|
 |
6462e1 |
From 735c29eebe2a0757f19bf8b3ba67977e9320c24a Mon Sep 17 00:00:00 2001
|
|
|
6462e1 |
From: Maxime Coquelin <maxime.coquelin@redhat.com>
|
|
|
6462e1 |
Date: Thu, 16 Jun 2022 14:25:07 +0200
|
|
|
6462e1 |
Subject: [PATCH v2 2/2] vhost: fix header spanned across more than two
|
|
|
6462e1 |
descriptors
|
|
|
6462e1 |
|
|
|
6462e1 |
This patch aims at supporting the unlikely case where a
|
|
|
6462e1 |
Virtio-net header is spanned across more than two
|
|
|
6462e1 |
descriptors.
|
|
|
6462e1 |
|
|
|
6462e1 |
CVE-2022-2132
|
|
|
6462e1 |
Fixes: fd68b4739d2c ("vhost: use buffer vectors in dequeue path")
|
|
|
6462e1 |
Cc: stable@dpdk.org
|
|
|
6462e1 |
|
|
|
6462e1 |
Signed-off-by: Maxime Coquelin <maxime.coquelin@redhat.com>
|
|
|
6462e1 |
---
|
|
|
6462e1 |
lib/librte_vhost/virtio_net.c | 45 +++++++++++------------------------
|
|
|
6462e1 |
1 file changed, 14 insertions(+), 31 deletions(-)
|
|
|
6462e1 |
|
|
|
6462e1 |
diff --git a/lib/librte_vhost/virtio_net.c b/lib/librte_vhost/virtio_net.c
|
|
|
6462e1 |
index 7da440de28..bd664c88c1 100644
|
|
|
6462e1 |
--- a/lib/librte_vhost/virtio_net.c
|
|
|
6462e1 |
+++ b/lib/librte_vhost/virtio_net.c
|
|
|
6462e1 |
@@ -1099,26 +1099,22 @@ copy_desc_to_mbuf(struct virtio_net *dev, struct vhost_virtqueue *vq,
|
|
|
6462e1 |
uint32_t buf_avail, buf_offset;
|
|
|
6462e1 |
uint64_t buf_addr, buf_iova, buf_len;
|
|
|
6462e1 |
uint32_t mbuf_avail, mbuf_offset;
|
|
|
6462e1 |
+ uint32_t hdr_remain = dev->vhost_hlen;
|
|
|
6462e1 |
uint32_t cpy_len;
|
|
|
6462e1 |
struct rte_mbuf *cur = m, *prev = m;
|
|
|
6462e1 |
struct virtio_net_hdr tmp_hdr;
|
|
|
6462e1 |
struct virtio_net_hdr *hdr = NULL;
|
|
|
6462e1 |
- /* A counter to avoid desc dead loop chain */
|
|
|
6462e1 |
- uint16_t vec_idx = 0;
|
|
|
6462e1 |
+ uint16_t vec_idx;
|
|
|
6462e1 |
struct batch_copy_elem *batch_copy = vq->batch_copy_elems;
|
|
|
6462e1 |
int error = 0;
|
|
|
6462e1 |
|
|
|
6462e1 |
- buf_addr = buf_vec[vec_idx].buf_addr;
|
|
|
6462e1 |
- buf_iova = buf_vec[vec_idx].buf_iova;
|
|
|
6462e1 |
- buf_len = buf_vec[vec_idx].buf_len;
|
|
|
6462e1 |
-
|
|
|
6462e1 |
/*
|
|
|
6462e1 |
* The caller has checked the descriptors chain is larger than the
|
|
|
6462e1 |
* header size.
|
|
|
6462e1 |
*/
|
|
|
6462e1 |
|
|
|
6462e1 |
if (virtio_net_with_host_offload(dev)) {
|
|
|
6462e1 |
- if (unlikely(buf_len < sizeof(struct virtio_net_hdr))) {
|
|
|
6462e1 |
+ if (unlikely(buf_vec[0].buf_len < sizeof(struct virtio_net_hdr))) {
|
|
|
6462e1 |
/*
|
|
|
6462e1 |
* No luck, the virtio-net header doesn't fit
|
|
|
6462e1 |
* in a contiguous virtual area.
|
|
|
6462e1 |
@@ -1126,36 +1122,23 @@ copy_desc_to_mbuf(struct virtio_net *dev, struct vhost_virtqueue *vq,
|
|
|
6462e1 |
copy_vnet_hdr_from_desc(&tmp_hdr, buf_vec);
|
|
|
6462e1 |
hdr = &tmp_hdr;
|
|
|
6462e1 |
} else {
|
|
|
6462e1 |
- hdr = (struct virtio_net_hdr *)((uintptr_t)buf_addr);
|
|
|
6462e1 |
+ hdr = (struct virtio_net_hdr *)((uintptr_t)buf_vec[0].buf_addr);
|
|
|
6462e1 |
}
|
|
|
6462e1 |
}
|
|
|
6462e1 |
|
|
|
6462e1 |
- /*
|
|
|
6462e1 |
- * A virtio driver normally uses at least 2 desc buffers
|
|
|
6462e1 |
- * for Tx: the first for storing the header, and others
|
|
|
6462e1 |
- * for storing the data.
|
|
|
6462e1 |
- */
|
|
|
6462e1 |
- if (unlikely(buf_len < dev->vhost_hlen)) {
|
|
|
6462e1 |
- buf_offset = dev->vhost_hlen - buf_len;
|
|
|
6462e1 |
- vec_idx++;
|
|
|
6462e1 |
- buf_addr = buf_vec[vec_idx].buf_addr;
|
|
|
6462e1 |
- buf_iova = buf_vec[vec_idx].buf_iova;
|
|
|
6462e1 |
- buf_len = buf_vec[vec_idx].buf_len;
|
|
|
6462e1 |
- buf_avail = buf_len - buf_offset;
|
|
|
6462e1 |
- } else if (buf_len == dev->vhost_hlen) {
|
|
|
6462e1 |
- if (unlikely(++vec_idx >= nr_vec))
|
|
|
6462e1 |
- goto out;
|
|
|
6462e1 |
- buf_addr = buf_vec[vec_idx].buf_addr;
|
|
|
6462e1 |
- buf_iova = buf_vec[vec_idx].buf_iova;
|
|
|
6462e1 |
- buf_len = buf_vec[vec_idx].buf_len;
|
|
|
6462e1 |
+ for (vec_idx = 0; vec_idx < nr_vec; vec_idx++) {
|
|
|
6462e1 |
+ if (buf_vec[vec_idx].buf_len > hdr_remain)
|
|
|
6462e1 |
+ break;
|
|
|
6462e1 |
|
|
|
6462e1 |
- buf_offset = 0;
|
|
|
6462e1 |
- buf_avail = buf_len;
|
|
|
6462e1 |
- } else {
|
|
|
6462e1 |
- buf_offset = dev->vhost_hlen;
|
|
|
6462e1 |
- buf_avail = buf_vec[vec_idx].buf_len - dev->vhost_hlen;
|
|
|
6462e1 |
+ hdr_remain -= buf_vec[vec_idx].buf_len;
|
|
|
6462e1 |
}
|
|
|
6462e1 |
|
|
|
6462e1 |
+ buf_addr = buf_vec[vec_idx].buf_addr;
|
|
|
6462e1 |
+ buf_iova = buf_vec[vec_idx].buf_iova;
|
|
|
6462e1 |
+ buf_len = buf_vec[vec_idx].buf_len;
|
|
|
6462e1 |
+ buf_offset = hdr_remain;
|
|
|
6462e1 |
+ buf_avail = buf_vec[vec_idx].buf_len - hdr_remain;
|
|
|
6462e1 |
+
|
|
|
6462e1 |
PRINT_PACKET(dev,
|
|
|
6462e1 |
(uintptr_t)(buf_addr + buf_offset),
|
|
|
6462e1 |
(uint32_t)buf_avail, 0);
|
|
|
6462e1 |
--
|
|
|
6462e1 |
2.37.1
|
|
|
6462e1 |
|