diff mbox series

[net,3/4] vhost: vsock: add weight support

Message ID 1557992862-27320-4-git-send-email-jasowang@redhat.com (mailing list archive)
State New, archived
Headers show
Series Prevent vhost kthread from hogging CPU | expand

Commit Message

Jason Wang May 16, 2019, 7:47 a.m. UTC 
This patch will check the weight and exit the loop if we exceeds the
weight. This is useful for preventing vsock kthread from hogging cpu
which is guest triggerable. The weight can help to avoid starving the
request from on direction while another direction is being processed.

The value of weight is picked from vhost-net.

This addresses CVE-2019-3900.

Cc: Stefan Hajnoczi <stefanha@redhat.com>
Fixes: 433fc58e6bf2 ("VSOCK: Introduce vhost_vsock.ko")
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 drivers/vhost/vsock.c | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

Comments

Stefan Hajnoczi May 16, 2019, 9:33 a.m. UTC | #1 
On Thu, May 16, 2019 at 03:47:41AM -0400, Jason Wang wrote:
> @@ -183,7 +184,8 @@ static struct vhost_vsock *vhost_vsock_get(u32 guest_cid)
>  		virtio_transport_deliver_tap_pkt(pkt);
>  
>  		virtio_transport_free_pkt(pkt);
> -	}
> +		total_len += pkt->len;

Please increment total_len before virtio_transport_free_pkt(pkt) to
avoid use-after-free.
Jason Wang May 17, 2019, 1:05 a.m. UTC | #2 
On 2019/5/16 下午5:33, Stefan Hajnoczi wrote:
> On Thu, May 16, 2019 at 03:47:41AM -0400, Jason Wang wrote:
>> @@ -183,7 +184,8 @@ static struct vhost_vsock *vhost_vsock_get(u32 guest_cid)
>>   		virtio_transport_deliver_tap_pkt(pkt);
>>   
>>   		virtio_transport_free_pkt(pkt);
>> -	}
>> +		total_len += pkt->len;
> Please increment total_len before virtio_transport_free_pkt(pkt) to
> avoid use-after-free.


Right, let me fix this.

Thanks
diff mbox series

Patch

diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c
index 47c6d4d..1fa9deb 100644
--- a/drivers/vhost/vsock.c
+++ b/drivers/vhost/vsock.c
@@ -86,6 +86,7 @@  static struct vhost_vsock *vhost_vsock_get(u32 guest_cid)
 			    struct vhost_virtqueue *vq)
 {
 	struct vhost_virtqueue *tx_vq = &vsock->vqs[VSOCK_VQ_TX];
+	int pkts = 0, total_len = 0;
 	bool added = false;
 	bool restart_tx = false;
 
@@ -97,7 +98,7 @@  static struct vhost_vsock *vhost_vsock_get(u32 guest_cid)
 	/* Avoid further vmexits, we're already processing the virtqueue */
 	vhost_disable_notify(&vsock->dev, vq);
 
-	for (;;) {
+	do {
 		struct virtio_vsock_pkt *pkt;
 		struct iov_iter iov_iter;
 		unsigned out, in;
@@ -183,7 +184,8 @@  static struct vhost_vsock *vhost_vsock_get(u32 guest_cid)
 		virtio_transport_deliver_tap_pkt(pkt);
 
 		virtio_transport_free_pkt(pkt);
-	}
+		total_len += pkt->len;
+	} while(likely(!vhost_exceeds_weight(vq, ++pkts, total_len)));
 	if (added)
 		vhost_signal(&vsock->dev, vq);
 
@@ -358,7 +360,7 @@  static void vhost_vsock_handle_tx_kick(struct vhost_work *work)
 	struct vhost_vsock *vsock = container_of(vq->dev, struct vhost_vsock,
 						 dev);
 	struct virtio_vsock_pkt *pkt;
-	int head;
+	int head, pkts = 0, total_len = 0;
 	unsigned int out, in;
 	bool added = false;
 
@@ -368,7 +370,7 @@  static void vhost_vsock_handle_tx_kick(struct vhost_work *work)
 		goto out;
 
 	vhost_disable_notify(&vsock->dev, vq);
-	for (;;) {
+	do {
 		u32 len;
 
 		if (!vhost_vsock_more_replies(vsock)) {
@@ -409,9 +411,11 @@  static void vhost_vsock_handle_tx_kick(struct vhost_work *work)
 		else
 			virtio_transport_free_pkt(pkt);
 
-		vhost_add_used(vq, head, sizeof(pkt->hdr) + len);
+		len += sizeof(pkt->hdr);
+		vhost_add_used(vq, head, len);
+		total_len += len;
 		added = true;
-	}
+	} while(likely(!vhost_exceeds_weight(vq, ++pkts, total_len)));
 
 no_more_replies:
 	if (added)