From f167022606b5ccca27a627ae599538ce2348ef67 Mon Sep 17 00:00:00 2001 Message-Id: From: Maxime Coquelin Date: Thu, 16 Jun 2022 11:35:56 +0200 Subject: [PATCH 1/2] vhost: discard too small descriptor chains [ upstream commit 71bd0cc536ad6d84188d947d6f24c17400d8f623 ] This patch discards descriptor chains which are smaller than the Virtio-net header size, and ones that are equal. Indeed, such descriptor chains sizes mean there is no packet data. This patch also has the advantage of requesting the exact packets sizes for the mbufs. CVE-2022-2132 Fixes: 62250c1d0978 ("vhost: extract split ring handling from Rx and Tx functions") Fixes: c3ff0ac70acb ("vhost: improve performance by supporting large buffer") Fixes: 84d5204310d7 ("vhost: support async dequeue for split ring") Signed-off-by: Maxime Coquelin Acked-by: Chenbo Xia Reviewed-by: David Marchand --- lib/vhost/virtio_net.c | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) diff --git a/lib/vhost/virtio_net.c b/lib/vhost/virtio_net.c index 858187d1b0..991a7a2bd4 100644 --- a/lib/vhost/virtio_net.c +++ b/lib/vhost/virtio_net.c @@ -2334,10 +2334,10 @@ copy_desc_to_mbuf(struct virtio_net *dev, struct vhost_virtqueue *vq, buf_addr = buf_vec[vec_idx].buf_addr; buf_len = buf_vec[vec_idx].buf_len; - if (unlikely(buf_len < dev->vhost_hlen && nr_vec <= 1)) { - error = -1; - goto out; - } + /* + * The caller has checked the descriptors chain is larger than the + * header size. + */ if (virtio_net_with_host_offload(dev)) { if (unlikely(buf_len < sizeof(struct virtio_net_hdr))) { @@ -2568,6 +2568,14 @@ virtio_dev_tx_split(struct virtio_net *dev, struct vhost_virtqueue *vq, update_shadow_used_ring_split(vq, head_idx, 0); + if (unlikely(buf_len <= dev->vhost_hlen)) { + dropped += 1; + i++; + break; + } + + buf_len -= dev->vhost_hlen; + err = virtio_dev_pktmbuf_prep(dev, pkts[i], buf_len); if (unlikely(err)) { /* @@ -2771,6 +2779,11 @@ vhost_dequeue_single_packed(struct virtio_net *dev, VHOST_ACCESS_RO) < 0)) return -1; + if (unlikely(buf_len <= dev->vhost_hlen)) + return -1; + + buf_len -= dev->vhost_hlen; + if (unlikely(virtio_dev_pktmbuf_prep(dev, pkts, buf_len))) { if (!allocerr_warned) { VHOST_LOG_DATA(ERR, -- 2.37.3