[PATCH 1/1] vhost: fix a double fetch when dequeue offloading

[David Marchand]

On Thu, Dec 19, 2024 at 7:38 AM Yunjian Wang <wangyunjian at huawei.com> wrote:
>
> The hdr->csum_start does two successive reads from user space to read a
> variable length data structure. The result overflow if the data structure
> changes between the two reads.
>
> To fix this, we can prevent double fetch issue by copying virtio_hdr to
> the temporary variable.
>
> Fixes: 4dc4e33ffa10 ("net/virtio: fix Rx checksum calculation")
> Cc: stable at dpdk.org
>
> Signed-off-by: Yunjian Wang <wangyunjian at huawei.com>
> ---
>  lib/vhost/virtio_net.c | 13 ++++++++-----
>  1 file changed, 8 insertions(+), 5 deletions(-)
>
> diff --git a/lib/vhost/virtio_net.c b/lib/vhost/virtio_net.c
> index 69901ab3b5..5c40ae7069 100644
> --- a/lib/vhost/virtio_net.c
> +++ b/lib/vhost/virtio_net.c
> @@ -2914,10 +2914,12 @@ desc_to_mbuf(struct virtio_net *dev, struct vhost_virtqueue *vq,
>                          * in a contiguous virtual area.
>                          */
>                         copy_vnet_hdr_from_desc(&tmp_hdr, buf_vec);
> -                       hdr = &tmp_hdr;
>                 } else {
> -                       hdr = (struct virtio_net_hdr *)((uintptr_t)buf_vec[0].buf_addr);
> +                       rte_memcpy((void *)(uintptr_t)&tmp_hdr,
> +                               (void *)(uintptr_t)buf_vec[0].buf_addr,
> +                               sizeof(struct virtio_net_hdr));
>                 }
> +               hdr = &tmp_hdr;
>         }

This will need some benchmark, as I remember putting rte_memcpy in
inlined helpers had some performance impact.

Instead, I would call copy_vnet_hdr_from_desc unconditionnally, and
store in a struct virtio_net_hdr hdr variable (+ a has_vnet_hdr
boolean to indicate validity).
Something like:
        if (virtio_net_with_host_offload(dev)) {
-               if (unlikely(buf_vec[0].buf_len < sizeof(struct
virtio_net_hdr))) {
-                       /*
-                        * No luck, the virtio-net header doesn't fit
-                        * in a contiguous virtual area.
-                        */
-                       copy_vnet_hdr_from_desc(&tmp_hdr, buf_vec);
-                       hdr = &tmp_hdr;
-               } else {
-                       hdr = (struct virtio_net_hdr
*)((uintptr_t)buf_vec[0].buf_addr);
-               }
+               copy_vnet_hdr_from_desc(&hdr, buf_vec);
+               has_vnet_hdr = true;
        }

(besides, in copy_vnet_hdr_from_desc, the while (cond) {} loop could
be changed to do a do {} while (cond), and that approach requires
performance numbers too)


>
>         for (vec_idx = 0; vec_idx < nr_vec; vec_idx++) {
> @@ -3363,7 +3365,7 @@ virtio_dev_tx_batch_packed(struct virtio_net *dev,
>  {
>         uint16_t avail_idx = vq->last_avail_idx;
>         uint32_t buf_offset = sizeof(struct virtio_net_hdr_mrg_rxbuf);
> -       struct virtio_net_hdr *hdr;
> +       struct virtio_net_hdr hdr;
>         uintptr_t desc_addrs[PACKED_BATCH_SIZE];
>         uint16_t ids[PACKED_BATCH_SIZE];
>         uint16_t i;
> @@ -3382,8 +3384,9 @@ virtio_dev_tx_batch_packed(struct virtio_net *dev,
>
>         if (virtio_net_with_host_offload(dev)) {
>                 vhost_for_each_try_unroll(i, 0, PACKED_BATCH_SIZE) {
> -                       hdr = (struct virtio_net_hdr *)(desc_addrs[i]);
> -                       vhost_dequeue_offload(dev, hdr, pkts[i], legacy_ol_flags);
> +                       rte_memcpy((void *)(uintptr_t)&hdr,
> +                               (void *)(uintptr_t)desc_addrs[i], sizeof(struct virtio_net_hdr));
> +                       vhost_dequeue_offload(dev, &hdr, pkts[i], legacy_ol_flags);
>                 }
>         }

Here too, there may be an impact with adding rte_memcpy.
Just do a copy like:

        if (virtio_net_with_host_offload(dev)) {
+               struct virtio_net_hdr hdr;
+
                vhost_for_each_try_unroll(i, 0, PACKED_BATCH_SIZE) {
-                       hdr = (struct virtio_net_hdr *)(desc_addrs[i]);
-                       vhost_dequeue_offload(dev, hdr, pkts[i],
legacy_ol_flags);
+                       hdr = *(struct virtio_net_hdr *)(desc_addrs[i]);
+                       vhost_dequeue_offload(dev, &hdr, pkts[i],
legacy_ol_flags);
                }


-- 
David Marchand