In the batch path of the asynchronous packed ring dequeue, the address
of the virtio net header is obtained from vhost_iova_to_vva(), which
returns 0 when a guest-provided descriptor address cannot be fully
translated. The batch check only validates that the descriptor address
is non-zero and that the length is consistent. A malicious or buggy
guest could therefore trigger a NULL pointer dereference and crash the
vhost application (denial of service).
Check the translation result and leave the batch fast path with an error
on failure, so the single-packet path handles the invalid descriptor, as
is already done for the non-batch async dequeue path.
Perform the header translation before the DMA iovec setup so that the
early return cannot leave the async iterator state partially updated.
Fixes: c2fa52bf1e5d ("vhost: add batch dequeue in async vhost packed ring")
Cc: [email protected]
Signed-off-by: Anton Vanda <[email protected]>
---
.mailmap | 1 +
lib/vhost/virtio_net.c | 26 +++++++++++++++++---------
2 files changed, 18 insertions(+), 9 deletions(-)
diff --git a/.mailmap b/.mailmap
index 05a55c0bd6..9215581a29 100644
--- a/.mailmap
+++ b/.mailmap
@@ -141,6 +141,7 @@ Antara Ganesh Kolar <[email protected]>
Anthony Fee <[email protected]>
Anthony Harivel <[email protected]>
Antonio Fischetti <[email protected]>
+Anton Vanda <[email protected]>
Anup Prabhu <[email protected]>
Anupam Kapoor <[email protected]>
Anurag Mandal <[email protected]>
diff --git a/lib/vhost/virtio_net.c b/lib/vhost/virtio_net.c
index 0658b81de5..6528c06ea4 100644
--- a/lib/vhost/virtio_net.c
+++ b/lib/vhost/virtio_net.c
@@ -4039,6 +4039,23 @@ virtio_dev_tx_async_packed_batch(struct virtio_net *dev,
vhost_for_each_try_unroll(i, 0, PACKED_BATCH_SIZE)
rte_prefetch0((void *)(uintptr_t)desc_addrs[i]);
+ if (virtio_net_with_host_offload(dev)) {
+ vhost_for_each_try_unroll(i, 0, PACKED_BATCH_SIZE) {
+ desc_vva = vhost_iova_to_vva(dev, vq, desc_addrs[i],
+ &lens[i], VHOST_ACCESS_RO);
+ /*
+ * A malformed or unmapped guest descriptor makes the
+ * IOVA translation fail (returns 0). Bail out of the
+ * batch fast path so the single-packet path handles the
+ * error, instead of dereferencing a NULL header.
+ */
+ if (unlikely(!desc_vva))
+ return -1;
+ hdr = (struct virtio_net_hdr *)(uintptr_t)desc_vva;
+ pkts_info[slot_idx + i].nethdr = *hdr;
+ }
+ }
+
vhost_for_each_try_unroll(i, 0, PACKED_BATCH_SIZE) {
host_iova[i] = (void *)(uintptr_t)gpa_to_first_hpa(dev,
desc_addrs[i] + buf_offset, pkts[i]->pkt_len,
&mapped_len[i]);
@@ -4053,15 +4070,6 @@ virtio_dev_tx_async_packed_batch(struct virtio_net *dev,
async->iter_idx++;
}
- if (virtio_net_with_host_offload(dev)) {
- vhost_for_each_try_unroll(i, 0, PACKED_BATCH_SIZE) {
- desc_vva = vhost_iova_to_vva(dev, vq, desc_addrs[i],
- &lens[i], VHOST_ACCESS_RO);
- hdr = (struct virtio_net_hdr *)(uintptr_t)desc_vva;
- pkts_info[slot_idx + i].nethdr = *hdr;
- }
- }
-
vq_inc_last_avail_packed(vq, PACKED_BATCH_SIZE);
vhost_async_shadow_dequeue_packed_batch(vq, ids);
--
2.51.0
