[v2] vhost: add sanity check when operating the split ring
Checks
Commit Message
The idx in rte_vhost_set_last_inflight_io_split is from the frontend
driver, check if it's in the virtqueue range.
Fixes: bb0c2de9602b ("vhost: add APIs to operate inflight ring")
Cc: stable@dpdk.org
Signed-off-by: Li Feng <fengli@smartx.com>
---
lib/vhost/vhost.c | 3 +++
1 file changed, 3 insertions(+)
Comments
The title is too vague, I would put something like:
vhost: add sanity check on inflight last index
On 10/14/21 14:40, Li Feng wrote:
> The idx in rte_vhost_set_last_inflight_io_split is from the frontend
s/idx/index/
> driver, check if it's in the virtqueue range.
>
> Fixes: bb0c2de9602b ("vhost: add APIs to operate inflight ring")
> Cc: stable@dpdk.org
>
> Signed-off-by: Li Feng <fengli@smartx.com>
> ---
> lib/vhost/vhost.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/lib/vhost/vhost.c b/lib/vhost/vhost.c
> index 9540522dac..3b674ac320 100644
> --- a/lib/vhost/vhost.c
> +++ b/lib/vhost/vhost.c
> @@ -1226,6 +1226,9 @@ rte_vhost_set_last_inflight_io_split(int vid, uint16_t vring_idx,
> if (unlikely(!vq->inflight_split))
> return -1;
>
> + if (unlikely(idx >= vq->size))
> + return -1;
> +
> vq->inflight_split->last_inflight_io = idx;
> return 0;
> }
>
Other than that, this is fine to me:
Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com>
If my suggestions are fine for you, I can fix while applying.
Thanks,
Maxime
On Fri, Oct 15, 2021 at 4:52 PM Maxime Coquelin
<maxime.coquelin@redhat.com> wrote:
>
> The title is too vague, I would put something like:
>
> vhost: add sanity check on inflight last index
>
> On 10/14/21 14:40, Li Feng wrote:
> > The idx in rte_vhost_set_last_inflight_io_split is from the frontend
>
> s/idx/index/
>
> > driver, check if it's in the virtqueue range.
> >
> > Fixes: bb0c2de9602b ("vhost: add APIs to operate inflight ring")
> > Cc: stable@dpdk.org
> >
> > Signed-off-by: Li Feng <fengli@smartx.com>
> > ---
> > lib/vhost/vhost.c | 3 +++
> > 1 file changed, 3 insertions(+)
> >
> > diff --git a/lib/vhost/vhost.c b/lib/vhost/vhost.c
> > index 9540522dac..3b674ac320 100644
> > --- a/lib/vhost/vhost.c
> > +++ b/lib/vhost/vhost.c
> > @@ -1226,6 +1226,9 @@ rte_vhost_set_last_inflight_io_split(int vid, uint16_t vring_idx,
> > if (unlikely(!vq->inflight_split))
> > return -1;
> >
> > + if (unlikely(idx >= vq->size))
> > + return -1;
> > +
> > vq->inflight_split->last_inflight_io = idx;
> > return 0;
> > }
> >
>
> Other than that, this is fine to me:
>
> Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com>
>
> If my suggestions are fine for you, I can fix while applying.
>
It's fine.
> Thanks,
> Maxime
>
On 10/15/21 11:25, Li Feng wrote:
> On Fri, Oct 15, 2021 at 4:52 PM Maxime Coquelin
> <maxime.coquelin@redhat.com> wrote:
>>
>> The title is too vague, I would put something like:
>>
>> vhost: add sanity check on inflight last index
>>
>> On 10/14/21 14:40, Li Feng wrote:
>>> The idx in rte_vhost_set_last_inflight_io_split is from the frontend
>>
>> s/idx/index/
>>
>>> driver, check if it's in the virtqueue range.
>>>
>>> Fixes: bb0c2de9602b ("vhost: add APIs to operate inflight ring")
>>> Cc: stable@dpdk.org
>>>
>>> Signed-off-by: Li Feng <fengli@smartx.com>
>>> ---
>>> lib/vhost/vhost.c | 3 +++
>>> 1 file changed, 3 insertions(+)
>>>
>>> diff --git a/lib/vhost/vhost.c b/lib/vhost/vhost.c
>>> index 9540522dac..3b674ac320 100644
>>> --- a/lib/vhost/vhost.c
>>> +++ b/lib/vhost/vhost.c
>>> @@ -1226,6 +1226,9 @@ rte_vhost_set_last_inflight_io_split(int vid, uint16_t vring_idx,
>>> if (unlikely(!vq->inflight_split))
>>> return -1;
>>>
>>> + if (unlikely(idx >= vq->size))
>>> + return -1;
>>> +
>>> vq->inflight_split->last_inflight_io = idx;
>>> return 0;
>>> }
>>>
>>
>> Other than that, this is fine to me:
>>
>> Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com>
>>
>> If my suggestions are fine for you, I can fix while applying.
>>
> It's fine.
>
>> Thanks,
>> Maxime
>>
>
Applied to dpdk-next-virtio/main.
Thanks,
Maxime
@@ -1226,6 +1226,9 @@ rte_vhost_set_last_inflight_io_split(int vid, uint16_t vring_idx,
if (unlikely(!vq->inflight_split))
return -1;
+ if (unlikely(idx >= vq->size))
+ return -1;
+
vq->inflight_split->last_inflight_io = idx;
return 0;
}