-07-13 9:34 ` Maxime Coquelin 2021-07-20 2:43 ` Xia, Chenbo
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=DM6PR11MB449184C89B13FDB1921B7E9C9A909@DM6PR11MB4491.namprd11.prod.outlook.com \ --to=konstantin.ananyev@intel.com \ --cc=chenbo.xia@intel.com \ --cc=dev@dpdk.org \ --cc=maxime.coquelin@redhat.com \ --cc=stable@dpdk.org \ --cc=xiao.w.wang@intel.com \ --cc=yong.liu@intel.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
patches for DPDK stable branches This inbox may be cloned and mirrored by anyone: git clone --mirror https://inbox.dpdk.org/stable/0 stable/git/0.git # If you have public-inbox 1.1+ installed, you may # initialize and index your mirror using the following commands: public-inbox-init -V2 stable stable/ https://inbox.dpdk.org/stable \ stable@dpdk.org public-inbox-index stable Example config snippet for mirrors. Newsgroup available over NNTP: nntp://inbox.dpdk.org/inbox.dpdk.stable AGPL code for this site: git clone https://public-inbox.org/public-inbox.git