Messages in this thread | | | Date | Mon, 18 Jan 2021 12:27:56 +0100 | From | Stefano Garzarella <> | Subject | Re: [PATCH] VMCI: Enforce queuepair max size for IOCTL_VMCI_QUEUEPAIR_ALLOC |
| |
+Cc: Norbert Slusarek <nslusarek@gmx.net>
On Mon, Jan 11, 2021 at 04:18:53AM -0800, Jorgen Hansen wrote: >When create the VMCI queue pair tracking data structures on the host >side, the IOCTL for creating the VMCI queue pair didn't validate >the queue pair size parameters. This change adds checks for this. > >This avoids a memory allocation issue in qp_host_alloc_queue, as >reported by nslusarek@gmx.net. The check in qp_host_alloc_queue >has also been updated to enforce the maximum queue pair size >as defined by VMCI_MAX_GUEST_QP_MEMORY. > >The fix has been verified using sample code supplied by >nslusarek@gmx.net. > >Reported-by: nslusarek@gmx.net >Reviewed-by: Vishnu Dasa <vdasa@vmware.com> >Signed-off-by: Jorgen Hansen <jhansen@vmware.com> >--- > drivers/misc/vmw_vmci/vmci_queue_pair.c | 12 ++++++++---- > include/linux/vmw_vmci_defs.h | 4 ++-- > 2 files changed, 10 insertions(+), 6 deletions(-) > >diff --git a/drivers/misc/vmw_vmci/vmci_queue_pair.c b/drivers/misc/vmw_vmci/vmci_queue_pair.c >index 525ef96..39d2f191 100644 >--- a/drivers/misc/vmw_vmci/vmci_queue_pair.c >+++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c >@@ -237,7 +237,9 @@ static struct qp_list qp_guest_endpoints = { > #define QPE_NUM_PAGES(_QPE) ((u32) \ > (DIV_ROUND_UP(_QPE.produce_size, PAGE_SIZE) + \ > DIV_ROUND_UP(_QPE.consume_size, PAGE_SIZE) + 2)) >- >+#define QP_SIZES_ARE_VALID(_prod_qsize, _cons_qsize) \ >+ ((_prod_qsize) + (_cons_qsize) >= max(_prod_qsize, _cons_qsize) && \ >+ (_prod_qsize) + (_cons_qsize) <= VMCI_MAX_GUEST_QP_MEMORY) > > /* > * Frees kernel VA space for a given queue and its queue header, and >@@ -528,7 +530,7 @@ static struct vmci_queue *qp_host_alloc_queue(u64 size) > u64 num_pages; > const size_t queue_size = sizeof(*queue) + sizeof(*(queue->kernel_if)); > >- if (size > SIZE_MAX - PAGE_SIZE) >+ if (size > min(VMCI_MAX_GUEST_QP_MEMORY, SIZE_MAX - PAGE_SIZE)) > return NULL; > num_pages = DIV_ROUND_UP(size, PAGE_SIZE) + 1; > if (num_pages > (SIZE_MAX - queue_size) / >@@ -1929,6 +1931,9 @@ int vmci_qp_broker_alloc(struct vmci_handle handle, > struct vmci_qp_page_store *page_store, > struct vmci_ctx *context) > { >+ if (!QP_SIZES_ARE_VALID(produce_size, consume_size)) >+ return VMCI_ERROR_NO_RESOURCES; >+ > return qp_broker_alloc(handle, peer, flags, priv_flags, > produce_size, consume_size, > page_store, context, NULL, NULL, NULL, NULL); >@@ -2685,8 +2690,7 @@ int vmci_qpair_alloc(struct vmci_qp **qpair, > * used by the device is NO_RESOURCES, so use that here too. > */ > >- if (produce_qsize + consume_qsize < max(produce_qsize, consume_qsize) || >- produce_qsize + consume_qsize > VMCI_MAX_GUEST_QP_MEMORY) >+ if (!QP_SIZES_ARE_VALID(produce_qsize, consume_qsize)) > return VMCI_ERROR_NO_RESOURCES; > > retval = vmci_route(&src, &dst, false, &route); >diff --git a/include/linux/vmw_vmci_defs.h b/include/linux/vmw_vmci_defs.h >index be0afe6..e36cb11 100644 >--- a/include/linux/vmw_vmci_defs.h >+++ b/include/linux/vmw_vmci_defs.h >@@ -66,7 +66,7 @@ enum { > * consists of at least two pages, the memory limit also dictates the > * number of queue pairs a guest can create. > */ >-#define VMCI_MAX_GUEST_QP_MEMORY (128 * 1024 * 1024) >+#define VMCI_MAX_GUEST_QP_MEMORY ((size_t)(128 * 1024 * 1024)) > #define VMCI_MAX_GUEST_QP_COUNT (VMCI_MAX_GUEST_QP_MEMORY / PAGE_SIZE / 2) > > /* >@@ -80,7 +80,7 @@ enum { > * too much kernel memory (especially on vmkernel). We limit a queuepair to > * 32 KB, or 16 KB per queue for symmetrical pairs. > */ >-#define VMCI_MAX_PINNED_QP_MEMORY (32 * 1024) >+#define VMCI_MAX_PINNED_QP_MEMORY ((size_t)(32 * 1024)) > > /* > * We have a fixed set of resource IDs available in the VMX. >-- >2.6.2 > >_______________________________________________ >Virtualization mailing list >Virtualization@lists.linux-foundation.org >https://lists.linuxfoundation.org/mailman/listinfo/virtualization >
| |