* [dpdk-stable] [PATCH 4/6] vhost: fix possible out of bound access in vector filling
[not found] <20190104040642.27463-1-tiwei.bie@intel.com>
@ 2019-01-04 4:06 ` Tiwei Bie
2019-01-04 8:46 ` Maxime Coquelin
2019-01-04 4:06 ` [dpdk-stable] [PATCH 5/6] vhost: fix possible dead loop " Tiwei Bie
2019-01-04 4:06 ` [dpdk-stable] [PATCH 6/6] vhost: ensure event idx is mapped when negotiated Tiwei Bie
2 siblings, 1 reply; 6+ messages in thread
From: Tiwei Bie @ 2019-01-04 4:06 UTC (permalink / raw)
To: maxime.coquelin, zhihong.wang, dev; +Cc: stable
Fixes: 7f74b95c444f ("vhost: pre update used ring for Tx and Rx")
Cc: stable@dpdk.org
Signed-off-by: Tiwei Bie <tiwei.bie@intel.com>
---
lib/librte_vhost/virtio_net.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/lib/librte_vhost/virtio_net.c b/lib/librte_vhost/virtio_net.c
index 474acf64d..d64c355b9 100644
--- a/lib/librte_vhost/virtio_net.c
+++ b/lib/librte_vhost/virtio_net.c
@@ -312,6 +312,9 @@ fill_vec_buf_split(struct virtio_net *dev, struct vhost_virtqueue *vq,
struct vring_desc *descs = vq->desc;
struct vring_desc *idesc = NULL;
+ if (unlikely(idx >= vq->size))
+ return -1;
+
*desc_chain_head = idx;
if (vq->desc[idx].flags & VRING_DESC_F_INDIRECT) {
--
2.17.1
^ permalink raw reply [flat|nested] 6+ messages in thread* [dpdk-stable] [PATCH 5/6] vhost: fix possible dead loop in vector filling
[not found] <20190104040642.27463-1-tiwei.bie@intel.com>
2019-01-04 4:06 ` [dpdk-stable] [PATCH 4/6] vhost: fix possible out of bound access in vector filling Tiwei Bie
@ 2019-01-04 4:06 ` Tiwei Bie
2019-01-04 8:46 ` Maxime Coquelin
2019-01-04 4:06 ` [dpdk-stable] [PATCH 6/6] vhost: ensure event idx is mapped when negotiated Tiwei Bie
2 siblings, 1 reply; 6+ messages in thread
From: Tiwei Bie @ 2019-01-04 4:06 UTC (permalink / raw)
To: maxime.coquelin, zhihong.wang, dev; +Cc: stable
Fix a possible dead loop which may happen, e.g. when driver
created a loop in the desc list and lens in descs are zero.
Fixes: fd68b4739d2c ("vhost: use buffer vectors in dequeue path")
Fixes: 2f3225a7d69b ("vhost: add vector filling support for packed ring")
Cc: stable@dpdk.org
Signed-off-by: Tiwei Bie <tiwei.bie@intel.com>
---
lib/librte_vhost/virtio_net.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/lib/librte_vhost/virtio_net.c b/lib/librte_vhost/virtio_net.c
index d64c355b9..0893a1d04 100644
--- a/lib/librte_vhost/virtio_net.c
+++ b/lib/librte_vhost/virtio_net.c
@@ -309,6 +309,7 @@ fill_vec_buf_split(struct virtio_net *dev, struct vhost_virtqueue *vq,
uint16_t vec_id = *vec_idx;
uint32_t len = 0;
uint64_t dlen;
+ uint32_t nr_descs = vq->size;
struct vring_desc *descs = vq->desc;
struct vring_desc *idesc = NULL;
@@ -319,6 +320,10 @@ fill_vec_buf_split(struct virtio_net *dev, struct vhost_virtqueue *vq,
if (vq->desc[idx].flags & VRING_DESC_F_INDIRECT) {
dlen = vq->desc[idx].len;
+ nr_descs = dlen / sizeof(struct vring_desc);
+ if (unlikely(nr_descs > vq->size))
+ return -1;
+
descs = (struct vring_desc *)(uintptr_t)
vhost_iova_to_vva(dev, vq, vq->desc[idx].addr,
&dlen,
@@ -348,6 +353,11 @@ fill_vec_buf_split(struct virtio_net *dev, struct vhost_virtqueue *vq,
return -1;
}
+ if (unlikely(nr_descs-- == 0)) {
+ free_ind_table(idesc);
+ return -1;
+ }
+
len += descs[idx].len;
if (unlikely(map_one_desc(dev, vq, buf_vec, &vec_id,
@@ -510,6 +520,9 @@ fill_vec_buf_packed(struct virtio_net *dev, struct vhost_virtqueue *vq,
if (unlikely(vec_id >= BUF_VECTOR_MAX))
return -1;
+ if (unlikely(*desc_count >= vq->size))
+ return -1;
+
*desc_count += 1;
*buf_id = descs[avail_idx].id;
--
2.17.1
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [dpdk-stable] [PATCH 5/6] vhost: fix possible dead loop in vector filling
2019-01-04 4:06 ` [dpdk-stable] [PATCH 5/6] vhost: fix possible dead loop " Tiwei Bie
@ 2019-01-04 8:46 ` Maxime Coquelin
0 siblings, 0 replies; 6+ messages in thread
From: Maxime Coquelin @ 2019-01-04 8:46 UTC (permalink / raw)
To: Tiwei Bie, zhihong.wang, dev; +Cc: stable
On 1/4/19 5:06 AM, Tiwei Bie wrote:
> Fix a possible dead loop which may happen, e.g. when driver
> created a loop in the desc list and lens in descs are zero.
>
> Fixes: fd68b4739d2c ("vhost: use buffer vectors in dequeue path")
> Fixes: 2f3225a7d69b ("vhost: add vector filling support for packed ring")
> Cc: stable@dpdk.org
>
> Signed-off-by: Tiwei Bie <tiwei.bie@intel.com>
> ---
> lib/librte_vhost/virtio_net.c | 13 +++++++++++++
> 1 file changed, 13 insertions(+)
>
Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com>
Thanks,
Maxime
^ permalink raw reply [flat|nested] 6+ messages in thread
* [dpdk-stable] [PATCH 6/6] vhost: ensure event idx is mapped when negotiated
[not found] <20190104040642.27463-1-tiwei.bie@intel.com>
2019-01-04 4:06 ` [dpdk-stable] [PATCH 4/6] vhost: fix possible out of bound access in vector filling Tiwei Bie
2019-01-04 4:06 ` [dpdk-stable] [PATCH 5/6] vhost: fix possible dead loop " Tiwei Bie
@ 2019-01-04 4:06 ` Tiwei Bie
2019-01-04 8:47 ` Maxime Coquelin
2 siblings, 1 reply; 6+ messages in thread
From: Tiwei Bie @ 2019-01-04 4:06 UTC (permalink / raw)
To: maxime.coquelin, zhihong.wang, dev; +Cc: stable
Fixes: 30920b1e2b15 ("vhost: ensure all range is mapped when translating QVAs")
Cc: stable@dpdk.org
Signed-off-by: Tiwei Bie <tiwei.bie@intel.com>
---
lib/librte_vhost/vhost_user.c | 15 +++++++++------
1 file changed, 9 insertions(+), 6 deletions(-)
diff --git a/lib/librte_vhost/vhost_user.c b/lib/librte_vhost/vhost_user.c
index 8fec773d5..1843e032f 100644
--- a/lib/librte_vhost/vhost_user.c
+++ b/lib/librte_vhost/vhost_user.c
@@ -541,7 +541,7 @@ translate_ring_addresses(struct virtio_net *dev, int vq_index)
{
struct vhost_virtqueue *vq = dev->virtqueue[vq_index];
struct vhost_vring_addr *addr = &vq->ring_addrs;
- uint64_t len;
+ uint64_t len, expected_len;
if (vq_is_packed(dev)) {
len = sizeof(struct vring_packed_desc) * vq->size;
@@ -607,11 +607,12 @@ translate_ring_addresses(struct virtio_net *dev, int vq_index)
addr = &vq->ring_addrs;
len = sizeof(struct vring_avail) + sizeof(uint16_t) * vq->size;
+ if (dev->features & (1ULL << VIRTIO_RING_F_EVENT_IDX))
+ len += sizeof(uint16_t);
+ expected_len = len;
vq->avail = (struct vring_avail *)(uintptr_t)ring_addr_to_vva(dev,
vq, addr->avail_user_addr, &len);
- if (vq->avail == 0 ||
- len != sizeof(struct vring_avail) +
- sizeof(uint16_t) * vq->size) {
+ if (vq->avail == 0 || len != expected_len) {
RTE_LOG(DEBUG, VHOST_CONFIG,
"(%d) failed to map avail ring.\n",
dev->vid);
@@ -620,10 +621,12 @@ translate_ring_addresses(struct virtio_net *dev, int vq_index)
len = sizeof(struct vring_used) +
sizeof(struct vring_used_elem) * vq->size;
+ if (dev->features & (1ULL << VIRTIO_RING_F_EVENT_IDX))
+ len += sizeof(uint16_t);
+ expected_len = len;
vq->used = (struct vring_used *)(uintptr_t)ring_addr_to_vva(dev,
vq, addr->used_user_addr, &len);
- if (vq->used == 0 || len != sizeof(struct vring_used) +
- sizeof(struct vring_used_elem) * vq->size) {
+ if (vq->used == 0 || len != expected_len) {
RTE_LOG(DEBUG, VHOST_CONFIG,
"(%d) failed to map used ring.\n",
dev->vid);
--
2.17.1
^ permalink raw reply [flat|nested] 6+ messages in thread