d/numam-dpdk
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

vhost: discard too small descriptor chains

Browse Source 
This patch discards descriptor chains which are smaller
than the Virtio-net header size, and ones that are equal.

Indeed, such descriptor chains sizes mean there is no
packet data.

This patch also has the advantage of requesting the exact
packets sizes for the mbufs.

CVE-2022-2132
Fixes: 62250c1d09 ("vhost: extract split ring handling from Rx and Tx functions")
Fixes: c3ff0ac70a ("vhost: improve performance by supporting large buffer")
Fixes: 84d5204310 ("vhost: support async dequeue for split ring")
Cc: stable@dpdk.org

Signed-off-by: Maxime Coquelin <maxime.coquelin@redhat.com>
Acked-by: Chenbo Xia <chenbo.xia@intel.com>
Reviewed-by: David Marchand <david.marchand@redhat.com>
This commit is contained in:
Maxime Coquelin 2022-06-16 11:35:56 +02:00 committed by David Marchand
parent 60b254e392
commit 71bd0cc536
1 changed files with 24 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
lib/vhost/virtio_net.c
View File

@ -2677,8 +2677,10 @@ desc_to_mbuf(struct virtio_net *dev, struct vhost_virtqueue *vq,
buf_iova = buf_vec[vec_idx].buf_iova;
buf_len = buf_vec[vec_idx].buf_len;
if (unlikely(buf_len < dev->vhost_hlen && nr_vec <= 1))
return -1;
/*
* The caller has checked the descriptors chain is larger than the
* header size.
*/
if (virtio_net_with_host_offload(dev)) {
if (unlikely(buf_len < sizeof(struct virtio_net_hdr))) {
@ -2922,6 +2924,14 @@ virtio_dev_tx_split(struct virtio_net *dev, struct vhost_virtqueue *vq,
update_shadow_used_ring_split(vq, head_idx, 0);
if (unlikely(buf_len <= dev->vhost_hlen)) {
dropped += 1;
i++;
break;
}
buf_len -= dev->vhost_hlen;
err = virtio_dev_pktmbuf_prep(dev, pkts[i], buf_len);
if (unlikely(err)) {
/*
@ -3124,6 +3134,11 @@ vhost_dequeue_single_packed(struct virtio_net *dev,
VHOST_ACCESS_RO) < 0))
return -1;
if (unlikely(buf_len <= dev->vhost_hlen))
return -1;
buf_len -= dev->vhost_hlen;
if (unlikely(virtio_dev_pktmbuf_prep(dev, pkts, buf_len))) {
if (!allocerr_warned) {
VHOST_LOG_DATA(dev->ifname, ERR,
@ -3448,6 +3463,13 @@ virtio_dev_tx_async_split(struct virtio_net *dev, struct vhost_virtqueue *vq,
break;
}
if (unlikely(buf_len <= dev->vhost_hlen)) {
dropped = true;
break;
}
buf_len -= dev->vhost_hlen;
err = virtio_dev_pktmbuf_prep(dev, pkt, buf_len);
if (unlikely(err)) {
/**