Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Alvaro Karsz <alvaro.karsz@solid-run.com>
To:     mst@redhat.com, jasowang@redhat.com
Cc:     davem@davemloft.net, edumazet@google.com, kuba@kernel.org,
        pabeni@redhat.com, virtualization@lists.linux-foundation.org,
        netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
        Alvaro Karsz <alvaro.karsz@solid-run.com>
Subject: [PATCH net] virtio-net: reject small vring sizes
Date:   Sun, 16 Apr 2023 10:46:07 +0300
Message-Id: <20230416074607.292616-1-alvaro.karsz@solid-run.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?sChBIsXmL16FRWXflpLaD+ZnqN4Ebgw1SRZuFLIB76ek7pVrphkt/QVZk6pI?=
 =?us-ascii?Q?5HHtvEauMgPYpN3teZcG0AUSoPpODEKLtY+2Zkd9XgcyLGbqxIOVz65kTBmu?=
 =?us-ascii?Q?GSjdMABuAPaEYryHuC7yJn5UVYRo2X73TmGIYv7LkChX3mFEv4+al0WLmVBS?=
 =?us-ascii?Q?RyTiKSQ/chzL3z2i57LAiJxA/JRqHvhLBHPVBZ9y9FnIvXopKEePt/eoIu9W?=
 =?us-ascii?Q?79Oqtqwh0vr2aCEmNK3JGs+UqxQFby3kWxmLPXJ140RTO6xyDGWBZEb0N0FO?=
 =?us-ascii?Q?26qX6CJyEGAGsGvSjToul9wjl3GdveZAOaY/ZvFeaNTt1RNA70kb3fym4FI8?=
 =?us-ascii?Q?HU/3Kj4TrPwUvlYMCvClsMSUjCvHZmUGmHNg17hXaZcLy6v6dGAR6+ubhGnz?=
 =?us-ascii?Q?+amvaS/W/yJ6q4T70pL46egB084n58+nsgQ64j8tiEtllMbHe0ed6mf4D0jd?=
 =?us-ascii?Q?AJMaP9TopwNElRNiPA2WhVx3TARIsHr9LjD75TUdy4eLiCCD1uIMZ3FZpFQn?=
 =?us-ascii?Q?xtaUlAoRz+8GNEFZXMpCdCXjNooJgVfq3AEI/Ff3qYZaDLKXzcKOXmyWRcRK?=
 =?us-ascii?Q?nguRg8ZCzVxyFMg4HIFzRYf1kVrG13caVopovtIAAlMJW51k3chDPa2Vww7Y?=
 =?us-ascii?Q?sBIy1nOJbxcqwW3LNIIajAFzgI3l6qraqBLwovD1cGUfaGcBBnskllu9zRr+?=
 =?us-ascii?Q?jzz5eIH3OsCtcPgDpBnz5SEo+iOppxwU2mXGqGfLHvXjQG2tR0oSldAjteqN?=
 =?us-ascii?Q?GHOb/hscBdyzpYYZ3lb2CrM08bOudsQ/0ZvxIBFgjVbyzllhn7LZl5r7EA6i?=
 =?us-ascii?Q?IxIwBdAMq4jYmlNikN7ijXuIp635RuiOaP2Zv1dkB/lFjqqvwLU4v81WbNA9?=
 =?us-ascii?Q?vhn59Hq8N8j/oImJvFunDN72Yurx0X1XhXgfieuhdzKZVEApK1nKi4Ztlbsn?=
 =?us-ascii?Q?ilnDbhzyq/68FR6eS49nvcqJyF4XY5erDqb3F6UERN44n1N2fur6a75KuiGe?=
 =?us-ascii?Q?5lkD5yXd7+nBgWYhCOyNOvjI/CSxRlPfR9CXmZ+N8TRa2fxTkJCoPqcwzOQJ?=
 =?us-ascii?Q?ZN+wooDAq5aGoN+RVb0AmKF0wjiwelpb479mcT01XbFuQHdQYSZPfp0fVAO2?=
 =?us-ascii?Q?rshrrvIXzwRHtD9ETuY5DMOf9idyK9VefBGRpXnbTgqYugxmhZbG6DQHgeur?=
 =?us-ascii?Q?LDXmj1YlSyL1UqF12sUSkpwjacBG/BsPanftd3TNzB+PhqpDAS8uAux/b9MK?=
 =?us-ascii?Q?vKupoan/ZmrA1nIVvsAMxdsK4NNTKtf9HwdGu/thCWD/ux/odPDSXgz1N5f4?=
 =?us-ascii?Q?+Pf1tkBuEn+2+eF0kYfuMXlQ7EiJ9YQr0ENu9AWcVjJc/evnY//PUzVFp2DW?=
 =?us-ascii?Q?cWfxhq+Qe1t9MZGyoM9DuZfHLgPZssbQixJXfs7wPJAKsoV398EWc61TOsLw?=
 =?us-ascii?Q?w4/f+mxDHX3wxJlwRWQY8nd1c5yV7E/CvIQoEvS4N3oOFEyfY5HwVDqOdIMw?=
 =?us-ascii?Q?qRYNOL9YA+AyrvDA4r00gJH6U+6FsGZ/cfM5oIzowWPAX4xTmsnPb5U4gA87?=
 =?us-ascii?Q?cjFu+i3uzYmYAgfwtdYA+AkspaNu4v3OIZvurPdvY6Tftvisl8WE4JLtupqc?=
 =?us-ascii?Q?Xg=3D=3D?=
X-OriginatorOrg: solid-run.com
X-MS-Exchange-CrossTenant-Network-Message-Id: b85441f2-0206-4b3a-7cbf-08db3e4ea8ca
X-MS-Exchange-CrossTenant-AuthSource: AM0PR04MB4723.eurprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 Apr 2023 07:46:16.5135
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: a4a8aaf3-fd27-4e27-add2-604707ce5b82
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: voL46CbftVUf1G3rXGq0RWdxcMRmBhL9yiCfXr+SLXE53lHl+pr8OaQNeJTuM5/5eyyoRBfRouubq9Z9eO1SwgIGYM+cQ8Z8IZnhXBH0he4=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DBBPR04MB7740
X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_PASS,
        T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Check vring size and fail probe if a transmit/receive vring size is
smaller than MAX_SKB_FRAGS + 2.

At the moment, any vring size is accepted. This is problematic because
it may result in attempting to transmit a packet with more fragments
than there are descriptors in the ring.

Furthermore, it leads to an immediate bug:

The condition: (sq->vq->num_free >= 2 + MAX_SKB_FRAGS) in
virtnet_poll_cleantx and virtnet_poll_tx always evaluates to false,
so netif_tx_wake_queue is not called, leading to TX timeouts.

Signed-off-by: Alvaro Karsz <alvaro.karsz@solid-run.com>
---
 drivers/net/virtio_net.c | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 2396c28c012..59676252c5c 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -3745,6 +3745,26 @@ static int init_vqs(struct virtnet_info *vi)
 	return ret;
 }
 
+static int virtnet_validate_vqs(struct virtnet_info *vi)
+{
+	u32 i, min_size = roundup_pow_of_two(MAX_SKB_FRAGS + 2);
+
+	/* Transmit/Receive vring size must be at least MAX_SKB_FRAGS + 2
+	 * (fragments + linear part + virtio header)
+	 */
+	for (i = 0; i < vi->max_queue_pairs; i++) {
+		if (virtqueue_get_vring_size(vi->sq[i].vq) < min_size ||
+		    virtqueue_get_vring_size(vi->rq[i].vq) < min_size) {
+			dev_warn(&vi->vdev->dev,
+				 "Transmit/Receive virtqueue vring size must be at least %u\n",
+				 min_size);
+			return -EINVAL;
+		}
+	}
+
+	return 0;
+}
+
 #ifdef CONFIG_SYSFS
 static ssize_t mergeable_rx_buffer_size_show(struct netdev_rx_queue *queue,
 		char *buf)
@@ -4056,6 +4076,10 @@ static int virtnet_probe(struct virtio_device *vdev)
 	if (err)
 		goto free;
 
+	err = virtnet_validate_vqs(vi);
+	if (err)
+		goto free_vqs;
+
 #ifdef CONFIG_SYSFS
 	if (vi->mergeable_rx_bufs)
 		dev->sysfs_rx_queue_group = &virtio_net_mrg_rx_group;
-- 
2.34.1