debian/patches/CVE-2015-7295-virtio-introduce-virtqueue_unmap_sg.patch

   1 From ce317461573bac12b10d67699b4ddf1f97cf066c Mon Sep 17 00:00:00 2001
   2 From: Jason Wang <jasowang@redhat.com>
   3 Date: Fri, 25 Sep 2015 13:21:28 +0800
   4 Subject: [PATCH 1/3] virtio: introduce virtqueue_unmap_sg()
   5
   6 Factor out sg unmapping logic. This will be reused by the patch that
   7 can discard descriptor.
   8
   9 Cc: Michael S. Tsirkin <mst@redhat.com>
  10 Cc: Andrew James <andrew.james@hpe.com>
  11 Signed-off-by: Jason Wang <jasowang@redhat.com>
  12 Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
  13 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
  14 ---
  15  hw/virtio/virtio.c | 14 ++++++++++----
  16  1 file changed, 10 insertions(+), 4 deletions(-)
  17
  18 diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
  19 index 7504f8b..6f2b96c 100644
  20 --- a/hw/virtio/virtio.c
  21 +++ b/hw/virtio/virtio.c
  22 @@ -244,14 +244,12 @@ int virtio_queue_empty(VirtQueue *vq)
  23      return vring_avail_idx(vq) == vq->last_avail_idx;
  24  }
  25
  26 -void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem,
  27 -                    unsigned int len, unsigned int idx)
  28 +static void virtqueue_unmap_sg(VirtQueue *vq, const VirtQueueElement *elem,
  29 +                               unsigned int len)
  30  {
  31      unsigned int offset;
  32      int i;
  33
  34 -    trace_virtqueue_fill(vq, elem, len, idx);
  35 -
  36      offset = 0;
  37      for (i = 0; i < elem->in_num; i++) {
  38          size_t size = MIN(len - offset, elem->in_sg[i].iov_len);
  39 @@ -267,6 +265,14 @@ void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem,
  40          cpu_physical_memory_unmap(elem->out_sg[i].iov_base,
  41                                    elem->out_sg[i].iov_len,
  42                                    0, elem->out_sg[i].iov_len);
  43 +}
  44 +
  45 +void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem,
  46 +                    unsigned int len, unsigned int idx)
  47 +{
  48 +    trace_virtqueue_fill(vq, elem, len, idx);
  49 +
  50 +    virtqueue_unmap_sg(vq, elem, len);
  51
  52      idx = (idx + vring_used_idx(vq)) % vq->vring.num;
  53
  54 --
  55 2.1.4
  56
  57 From 29b9f5efd78ae0f9cc02dd169b6e80d2c404bade Mon Sep 17 00:00:00 2001
  58 From: Jason Wang <jasowang@redhat.com>
  59 Date: Fri, 25 Sep 2015 13:21:29 +0800
  60 Subject: [PATCH 2/3] virtio: introduce virtqueue_discard()
  61
  62 This patch introduces virtqueue_discard() to discard a descriptor and
  63 unmap the sgs. This will be used by the patch that will discard
  64 descriptor when packet is truncated.
  65
  66 Cc: Michael S. Tsirkin <mst@redhat.com>
  67 Signed-off-by: Jason Wang <jasowang@redhat.com>
  68 Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
  69 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
  70 ---
  71  hw/virtio/virtio.c         | 7 +++++++
  72  include/hw/virtio/virtio.h | 2 ++
  73  2 files changed, 9 insertions(+)
  74
  75 diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
  76 index 6f2b96c..d0bc72e 100644
  77 --- a/hw/virtio/virtio.c
  78 +++ b/hw/virtio/virtio.c
  79 @@ -267,6 +267,13 @@ static void virtqueue_unmap_sg(VirtQueue *vq, const VirtQueueElement *elem,
  80                                    0, elem->out_sg[i].iov_len);
  81  }
  82
  83 +void virtqueue_discard(VirtQueue *vq, const VirtQueueElement *elem,
  84 +                       unsigned int len)
  85 +{
  86 +    vq->last_avail_idx--;
  87 +    virtqueue_unmap_sg(vq, elem, len);
  88 +}
  89 +
  90  void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem,
  91                      unsigned int len, unsigned int idx)
  92  {
  93 diff --git a/include/hw/virtio/virtio.h b/include/hw/virtio/virtio.h
  94 index 6201ee8..9d09115 100644
  95 --- a/include/hw/virtio/virtio.h
  96 +++ b/include/hw/virtio/virtio.h
  97 @@ -146,6 +146,8 @@ void virtio_del_queue(VirtIODevice *vdev, int n);
  98  void virtqueue_push(VirtQueue *vq, const VirtQueueElement *elem,
  99                      unsigned int len);
 100  void virtqueue_flush(VirtQueue *vq, unsigned int count);
 101 +void virtqueue_discard(VirtQueue *vq, const VirtQueueElement *elem,
 102 +                       unsigned int len);
 103  void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem,
 104                      unsigned int len, unsigned int idx);
 105
 106 --
 107 2.1.4
 108
 109 From 0cf33fb6b49a19de32859e2cdc6021334f448fb3 Mon Sep 17 00:00:00 2001
 110 From: Jason Wang <jasowang@redhat.com>
 111 Date: Fri, 25 Sep 2015 13:21:30 +0800
 112 Subject: [PATCH 3/3] virtio-net: correctly drop truncated packets
 113
 114 When packet is truncated during receiving, we drop the packets but
 115 neither discard the descriptor nor add and signal used
 116 descriptor. This will lead several issues:
 117
 118 - sg mappings are leaked
 119 - rx will be stalled if a lots of packets were truncated
 120
 121 In order to be consistent with vhost, fix by discarding the descriptor
 122 in this case.
 123
 124 Cc: Michael S. Tsirkin <mst@redhat.com>
 125 Signed-off-by: Jason Wang <jasowang@redhat.com>
 126 Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
 127 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 128 ---
 129  hw/net/virtio-net.c | 8 +-------
 130  1 file changed, 1 insertion(+), 7 deletions(-)
 131
 132 diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
 133 index d388c55..a877614 100644
 134 --- a/hw/net/virtio-net.c
 135 +++ b/hw/net/virtio-net.c
 136 @@ -1094,13 +1094,7 @@ static ssize_t virtio_net_receive(NetClientState *nc, const uint8_t *buf, size_t
 137           * must have consumed the complete packet.
 138           * Otherwise, drop it. */
 139          if (!n->mergeable_rx_bufs && offset < size) {
 140 -#if 0
 141 -            error_report("virtio-net truncated non-mergeable packet: "
 142 -                         "i %zd mergeable %d offset %zd, size %zd, "
 143 -                         "guest hdr len %zd, host hdr len %zd",
 144 -                         i, n->mergeable_rx_bufs,
 145 -                         offset, size, n->guest_hdr_len, n->host_hdr_len);
 146 -#endif
 147 +            virtqueue_discard(q->rx_vq, &elem, total);
 148              return size;
 149          }
 150
 151 --
 152 2.1.4
 153