[dpdk-dev] net/virtio: do not gso when no header is present
Checks
Commit Message
Found with clang static analysis:
lib/librte_vhost/virtio_net.c:723:17: warning:
Access to field 'data_off' results in a dereference of a null pointer
(loaded from variable 'tcp_hdr')
m->l4_len = (tcp_hdr->data_off & 0xf0) >> 2;
^~~~~~~~~~~~~~~~~
Fixes: 2a51b1091cb5 ("vhost: support indirect descriptor in non-mergeable Rx")
Signed-off-by: Emmanuel Roullit <emmanuel.roullit@gmail.com>
---
lib/librte_vhost/virtio_net.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
Comments
On Tue, Jan 24, 2017 at 09:36:03PM +0100, Emmanuel Roullit wrote:
> Found with clang static analysis:
> lib/librte_vhost/virtio_net.c:723:17: warning:
> Access to field 'data_off' results in a dereference of a null pointer
> (loaded from variable 'tcp_hdr')
> m->l4_len = (tcp_hdr->data_off & 0xf0) >> 2;
> ^~~~~~~~~~~~~~~~~
This is a good fix, thanks. But there are few minor nits. Firstly,
prefix is wrong: it should be "vhost" but not "net/virtio".
> Fixes: 2a51b1091cb5 ("vhost: support indirect descriptor in non-mergeable Rx")
That's not the original commit introduced such issue, d0cf91303d73
("vhost: add Tx offload capabilities") is.
I actually saw you have made this kind of mistakes (referencing the
wrong culprit commit) few times. I'm wondering how did you get that.
Besides those, I think it's a good candidate for a stable release:
thinking that a malicious guest might forge some invalid virtio net
headers, which would make this potential NULL dereference become real.
So, Cc: stable@dpdk.org,
And Applied to dpdk-next-virtio.
--yliu
@@ -677,6 +677,7 @@ parse_ethernet(struct rte_mbuf *m, uint16_t *l4_proto, void **l4_hdr)
default:
m->l3_len = 0;
*l4_proto = 0;
+ *l4_hdr = NULL;
break;
}
}
@@ -713,7 +714,7 @@ vhost_dequeue_offload(struct virtio_net_hdr *hdr, struct rte_mbuf *m)
}
}
- if (hdr->gso_type != VIRTIO_NET_HDR_GSO_NONE) {
+ if (l4_hdr && hdr->gso_type != VIRTIO_NET_HDR_GSO_NONE) {
switch (hdr->gso_type & ~VIRTIO_NET_HDR_GSO_ECN) {
case VIRTIO_NET_HDR_GSO_TCPV4:
case VIRTIO_NET_HDR_GSO_TCPV6: