Commit 5479b12b authored by Jason Wang's avatar Jason Wang Committed by Khalid Elmously

vhost_net: fix possible infinite loop

When the rx buffer is too small for a packet, we will discard the vq
descriptor and retry it for the next packet:

while ((sock_len = vhost_net_rx_peek_head_len(net, sock->sk,
					      &busyloop_intr))) {
...
	/* On overrun, truncate and discard */
	if (unlikely(headcount > UIO_MAXIOV)) {
		iov_iter_init(&msg.msg_iter, READ, vq->iov, 1, 1);
		err = sock->ops->recvmsg(sock, &msg,
					 1, MSG_DONTWAIT | MSG_TRUNC);
		pr_debug("Discarded rx packet: len %zd\n", sock_len);
		continue;
	}
...
}

This makes it possible to trigger a infinite while..continue loop
through the co-opreation of two VMs like:

1) Malicious VM1 allocate 1 byte rx buffer and try to slow down the
   vhost process as much as possible e.g using indirect descriptors or
   other.
2) Malicious VM2 generate packets to VM1 as fast as possible

Fixing this by checking against weight at the end of RX and TX
loop. This also eliminate other similar cases when:

- userspace is consuming the packets in the meanwhile
- theoretical TOCTOU attack if guest moving avail index back and forth
  to hit the continue after vhost find guest just add new buffers

This addresses CVE-2019-3900.

Fixes: d8316f39 ("vhost: fix total length when packets are too short")
Fixes: 3a4d5c94 ("vhost_net: a kernel-level virtio server")
Signed-off-by: default avatarJason Wang <jasowang@redhat.com>
Reviewed-by: default avatarStefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>

CVE-2019-3900

(backported from commit e2412c07)
[tyhicks: Backport to Xenial:
 - Adjust handle_tx() instead of handle_tx_{copy,zerocopy}() due to
   missing commit 0d20bdf3 ("vhost_net: split out datacopy logic")
 - Minor context adjustments due to a lack of missing the iov_limit
   member of the vhost_dev struct which was added later in commit
   b46a0bf7 ("vhost: fix OOB in get_rx_bufs()")
 - handle_rx() still uses peek_head_len() due to missing and unneeded commit
   03088137 ("vhost_net: basic polling support")
 - Context adjustment in call to vhost_log_write() in hunk #3 of net.c due to
   missing and unneeded commit cc5e7107 ("vhost: log dirty page correctly")
 - Context adjustment in hunk #4 due to using break instead of goto out
 - Context adjustment in hunk #5 due to missing and unneeded commit
   c67df11f ("vhost_net: try batch dequing from skb array")]
Signed-off-by: default avatarTyler Hicks <tyhicks@canonical.com>
Acked-by: default avatarStefan Bader <stefan.bader@canonical.com>
Acked-by: default avatarConnor Kuehl <connor.kuehl@canonical.com>
Signed-off-by: default avatarKhalid Elmously <khalid.elmously@canonical.com>
parent 1801314e
...@@ -335,7 +335,7 @@ static void handle_tx(struct vhost_net *net) ...@@ -335,7 +335,7 @@ static void handle_tx(struct vhost_net *net)
hdr_size = nvq->vhost_hlen; hdr_size = nvq->vhost_hlen;
zcopy = nvq->ubufs; zcopy = nvq->ubufs;
for (;;) { do {
/* Release DMAs done buffers first */ /* Release DMAs done buffers first */
if (zcopy) if (zcopy)
vhost_zerocopy_signal_used(net, vq); vhost_zerocopy_signal_used(net, vq);
...@@ -425,10 +425,7 @@ static void handle_tx(struct vhost_net *net) ...@@ -425,10 +425,7 @@ static void handle_tx(struct vhost_net *net)
else else
vhost_zerocopy_signal_used(net, vq); vhost_zerocopy_signal_used(net, vq);
vhost_net_tx_packet(net); vhost_net_tx_packet(net);
if (unlikely(vhost_exceeds_weight(vq, ++sent_pkts, } while (likely(!vhost_exceeds_weight(vq, ++sent_pkts, total_len)));
total_len)))
break;
}
out: out:
mutex_unlock(&vq->mutex); mutex_unlock(&vq->mutex);
} }
...@@ -570,7 +567,11 @@ static void handle_rx(struct vhost_net *net) ...@@ -570,7 +567,11 @@ static void handle_rx(struct vhost_net *net)
vq->log : NULL; vq->log : NULL;
mergeable = vhost_has_feature(vq, VIRTIO_NET_F_MRG_RXBUF); mergeable = vhost_has_feature(vq, VIRTIO_NET_F_MRG_RXBUF);
while ((sock_len = peek_head_len(sock->sk))) { do {
sock_len = peek_head_len(sock->sk);
if (!sock_len)
break;
sock_len += sock_hlen; sock_len += sock_hlen;
vhost_len = sock_len + vhost_hlen; vhost_len = sock_len + vhost_hlen;
headcount = get_rx_bufs(vq, vq->heads, vhost_len, headcount = get_rx_bufs(vq, vq->heads, vhost_len,
...@@ -648,9 +649,8 @@ static void handle_rx(struct vhost_net *net) ...@@ -648,9 +649,8 @@ static void handle_rx(struct vhost_net *net)
if (unlikely(vq_log)) if (unlikely(vq_log))
vhost_log_write(vq, vq_log, log, vhost_len); vhost_log_write(vq, vq_log, log, vhost_len);
total_len += vhost_len; total_len += vhost_len;
if (unlikely(vhost_exceeds_weight(vq, ++recv_pkts, total_len))) } while (likely(!vhost_exceeds_weight(vq, ++recv_pkts, total_len)));
break;
}
out: out:
mutex_unlock(&vq->mutex); mutex_unlock(&vq->mutex);
} }
...@@ -720,7 +720,7 @@ static int vhost_net_open(struct inode *inode, struct file *f) ...@@ -720,7 +720,7 @@ static int vhost_net_open(struct inode *inode, struct file *f)
n->vqs[i].sock_hlen = 0; n->vqs[i].sock_hlen = 0;
} }
vhost_dev_init(dev, vqs, VHOST_NET_VQ_MAX, vhost_dev_init(dev, vqs, VHOST_NET_VQ_MAX,
VHOST_NET_WEIGHT, VHOST_NET_PKT_WEIGHT); VHOST_NET_PKT_WEIGHT, VHOST_NET_WEIGHT);
vhost_poll_init(n->poll + VHOST_NET_VQ_TX, handle_tx_net, POLLOUT, dev); vhost_poll_init(n->poll + VHOST_NET_VQ_TX, handle_tx_net, POLLOUT, dev);
vhost_poll_init(n->poll + VHOST_NET_VQ_RX, handle_rx_net, POLLIN, dev); vhost_poll_init(n->poll + VHOST_NET_VQ_RX, handle_rx_net, POLLIN, dev);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment