From patchwork Mon Aug 29 15:09:35 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Marchand X-Patchwork-Id: 115599 X-Patchwork-Delegate: maxime.coquelin@redhat.com Return-Path: X-Original-To: patchwork@inbox.dpdk.org Delivered-To: patchwork@inbox.dpdk.org Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id D7355A0542; Mon, 29 Aug 2022 17:10:20 +0200 (CEST) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id CBB6A41181; Mon, 29 Aug 2022 17:10:20 +0200 (CEST) Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by mails.dpdk.org (Postfix) with ESMTP id 73DB841147 for ; Mon, 29 Aug 2022 17:10:19 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1661785819; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Ot8wbt7X0ODS7YDVjMkqP3DNCyT17iKaXGMGsYsie1M=; b=DLE6KCXMtemvcKfrjyLINr3Uxb1mNs3DTlO+HIr2tJlD6bJQkBeezmTQhTJeL1iFl41abs kb+AXvsUpNPESNVfyh/wksX6bqpASMpwudh4ml5tfH2bTQnN9uKOTqI53MfBofcIiTxygD 0CBQXeeqJXsorXoMS54SszeS+XI1CKQ= Received: from mimecast-mx02.redhat.com (mx3-rdu2.redhat.com [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-307-VwepVixIPm-27OVCUVw-EA-1; Mon, 29 Aug 2022 11:10:01 -0400 X-MC-Unique: VwepVixIPm-27OVCUVw-EA-1 Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.rdu2.redhat.com [10.11.54.2]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 387E03C216C8; Mon, 29 Aug 2022 15:10:01 +0000 (UTC) Received: from fchome.redhat.com (unknown [10.40.193.251]) by smtp.corp.redhat.com (Postfix) with ESMTP id 5725740C141D; Mon, 29 Aug 2022 15:09:59 +0000 (UTC) From: David Marchand To: dev@dpdk.org Cc: Maxime Coquelin , stable@dpdk.org, Chenbo Xia , Tiwei Bie , Flavio Leitner , Yuan Wang , Xuan Ding Subject: [PATCH 1/2] vhost: discard too small descriptor chains Date: Mon, 29 Aug 2022 17:09:35 +0200 Message-Id: <20220829150936.1455069-1-david.marchand@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.84 on 10.11.54.2 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org From: Maxime Coquelin This patch discards descriptor chains which are smaller than the Virtio-net header size, and ones that are equal. Indeed, such descriptor chains sizes mean there is no packet data. This patch also has the advantage of requesting the exact packets sizes for the mbufs. CVE-2022-2132 Fixes: 62250c1d0978 ("vhost: extract split ring handling from Rx and Tx functions") Fixes: c3ff0ac70acb ("vhost: improve performance by supporting large buffer") Fixes: 84d5204310d7 ("vhost: support async dequeue for split ring") Cc: stable@dpdk.org Signed-off-by: Maxime Coquelin Acked-by: Chenbo Xia Reviewed-by: David Marchand --- lib/vhost/virtio_net.c | 26 ++++++++++++++++++++++++-- 1 file changed, 24 insertions(+), 2 deletions(-) diff --git a/lib/vhost/virtio_net.c b/lib/vhost/virtio_net.c index 35fa4670fd..757d8dee17 100644 --- a/lib/vhost/virtio_net.c +++ b/lib/vhost/virtio_net.c @@ -2677,8 +2677,10 @@ desc_to_mbuf(struct virtio_net *dev, struct vhost_virtqueue *vq, buf_iova = buf_vec[vec_idx].buf_iova; buf_len = buf_vec[vec_idx].buf_len; - if (unlikely(buf_len < dev->vhost_hlen && nr_vec <= 1)) - return -1; + /* + * The caller has checked the descriptors chain is larger than the + * header size. + */ if (virtio_net_with_host_offload(dev)) { if (unlikely(buf_len < sizeof(struct virtio_net_hdr))) { @@ -2922,6 +2924,14 @@ virtio_dev_tx_split(struct virtio_net *dev, struct vhost_virtqueue *vq, update_shadow_used_ring_split(vq, head_idx, 0); + if (unlikely(buf_len <= dev->vhost_hlen)) { + dropped += 1; + i++; + break; + } + + buf_len -= dev->vhost_hlen; + err = virtio_dev_pktmbuf_prep(dev, pkts[i], buf_len); if (unlikely(err)) { /* @@ -3124,6 +3134,11 @@ vhost_dequeue_single_packed(struct virtio_net *dev, VHOST_ACCESS_RO) < 0)) return -1; + if (unlikely(buf_len <= dev->vhost_hlen)) + return -1; + + buf_len -= dev->vhost_hlen; + if (unlikely(virtio_dev_pktmbuf_prep(dev, pkts, buf_len))) { if (!allocerr_warned) { VHOST_LOG_DATA(dev->ifname, ERR, @@ -3448,6 +3463,13 @@ virtio_dev_tx_async_split(struct virtio_net *dev, struct vhost_virtqueue *vq, break; } + if (unlikely(buf_len <= dev->vhost_hlen)) { + dropped = true; + break; + } + + buf_len -= dev->vhost_hlen; + err = virtio_dev_pktmbuf_prep(dev, pkt, buf_len); if (unlikely(err)) { /** From patchwork Mon Aug 29 15:09:36 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Marchand X-Patchwork-Id: 115598 X-Patchwork-Delegate: maxime.coquelin@redhat.com Return-Path: X-Original-To: patchwork@inbox.dpdk.org Delivered-To: patchwork@inbox.dpdk.org Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id C7C77A0542; Mon, 29 Aug 2022 17:10:07 +0200 (CEST) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id A79884069D; Mon, 29 Aug 2022 17:10:07 +0200 (CEST) Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by mails.dpdk.org (Postfix) with ESMTP id 5E90A4003C for ; Mon, 29 Aug 2022 17:10:06 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1661785805; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=E9C2FMjt/2K6Nh4kbdYEPTyAC1E/7ZBODKhs8qG0wXE=; b=Pt8SHAU6NYembgp0AMo50a6WeWpiIMZirQJ5Lx8P/6iLpMzvry5HngUNCaxSv0a/SkG+FL itacx/SncQj3mBaXOwuDeEyzoHjhfyT7gxlAVSjJOdaEEo3DNnIjzya3OuIowrKk6caNL4 BNPHsusV+6qxN2mTRHvFTfafHA2lwDc= Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-399-0I6ZJbZPN1q1cU47N2gMiw-1; Mon, 29 Aug 2022 11:10:04 -0400 X-MC-Unique: 0I6ZJbZPN1q1cU47N2gMiw-1 Received: from smtp.corp.redhat.com (int-mx01.intmail.prod.int.rdu2.redhat.com [10.11.54.1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 3A491180A380; Mon, 29 Aug 2022 15:10:04 +0000 (UTC) Received: from fchome.redhat.com (unknown [10.40.193.251]) by smtp.corp.redhat.com (Postfix) with ESMTP id 2D37040CF8E4; Mon, 29 Aug 2022 15:10:03 +0000 (UTC) From: David Marchand To: dev@dpdk.org Cc: Maxime Coquelin , stable@dpdk.org, Chenbo Xia , Tiwei Bie Subject: [PATCH 2/2] vhost: fix header spanned across more than two descriptors Date: Mon, 29 Aug 2022 17:09:36 +0200 Message-Id: <20220829150936.1455069-2-david.marchand@redhat.com> In-Reply-To: <20220829150936.1455069-1-david.marchand@redhat.com> References: <20220829150936.1455069-1-david.marchand@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.84 on 10.11.54.1 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org From: Maxime Coquelin This patch aims at supporting the unlikely case where a Virtio-net header is spanned across more than two descriptors. CVE-2022-2132 Fixes: fd68b4739d2c ("vhost: use buffer vectors in dequeue path") Cc: stable@dpdk.org Signed-off-by: Maxime Coquelin Acked-by: Chenbo Xia Reviewed-by: David Marchand --- lib/vhost/virtio_net.c | 45 +++++++++++++----------------------------- 1 file changed, 14 insertions(+), 31 deletions(-) diff --git a/lib/vhost/virtio_net.c b/lib/vhost/virtio_net.c index 757d8dee17..270c71a54e 100644 --- a/lib/vhost/virtio_net.c +++ b/lib/vhost/virtio_net.c @@ -2664,26 +2664,22 @@ desc_to_mbuf(struct virtio_net *dev, struct vhost_virtqueue *vq, uint32_t buf_avail, buf_offset, buf_len; uint64_t buf_addr, buf_iova; uint32_t mbuf_avail, mbuf_offset; + uint32_t hdr_remain = dev->vhost_hlen; uint32_t cpy_len; struct rte_mbuf *cur = m, *prev = m; struct virtio_net_hdr tmp_hdr; struct virtio_net_hdr *hdr = NULL; - /* A counter to avoid desc dead loop chain */ - uint16_t vec_idx = 0; + uint16_t vec_idx; struct vhost_async *async = vq->async; struct async_inflight_info *pkts_info; - buf_addr = buf_vec[vec_idx].buf_addr; - buf_iova = buf_vec[vec_idx].buf_iova; - buf_len = buf_vec[vec_idx].buf_len; - /* * The caller has checked the descriptors chain is larger than the * header size. */ if (virtio_net_with_host_offload(dev)) { - if (unlikely(buf_len < sizeof(struct virtio_net_hdr))) { + if (unlikely(buf_vec[0].buf_len < sizeof(struct virtio_net_hdr))) { /* * No luck, the virtio-net header doesn't fit * in a contiguous virtual area. @@ -2691,36 +2687,23 @@ desc_to_mbuf(struct virtio_net *dev, struct vhost_virtqueue *vq, copy_vnet_hdr_from_desc(&tmp_hdr, buf_vec); hdr = &tmp_hdr; } else { - hdr = (struct virtio_net_hdr *)((uintptr_t)buf_addr); + hdr = (struct virtio_net_hdr *)((uintptr_t)buf_vec[0].buf_addr); } } - /* - * A virtio driver normally uses at least 2 desc buffers - * for Tx: the first for storing the header, and others - * for storing the data. - */ - if (unlikely(buf_len < dev->vhost_hlen)) { - buf_offset = dev->vhost_hlen - buf_len; - vec_idx++; - buf_addr = buf_vec[vec_idx].buf_addr; - buf_iova = buf_vec[vec_idx].buf_iova; - buf_len = buf_vec[vec_idx].buf_len; - buf_avail = buf_len - buf_offset; - } else if (buf_len == dev->vhost_hlen) { - if (unlikely(++vec_idx >= nr_vec)) - goto error; - buf_addr = buf_vec[vec_idx].buf_addr; - buf_iova = buf_vec[vec_idx].buf_iova; - buf_len = buf_vec[vec_idx].buf_len; + for (vec_idx = 0; vec_idx < nr_vec; vec_idx++) { + if (buf_vec[vec_idx].buf_len > hdr_remain) + break; - buf_offset = 0; - buf_avail = buf_len; - } else { - buf_offset = dev->vhost_hlen; - buf_avail = buf_vec[vec_idx].buf_len - dev->vhost_hlen; + hdr_remain -= buf_vec[vec_idx].buf_len; } + buf_addr = buf_vec[vec_idx].buf_addr; + buf_iova = buf_vec[vec_idx].buf_iova; + buf_len = buf_vec[vec_idx].buf_len; + buf_offset = hdr_remain; + buf_avail = buf_vec[vec_idx].buf_len - hdr_remain; + PRINT_PACKET(dev, (uintptr_t)(buf_addr + buf_offset), (uint32_t)buf_avail, 0);