[PATCH] vhost: fix null dereference in async packed dequeue

[Anton Vanda]

In the batch path of the asynchronous packed ring dequeue, the address
of the virtio net header is obtained from vhost_iova_to_vva(), which
returns 0 when a guest-provided descriptor address cannot be fully
translated.  The batch check only validates that the descriptor address
is non-zero and that the length is consistent. A malicious or buggy
guest could therefore trigger a NULL pointer dereference and crash the
vhost application (denial of service).

Check the translation result and leave the batch fast path with an error
on failure, so the single-packet path handles the invalid descriptor, as
is already done for the non-batch async dequeue path.

Perform the header translation before the DMA iovec setup so that the
early return cannot leave the async iterator state partially updated.

Fixes: c2fa52bf1e5d ("vhost: add batch dequeue in async vhost packed ring")
Cc: stable at dpdk.org

Signed-off-by: Anton Vanda <avanda at ptsecurity.com>
---
 .mailmap               |  1 +
 lib/vhost/virtio_net.c | 26 +++++++++++++++++---------
 2 files changed, 18 insertions(+), 9 deletions(-)

diff --git a/.mailmap b/.mailmap
index 05a55c0bd6..9215581a29 100644
--- a/.mailmap
+++ b/.mailmap
@@ -141,6 +141,7 @@ Antara Ganesh Kolar <antara.ganesh.kolar at intel.com>
 Anthony Fee <anthonyx.fee at intel.com>
 Anthony Harivel <aharivel at redhat.com>
 Antonio Fischetti <antonio.fischetti at intel.com>
+Anton Vanda <avanda at ptsecurity.com>
 Anup Prabhu <aprabhu at marvell.com>
 Anupam Kapoor <anupam.kapoor at gmail.com>
 Anurag Mandal <anurag.mandal at intel.com>
diff --git a/lib/vhost/virtio_net.c b/lib/vhost/virtio_net.c
index 0658b81de5..6528c06ea4 100644
--- a/lib/vhost/virtio_net.c
+++ b/lib/vhost/virtio_net.c
@@ -4039,6 +4039,23 @@ virtio_dev_tx_async_packed_batch(struct virtio_net *dev,
 	vhost_for_each_try_unroll(i, 0, PACKED_BATCH_SIZE)
 		rte_prefetch0((void *)(uintptr_t)desc_addrs[i]);
 
+	if (virtio_net_with_host_offload(dev)) {
+		vhost_for_each_try_unroll(i, 0, PACKED_BATCH_SIZE) {
+			desc_vva = vhost_iova_to_vva(dev, vq, desc_addrs[i],
+						&lens[i], VHOST_ACCESS_RO);
+			/*
+			 * A malformed or unmapped guest descriptor makes the
+			 * IOVA translation fail (returns 0). Bail out of the
+			 * batch fast path so the single-packet path handles the
+			 * error, instead of dereferencing a NULL header.
+			 */
+			if (unlikely(!desc_vva))
+				return -1;
+			hdr = (struct virtio_net_hdr *)(uintptr_t)desc_vva;
+			pkts_info[slot_idx + i].nethdr = *hdr;
+		}
+	}
+
 	vhost_for_each_try_unroll(i, 0, PACKED_BATCH_SIZE) {
 		host_iova[i] = (void *)(uintptr_t)gpa_to_first_hpa(dev,
 			desc_addrs[i] + buf_offset, pkts[i]->pkt_len, &mapped_len[i]);
@@ -4053,15 +4070,6 @@ virtio_dev_tx_async_packed_batch(struct virtio_net *dev,
 		async->iter_idx++;
 	}
 
-	if (virtio_net_with_host_offload(dev)) {
-		vhost_for_each_try_unroll(i, 0, PACKED_BATCH_SIZE) {
-			desc_vva = vhost_iova_to_vva(dev, vq, desc_addrs[i],
-						&lens[i], VHOST_ACCESS_RO);
-			hdr = (struct virtio_net_hdr *)(uintptr_t)desc_vva;
-			pkts_info[slot_idx + i].nethdr = *hdr;
-		}
-	}
-
 	vq_inc_last_avail_packed(vq, PACKED_BATCH_SIZE);
 
 	vhost_async_shadow_dequeue_packed_batch(vq, ids);
-- 
2.51.0