d/numam-dpdk
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

vhost: avoid dead loop chain

Browse Source 
If a malicious guest forges a dead loop chain, it could lead to a dead
loop of copying the desc buf to mbuf, which results to all mbuf being
exhausted.

Add a var nr_desc to avoid such case.

Suggested-by: Huawei Xie <huawei.xie@intel.com>
Signed-off-by: Yuanhan Liu <yuanhan.liu@linux.intel.com>
This commit is contained in:
Yuanhan Liu 2016-03-10 12:32:46 +08:00 committed by Thomas Monjalon
parent c687b0b635
commit a436f53ebf
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
lib/librte_vhost/vhost_rxtx.c
View File

@ -745,6 +745,8 @@ copy_desc_to_mbuf(struct virtio_net *dev, struct vhost_virtqueue *vq,
uint32_t cpy_len;
struct rte_mbuf *cur = m, *prev = m;
struct virtio_net_hdr *hdr;
/* A counter to avoid desc dead loop chain */
uint32_t nr_desc = 1;
desc = &vq->desc[desc_idx];
if (unlikely(desc->len < vq->vhost_hlen))
@ -763,7 +765,8 @@ copy_desc_to_mbuf(struct virtio_net *dev, struct vhost_virtqueue *vq,
while (desc_avail != 0 || (desc->flags & VRING_DESC_F_NEXT) != 0) {
/* This desc reaches to its end, get the next one */
if (desc_avail == 0) {
if (unlikely(desc->next >= vq->size))
if (unlikely(desc->next >= vq->size ||
++nr_desc >= vq->size))
return -1;
desc = &vq->desc[desc->next];