net/virtio-user: fix overflow

virtio-user limits the qeueue number to 8 but provides no limit
check against the queue number input from user. If a bigger queue
number (> 8) is given, there is an overflow issue. Doing a sanity
check could avoid it.

Fixes: 37a7eb2ae816 ("net/virtio-user: add device emulation layer")
Cc: stable@dpdk.org
Signed-off-by: Wenfeng Liu <liuwf@arraynetworks.com.cn>
Acked-by: Yuanhan Liu <yuanhan.liu@linux.intel.com>

diff --git a/drivers/net/virtio/virtio_pci.h b/drivers/net/virtio/virtio_pci.h
index 59e45c4d33df3579676b6654ef5ba3020d840b62..1302556ebc6057ff81582a138b8ac9224b4b13d8 100644 (file)
--- a/drivers/net/virtio/virtio_pci.h
+++ b/drivers/net/virtio/virtio_pci.h
@@ -160,7 +160,8 @@ struct virtnet_ctl;
 /*
  * Maximum number of virtqueues per device.
  */
-#define VIRTIO_MAX_VIRTQUEUES 8
+#define VIRTIO_MAX_VIRTQUEUE_PAIRS 8
+#define VIRTIO_MAX_VIRTQUEUES (VIRTIO_MAX_VIRTQUEUE_PAIRS * 2 + 1)
 
 /* Common configuration */
 #define VIRTIO_PCI_CAP_COMMON_CFG      1

diff --git a/drivers/net/virtio/virtio_user/virtio_user_dev.c b/drivers/net/virtio/virtio_user/virtio_user_dev.c
index 21ed00d719dbf9aeca5a4e1386f9d84633ea32f5..9dcdac89617d257fb9c856f11571c517ebc150d5 100644 (file)
--- a/drivers/net/virtio/virtio_user/virtio_user_dev.c
+++ b/drivers/net/virtio/virtio_user/virtio_user_dev.c
@@ -237,7 +237,7 @@ virtio_user_dev_setup(struct virtio_user_dev *dev)
        uint32_t i, q;
 
        dev->vhostfd = -1;
-       for (i = 0; i < VIRTIO_MAX_VIRTQUEUES * 2 + 1; ++i) {
+       for (i = 0; i < VIRTIO_MAX_VIRTQUEUES; ++i) {
                dev->kickfds[i] = -1;
                dev->callfds[i] = -1;
        }

diff --git a/drivers/net/virtio/virtio_user/virtio_user_dev.h b/drivers/net/virtio/virtio_user/virtio_user_dev.h
index 0d39f40cc6a17a41a1aa1b56272637ca4b39ceb9..bd2e4ca719a44fb7e7aa895ff7d0fe43b7e1e6de 100644 (file)
--- a/drivers/net/virtio/virtio_user/virtio_user_dev.h
+++ b/drivers/net/virtio/virtio_user/virtio_user_dev.h
@@ -49,8 +49,8 @@ struct virtio_user_dev {
        int             *tapfds;
 
        /* for both vhost_user and vhost_kernel */
-       int             callfds[VIRTIO_MAX_VIRTQUEUES * 2 + 1];
-       int             kickfds[VIRTIO_MAX_VIRTQUEUES * 2 + 1];
+       int             callfds[VIRTIO_MAX_VIRTQUEUES];
+       int             kickfds[VIRTIO_MAX_VIRTQUEUES];
        int             mac_specified;
        uint32_t        max_queue_pairs;
        uint32_t        queue_pairs;
@@ -62,7 +62,7 @@ struct virtio_user_dev {
        uint8_t         status;
        uint8_t         mac_addr[ETHER_ADDR_LEN];
        char            path[PATH_MAX];
-       struct vring    vrings[VIRTIO_MAX_VIRTQUEUES * 2 + 1];
+       struct vring    vrings[VIRTIO_MAX_VIRTQUEUES];
        struct virtio_user_backend_ops *ops;
 };
 

diff --git a/drivers/net/virtio/virtio_user_ethdev.c b/drivers/net/virtio/virtio_user_ethdev.c
index 0b226ac7ce72715d5f4cdde21a948284d7fac209..7528a168aa71535c281e04077c866f43b3725a6e 100644 (file)
--- a/drivers/net/virtio/virtio_user_ethdev.c
+++ b/drivers/net/virtio/virtio_user_ethdev.c
@@ -418,6 +418,13 @@ virtio_user_pmd_probe(const char *name, const char *params)
                goto end;
        }
 
+       if (queues > VIRTIO_MAX_VIRTQUEUE_PAIRS) {
+               PMD_INIT_LOG(ERR, "arg %s %" PRIu64 " exceeds the limit %u",
+                       VIRTIO_USER_ARG_QUEUES_NUM, queues,
+                       VIRTIO_MAX_VIRTQUEUE_PAIRS);
+               goto end;
+       }
+
        eth_dev = virtio_user_eth_dev_alloc(name);
        if (!eth_dev) {
                PMD_INIT_LOG(ERR, "virtio_user fails to alloc device");