From patchwork Wed Mar 31 06:49:37 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Marvin Liu X-Patchwork-Id: 90163 X-Patchwork-Delegate: maxime.coquelin@redhat.com Return-Path: X-Original-To: patchwork@inbox.dpdk.org Delivered-To: patchwork@inbox.dpdk.org Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 7435BA034F; Wed, 31 Mar 2021 08:50:27 +0200 (CEST) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 5FDF94069E; Wed, 31 Mar 2021 08:50:27 +0200 (CEST) Received: from mga12.intel.com (mga12.intel.com [192.55.52.136]) by mails.dpdk.org (Postfix) with ESMTP id 75B3740141; Wed, 31 Mar 2021 08:50:25 +0200 (CEST) IronPort-SDR: 4DDXmY8GJscooazN308DnRULITeXKXHFKWN1ZyQqZkxnlD/dIq6vB5Xn1NB4kA6HFVJFAIDzlp 977kZnN0RGOw== X-IronPort-AV: E=McAfee;i="6000,8403,9939"; a="171342646" X-IronPort-AV: E=Sophos;i="5.81,293,1610438400"; d="scan'208";a="171342646" Received: from fmsmga002.fm.intel.com ([10.253.24.26]) by fmsmga106.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 30 Mar 2021 23:50:24 -0700 IronPort-SDR: kAzwI261UI9e7fNYUwc4Ne4lvkD8wh/svw/nMWD5/BpjNLf2hb4zy0mu2nHNs8liA8+aPjxe8x XccY9zcXbGcw== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.81,293,1610438400"; d="scan'208";a="445526235" Received: from npg-dpdk-virtual-marvin-dev.sh.intel.com ([10.67.119.108]) by fmsmga002.fm.intel.com with ESMTP; 30 Mar 2021 23:50:21 -0700 From: Marvin Liu To: maxime.coquelin@redhat.com, chenbo.xia@intel.com Cc: dev@dpdk.org, Marvin Liu , stable@dpdk.org Date: Wed, 31 Mar 2021 14:49:37 +0800 Message-Id: <20210331064939.56107-1-yong.liu@intel.com> X-Mailer: git-send-email 2.17.1 Subject: [dpdk-dev] [PATCH 1/3] vhost: fix split ring potential buffer overflow X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" In vhost datapath, descriptor's length are mostly used in two coherent operations. First step is used for address translation, second step is used for memory transaction from guest to host. But the iterval between two steps will give a window for malicious guest, in which can change descriptor length after vhost calcuated buffer size. Thus may lead to buffer overflow in vhost side. This potential risk can be eliminated by accessing the descriptor length once. Fixes: 1be4ebb1c464 ("vhost: support indirect descriptor in mergeable Rx") Cc: stable@dpdk.org Signed-off-by: Marvin Liu Reviewed-by: Maxime Coquelin diff --git a/lib/librte_vhost/virtio_net.c b/lib/librte_vhost/virtio_net.c index 583bf379c6..576a0a20c0 100644 --- a/lib/librte_vhost/virtio_net.c +++ b/lib/librte_vhost/virtio_net.c @@ -548,10 +548,11 @@ fill_vec_buf_split(struct virtio_net *dev, struct vhost_virtqueue *vq, return -1; } - len += descs[idx].len; + dlen = descs[idx].len; + len += dlen; if (unlikely(map_one_desc(dev, vq, buf_vec, &vec_id, - descs[idx].addr, descs[idx].len, + descs[idx].addr, dlen, perm))) { free_ind_table(idesc); return -1; From patchwork Wed Mar 31 06:49:38 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Marvin Liu X-Patchwork-Id: 90164 X-Patchwork-Delegate: maxime.coquelin@redhat.com Return-Path: X-Original-To: patchwork@inbox.dpdk.org Delivered-To: patchwork@inbox.dpdk.org Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id B469AA034F; Wed, 31 Mar 2021 08:50:32 +0200 (CEST) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 9CCB7140DEB; Wed, 31 Mar 2021 08:50:30 +0200 (CEST) Received: from mga12.intel.com (mga12.intel.com [192.55.52.136]) by mails.dpdk.org (Postfix) with ESMTP id 5BD6340141; Wed, 31 Mar 2021 08:50:26 +0200 (CEST) IronPort-SDR: 2nihPO6LDUIWXoVnmfHEkj7L2O3bhSRvJ28h3VOkaF5BTQoPRhwTRB5YiOe5J3MoZ8Ahhu9EdK 23CJVsLd7srg== X-IronPort-AV: E=McAfee;i="6000,8403,9939"; a="171342648" X-IronPort-AV: E=Sophos;i="5.81,293,1610438400"; d="scan'208";a="171342648" Received: from fmsmga002.fm.intel.com ([10.253.24.26]) by fmsmga106.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 30 Mar 2021 23:50:26 -0700 IronPort-SDR: 7hfoDcLe91dmALr+U849qe+d/nxYSrsWX74o+WtmSfLkFAmZQtJFHcQN0vTyzEG3UrPiGFFlFK gtKcHIL4PYCA== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.81,293,1610438400"; d="scan'208";a="445526314" Received: from npg-dpdk-virtual-marvin-dev.sh.intel.com ([10.67.119.108]) by fmsmga002.fm.intel.com with ESMTP; 30 Mar 2021 23:50:24 -0700 From: Marvin Liu To: maxime.coquelin@redhat.com, chenbo.xia@intel.com Cc: dev@dpdk.org, Marvin Liu , stable@dpdk.org Date: Wed, 31 Mar 2021 14:49:38 +0800 Message-Id: <20210331064939.56107-2-yong.liu@intel.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20210331064939.56107-1-yong.liu@intel.com> References: <20210331064939.56107-1-yong.liu@intel.com> Subject: [dpdk-dev] [PATCH 2/3] vhost: fix packed ring potential buffer overflow X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" Similar as split ring, the multiple accesses of descriptor length will lead to potential risk. One-time access of descriptor length can eliminate this risk. Fixes: 2f3225a7d69b ("vhost: add vector filling support for packed ring") Cc: stable@dpdk.org Signed-off-by: Marvin Liu Reviewed-by: Maxime Coquelin diff --git a/lib/librte_vhost/virtio_net.c b/lib/librte_vhost/virtio_net.c index 576a0a20c0..de43686522 100644 --- a/lib/librte_vhost/virtio_net.c +++ b/lib/librte_vhost/virtio_net.c @@ -669,9 +669,10 @@ fill_vec_buf_packed_indirect(struct virtio_net *dev, return -1; } - *len += descs[i].len; + dlen = descs[i].len; + *len += dlen; if (unlikely(map_one_desc(dev, vq, buf_vec, &vec_id, - descs[i].addr, descs[i].len, + descs[i].addr, dlen, perm))) return -1; } @@ -692,6 +693,7 @@ fill_vec_buf_packed(struct virtio_net *dev, struct vhost_virtqueue *vq, bool wrap_counter = vq->avail_wrap_counter; struct vring_packed_desc *descs = vq->desc_packed; uint16_t vec_id = *vec_idx; + uint64_t dlen; if (avail_idx < vq->last_avail_idx) wrap_counter ^= 1; @@ -724,11 +726,12 @@ fill_vec_buf_packed(struct virtio_net *dev, struct vhost_virtqueue *vq, len, perm) < 0)) return -1; } else { - *len += descs[avail_idx].len; + dlen = descs[avail_idx].len; + *len += dlen; if (unlikely(map_one_desc(dev, vq, buf_vec, &vec_id, descs[avail_idx].addr, - descs[avail_idx].len, + dlen, perm))) return -1; } From patchwork Wed Mar 31 06:49:39 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Marvin Liu X-Patchwork-Id: 90165 X-Patchwork-Delegate: maxime.coquelin@redhat.com Return-Path: X-Original-To: patchwork@inbox.dpdk.org Delivered-To: patchwork@inbox.dpdk.org Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 4C27BA034F; Wed, 31 Mar 2021 08:50:39 +0200 (CEST) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 16F89140E07; Wed, 31 Mar 2021 08:50:33 +0200 (CEST) Received: from mga12.intel.com (mga12.intel.com [192.55.52.136]) by mails.dpdk.org (Postfix) with ESMTP id B9AB4140DED; Wed, 31 Mar 2021 08:50:30 +0200 (CEST) IronPort-SDR: RNz9v9qRRQKEYdBnfOosr1ssKFWoDrsG04Rv+SsIiczXEjHT4CVZ4VEn8uvBzddOo3HKtjRzX3 9F6MI2GbGClw== X-IronPort-AV: E=McAfee;i="6000,8403,9939"; a="171342653" X-IronPort-AV: E=Sophos;i="5.81,293,1610438400"; d="scan'208";a="171342653" Received: from fmsmga002.fm.intel.com ([10.253.24.26]) by fmsmga106.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 30 Mar 2021 23:50:30 -0700 IronPort-SDR: sK7mZ7yYxpwppE48tI+JGQjz8OGSXcYro2bd1LMeO5QgrlBFVsRS7aKeD4U3jbU22ZBanuwEe9 2rij4LkhNXMg== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.81,293,1610438400"; d="scan'208";a="445526432" Received: from npg-dpdk-virtual-marvin-dev.sh.intel.com ([10.67.119.108]) by fmsmga002.fm.intel.com with ESMTP; 30 Mar 2021 23:50:26 -0700 From: Marvin Liu To: maxime.coquelin@redhat.com, chenbo.xia@intel.com Cc: dev@dpdk.org, Marvin Liu , stable@dpdk.org Date: Wed, 31 Mar 2021 14:49:39 +0800 Message-Id: <20210331064939.56107-3-yong.liu@intel.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20210331064939.56107-1-yong.liu@intel.com> References: <20210331064939.56107-1-yong.liu@intel.com> Subject: [dpdk-dev] [PATCH 3/3] vhost: fix potential buffer overflow when batch dequeue X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" Similar as single dequeue, the multiple accesses of descriptor length will lead to potential risk. One-time access of descriptor length can eliminate this risk. Fixes: 75ed51697820 ("vhost: add packed ring batch dequeue") Cc: stable@dpdk.org Signed-off-by: Marvin Liu Reviewed-by: Maxime Coquelin diff --git a/lib/librte_vhost/virtio_net.c b/lib/librte_vhost/virtio_net.c index de43686522..0a7d008a91 100644 --- a/lib/librte_vhost/virtio_net.c +++ b/lib/librte_vhost/virtio_net.c @@ -2318,7 +2318,7 @@ vhost_reserve_avail_batch_packed(struct virtio_net *dev, } vhost_for_each_try_unroll(i, 0, PACKED_BATCH_SIZE) { - pkts[i]->pkt_len = descs[avail_idx + i].len - buf_offset; + pkts[i]->pkt_len = lens[i] - buf_offset; pkts[i]->data_len = pkts[i]->pkt_len; ids[i] = descs[avail_idx + i].id; }