| Message ID | 20240115194840.1183077-1-andrew@daynix.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [1/1] vhost: Added pad cleanup if vnet_hdr is not present. | expand |
See also https://issues.redhat.com/browse/RHEL-1303 On Mon, Jan 15, 2024 at 9:48 PM Andrew Melnychenko <andrew@daynix.com> wrote: > > When the Qemu launched with vhost but without tap vnet_hdr, > vhost tries to copy vnet_hdr from socket iter with size 0 > to the page that may contain some trash. > That trash can be interpreted as unpredictable values for > vnet_hdr. > That leads to dropping some packets and in some cases to > stalling vhost routine when the vhost_net tries to process > packets and fails in a loop. > > Qemu options: > -netdev tap,vhost=on,vnet_hdr=off,... > > Signed-off-by: Andrew Melnychenko <andrew@daynix.com> > --- > drivers/vhost/net.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c > index f2ed7167c848..57411ac2d08b 100644 > --- a/drivers/vhost/net.c > +++ b/drivers/vhost/net.c > @@ -735,6 +735,9 @@ static int vhost_net_build_xdp(struct vhost_net_virtqueue *nvq, > hdr = buf; > gso = &hdr->gso; > > + if (!sock_hlen) > + memset(buf, 0, pad); > + > if ((gso->flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) && > vhost16_to_cpu(vq, gso->csum_start) + > vhost16_to_cpu(vq, gso->csum_offset) + 2 > > -- > 2.43.0 >
On Mon, Jan 15, 2024 at 09:48:40PM +0200, Andrew Melnychenko wrote: > When the Qemu launched with vhost but without tap vnet_hdr, > vhost tries to copy vnet_hdr from socket iter with size 0 > to the page that may contain some trash. > That trash can be interpreted as unpredictable values for > vnet_hdr. > That leads to dropping some packets and in some cases to > stalling vhost routine when the vhost_net tries to process > packets and fails in a loop. > > Qemu options: > -netdev tap,vhost=on,vnet_hdr=off,... > > Signed-off-by: Andrew Melnychenko <andrew@daynix.com> > --- > drivers/vhost/net.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c > index f2ed7167c848..57411ac2d08b 100644 > --- a/drivers/vhost/net.c > +++ b/drivers/vhost/net.c > @@ -735,6 +735,9 @@ static int vhost_net_build_xdp(struct vhost_net_virtqueue *nvq, > hdr = buf; > gso = &hdr->gso; > > + if (!sock_hlen) > + memset(buf, 0, pad); > + > if ((gso->flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) && > vhost16_to_cpu(vq, gso->csum_start) + > vhost16_to_cpu(vq, gso->csum_offset) + 2 > Hmm need to analyse it to make sure there are no cases where we leak some data to guest here in case where sock_hlen is set ... > -- > 2.43.0
Just polite ping On Tue, Jan 16, 2024 at 12:32 AM Michael S. Tsirkin <mst@redhat.com> wrote: > > On Mon, Jan 15, 2024 at 09:48:40PM +0200, Andrew Melnychenko wrote: > > When the Qemu launched with vhost but without tap vnet_hdr, > > vhost tries to copy vnet_hdr from socket iter with size 0 > > to the page that may contain some trash. > > That trash can be interpreted as unpredictable values for > > vnet_hdr. > > That leads to dropping some packets and in some cases to > > stalling vhost routine when the vhost_net tries to process > > packets and fails in a loop. > > > > Qemu options: > > -netdev tap,vhost=on,vnet_hdr=off,... > > > > Signed-off-by: Andrew Melnychenko <andrew@daynix.com> > > --- > > drivers/vhost/net.c | 3 +++ > > 1 file changed, 3 insertions(+) > > > > diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c > > index f2ed7167c848..57411ac2d08b 100644 > > --- a/drivers/vhost/net.c > > +++ b/drivers/vhost/net.c > > @@ -735,6 +735,9 @@ static int vhost_net_build_xdp(struct vhost_net_virtqueue *nvq, > > hdr = buf; > > gso = &hdr->gso; > > > > + if (!sock_hlen) > > + memset(buf, 0, pad); > > + > > if ((gso->flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) && > > vhost16_to_cpu(vq, gso->csum_start) + > > vhost16_to_cpu(vq, gso->csum_offset) + 2 > > > > Hmm need to analyse it to make sure there are no cases where we leak > some data to guest here in case where sock_hlen is set ... > > -- > > 2.43.0 >
On Mon, Jan 15, 2024 at 05:32:25PM -0500, Michael S. Tsirkin wrote: > On Mon, Jan 15, 2024 at 09:48:40PM +0200, Andrew Melnychenko wrote: > > When the Qemu launched with vhost but without tap vnet_hdr, > > vhost tries to copy vnet_hdr from socket iter with size 0 > > to the page that may contain some trash. > > That trash can be interpreted as unpredictable values for > > vnet_hdr. > > That leads to dropping some packets and in some cases to > > stalling vhost routine when the vhost_net tries to process > > packets and fails in a loop. > > > > Qemu options: > > -netdev tap,vhost=on,vnet_hdr=off,... > > > > Signed-off-by: Andrew Melnychenko <andrew@daynix.com> > > --- > > drivers/vhost/net.c | 3 +++ > > 1 file changed, 3 insertions(+) > > > > diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c > > index f2ed7167c848..57411ac2d08b 100644 > > --- a/drivers/vhost/net.c > > +++ b/drivers/vhost/net.c > > @@ -735,6 +735,9 @@ static int vhost_net_build_xdp(struct vhost_net_virtqueue *nvq, > > hdr = buf; > > gso = &hdr->gso; > > > > + if (!sock_hlen) > > + memset(buf, 0, pad); > > + > > if ((gso->flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) && > > vhost16_to_cpu(vq, gso->csum_start) + > > vhost16_to_cpu(vq, gso->csum_offset) + 2 > > > > Hmm need to analyse it to make sure there are no cases where we leak > some data to guest here in case where sock_hlen is set ... Could you post this analysis pls? > > -- > > 2.43.0
Hi all, Ok, let me prepare a new patch v2, where I'll write a description/analysis of the issue in the commit message. On Thu, Feb 22, 2024 at 10:02 PM Michael S. Tsirkin <mst@redhat.com> wrote: > > On Mon, Jan 15, 2024 at 05:32:25PM -0500, Michael S. Tsirkin wrote: > > On Mon, Jan 15, 2024 at 09:48:40PM +0200, Andrew Melnychenko wrote: > > > When the Qemu launched with vhost but without tap vnet_hdr, > > > vhost tries to copy vnet_hdr from socket iter with size 0 > > > to the page that may contain some trash. > > > That trash can be interpreted as unpredictable values for > > > vnet_hdr. > > > That leads to dropping some packets and in some cases to > > > stalling vhost routine when the vhost_net tries to process > > > packets and fails in a loop. > > > > > > Qemu options: > > > -netdev tap,vhost=on,vnet_hdr=off,... > > > > > > Signed-off-by: Andrew Melnychenko <andrew@daynix.com> > > > --- > > > drivers/vhost/net.c | 3 +++ > > > 1 file changed, 3 insertions(+) > > > > > > diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c > > > index f2ed7167c848..57411ac2d08b 100644 > > > --- a/drivers/vhost/net.c > > > +++ b/drivers/vhost/net.c > > > @@ -735,6 +735,9 @@ static int vhost_net_build_xdp(struct vhost_net_virtqueue *nvq, > > > hdr = buf; > > > gso = &hdr->gso; > > > > > > + if (!sock_hlen) > > > + memset(buf, 0, pad); > > > + > > > if ((gso->flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) && > > > vhost16_to_cpu(vq, gso->csum_start) + > > > vhost16_to_cpu(vq, gso->csum_offset) + 2 > > > > > > > Hmm need to analyse it to make sure there are no cases where we leak > > some data to guest here in case where sock_hlen is set ... > > > Could you post this analysis pls? > > > > -- > > > 2.43.0 >
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c index f2ed7167c848..57411ac2d08b 100644 --- a/drivers/vhost/net.c +++ b/drivers/vhost/net.c @@ -735,6 +735,9 @@ static int vhost_net_build_xdp(struct vhost_net_virtqueue *nvq, hdr = buf; gso = &hdr->gso; + if (!sock_hlen) + memset(buf, 0, pad); + if ((gso->flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) && vhost16_to_cpu(vq, gso->csum_start) + vhost16_to_cpu(vq, gso->csum_offset) + 2 >
When the Qemu launched with vhost but without tap vnet_hdr, vhost tries to copy vnet_hdr from socket iter with size 0 to the page that may contain some trash. That trash can be interpreted as unpredictable values for vnet_hdr. That leads to dropping some packets and in some cases to stalling vhost routine when the vhost_net tries to process packets and fails in a loop. Qemu options: -netdev tap,vhost=on,vnet_hdr=off,... Signed-off-by: Andrew Melnychenko <andrew@daynix.com> --- drivers/vhost/net.c | 3 +++ 1 file changed, 3 insertions(+)