From nobody Thu Aug 25 17:32:01 2022 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4MD94y4kPLz4b34K; Thu, 25 Aug 2022 17:32:02 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4MD94x4QxWz3MVD; Thu, 25 Aug 2022 17:32:01 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1661448721; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ASP5Y86O1MxTbNIcvfJ7+lB0NK7YYCHmPwRShIaACKk=; b=buTtqOHvz71/YT1fR+8KnY19iBhgH70aYLbGuV9VNWzHXH7fiqMU/E1eFNOy2BzH0+ubnf MliMp8lgqLRrr4eYDASZwYt8TNEoI2jTgrKuIbx/vMquwsj0q/B2cEm/I9/PfM5peMle6D fFggqUECmzO/dU7Imk505iLc1y4rKnAEtOxtWxF5GtKmJyOkf/01aZgA+Q4hTC7RgUxwvW HpMB7+2nnCxWRwyQ/MEjnl4tnBT631qL1SvWtrFHr6J8oTq52PXXwmQVH+B3a/aFqwGGlV FWFkP7xZYYn4iKKxdMEp6lKQiE66YNeDs/P/szsosHpHhqk1MlccGW/ecWwWbA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4MD94x3T7tzwvS; Thu, 25 Aug 2022 17:32:01 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 27PHW1Ug045400; Thu, 25 Aug 2022 17:32:01 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 27PHW1r8045388; Thu, 25 Aug 2022 17:32:01 GMT (envelope-from git) Date: Thu, 25 Aug 2022 17:32:01 GMT Message-Id: <202208251732.27PHW1r8045388@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: John Baldwin Subject: git: 2d349fd22c97 - stable/12 - bhyve e1000: Skip packets with a small header. List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-branches@freebsd.org X-BeenThere: dev-commits-src-branches@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: jhb X-Git-Repository: src X-Git-Refname: refs/heads/stable/12 X-Git-Reftype: branch X-Git-Commit: 2d349fd22c97e34e5cf4e8e2ac9454d062fb7a61 Auto-Submitted: auto-generated ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1661448721; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ASP5Y86O1MxTbNIcvfJ7+lB0NK7YYCHmPwRShIaACKk=; b=MTl7gkr3R1/tC98rcsR6tKTm5lGWb1Qqtul6xAv4Zt9+VGjj16kDmvwxxvfxlNnxwMdISf kQySE/J4odO/O6NJbJKAF9OoVS5YZoM/YjNt5H9v8kPh0ANRwcLuppEbJe+tXZl+M+x/nE VBwm4qHmeV6ZDi8UxwG02FYb1En2xVAThJKIfekCHCU5j5QuoKp9HN87M1gcZYBnKSgVcY DQHRX5VKMjInDGuTzluLJmlslo/V20KcmqQ739eCJE8OIvj2/QFos9Iir1puEAL6KZTR6q dYGQ25QhJ/NaxuU3VCnxOxblI4t2kux/9dqTDvDyP3dfQCvRhmfujBxtUBer4g== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1661448721; a=rsa-sha256; cv=none; b=ULkxBRQrdgt/GfJSDTmGyKDDkT2XYD6W0KJgwRyi2IkScOTb5m9s+bnK5IcXEYh7RaH9jG z5BUcH1mnCcw7YfLKZ/d235MVfTHflbK5Onm+hI8VrigiHXk2JrM2B4jeTInlQJE2uqxeQ pw5qTxaSueDQTjq+pzTzMK0P+pcnWgKMowEVMfy5XAHnjyN7ZGQ9kS1Aqhh18EqqkEXVRN IfAAMPQOmzSEkTcW76hBktu8jJA2cwSl20l09IkLL2s6WLvJBFWwB0dfmlLQoEQYd8raTk GG3Fd9tAY+nqDP5cjRGsOPxgBTQ6adS9krrM9e+00cGBG3vN7A4N/WI5GAOyMQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N The branch stable/12 has been updated by jhb: URL: https://cgit.FreeBSD.org/src/commit/?id=2d349fd22c97e34e5cf4e8e2ac9454d062fb7a61 commit 2d349fd22c97e34e5cf4e8e2ac9454d062fb7a61 Author: John Baldwin AuthorDate: 2022-08-17 17:01:16 +0000 Commit: John Baldwin CommitDate: 2022-08-25 16:39:59 +0000 bhyve e1000: Skip packets with a small header. Certain operations such as checksum insertion and VLAN insertion require the device model to rewrite the packet header. The first step in rewriting the packet header is to copy the existing packet header from the source packet. This copy is done by copying data from an iovec array that corresponds to the S/G entries described by transmit descriptors. However, if the total packet length is smaller than the headers that need to be copied as the initial template, this copy can overflow the iovec array and use garbage values as the source pointer to memcpy. The PR used a single descriptor with a length of 0 in its PoC. To fix, track the total packet length and drop requests to transmit packets whose payload is smaller than the required header length. While here, fix another issue where the final descriptor could have an invalid length (too short) that could underflow 'len' when stripping the checksum. Skip those requests instead, too. PR: 264372 Reported by: Robert Morris Reviewed by: grehan, markj MFC after: 1 week Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D36182 (cherry picked from commit fa46f3704b7618f9d9493c126df781faf59040a8) --- usr.sbin/bhyve/pci_e82545.c | 41 +++++++++++++++++++++++++++++------------ 1 file changed, 29 insertions(+), 12 deletions(-) diff --git a/usr.sbin/bhyve/pci_e82545.c b/usr.sbin/bhyve/pci_e82545.c index aeef3f84ee5d..0b46ea5dced7 100644 --- a/usr.sbin/bhyve/pci_e82545.c +++ b/usr.sbin/bhyve/pci_e82545.c @@ -230,7 +230,7 @@ struct ck_info { * Debug printf */ static int e82545_debug = 0; -#define WPRINTF(msg,params...) PRINTLN("e82545: " msg, params) +#define WPRINTF(msg,params...) PRINTLN("e82545: " msg, ##params) #define DPRINTF(msg,params...) if (e82545_debug) WPRINTF(msg, params) #define MIN(a,b) (((a)<(b))?(a):(b)) @@ -1083,15 +1083,18 @@ e82545_transmit(struct e82545_softc *sc, uint16_t head, uint16_t tail, union e1000_tx_udesc *dsc; int desc, dtype, len, ntype, iovcnt, tcp, tso; int mss, paylen, seg, tiovcnt, left, now, nleft, nnow, pv, pvoff; - unsigned hdrlen, vlen; + unsigned hdrlen, vlen, pktlen; uint32_t tcpsum, tcpseq; uint16_t ipcs, tcpcs, ipid, ohead; + bool invalid; ckinfo[0].ck_valid = ckinfo[1].ck_valid = 0; iovcnt = 0; ntype = 0; tso = 0; + pktlen = 0; ohead = head; + invalid = false; /* iovb[0/1] may be used for writable copy of headers. */ iov = &iovb[2]; @@ -1141,17 +1144,23 @@ e82545_transmit(struct e82545_softc *sc, uint16_t head, uint16_t tail, len = (dtype == E1000_TXD_TYP_L) ? dsc->td.lower.flags.length : dsc->dd.lower.data & 0xFFFFF; - if (len > 0) { - /* Strip checksum supplied by guest. */ - if ((dsc->td.lower.data & E1000_TXD_CMD_EOP) != 0 && - (dsc->td.lower.data & E1000_TXD_CMD_IFCS) == 0) + /* Strip checksum supplied by guest. */ + if ((dsc->td.lower.data & E1000_TXD_CMD_EOP) != 0 && + (dsc->td.lower.data & E1000_TXD_CMD_IFCS) == 0) { + if (len <= 2) { + WPRINTF("final descriptor too short (%d) -- dropped", + len); + invalid = true; + } else len -= 2; - if (iovcnt < I82545_MAX_TXSEGS) { - iov[iovcnt].iov_base = paddr_guest2host( - sc->esc_ctx, dsc->td.buffer_addr, len); - iov[iovcnt].iov_len = len; - } + } + + if (len > 0 && iovcnt < I82545_MAX_TXSEGS) { + iov[iovcnt].iov_base = paddr_guest2host(sc->esc_ctx, + dsc->td.buffer_addr, len); + iov[iovcnt].iov_len = len; iovcnt++; + pktlen += len; } /* @@ -1199,6 +1208,9 @@ e82545_transmit(struct e82545_softc *sc, uint16_t head, uint16_t tail, } } + if (invalid) + goto done; + if (iovcnt > I82545_MAX_TXSEGS) { WPRINTF("tx too many descriptors (%d > %d) -- dropped", iovcnt, I82545_MAX_TXSEGS); @@ -1292,8 +1304,13 @@ e82545_transmit(struct e82545_softc *sc, uint16_t head, uint16_t tail, } } + if (pktlen < hdrlen + vlen) { + WPRINTF("packet too small for writable header"); + goto done; + } + /* Allocate, fill and prepend writable header vector. */ - if (hdrlen != 0) { + if (hdrlen + vlen != 0) { hdr = __builtin_alloca(hdrlen + vlen); hdr += vlen; for (left = hdrlen, hdrp = hdr; left > 0;