git: if_vtnet - Allocate struct vtnet_tx_header entries from a queue.

Imre Vadasz ivadasz at crater.dragonflybsd.org
Thu Mar 23 14:38:17 PDT 2017


commit d8c85757e795ea753bd0625eb344c8220e7a048e
Author: Imre Vadász <imre at vdsz.com>
Date:   Mon Mar 20 20:16:50 2017 +0100

    if_vtnet - Allocate struct vtnet_tx_header entries from a queue.
    
    * The existing code was sequentially allocating from an array of
      struct vtnet_tx_header, using an appropriately sized area.
      But this scheme turns out to be a very bad idea when we get out-of-order
      completions in the virtqueue.
    
    * Instead allocate struct vtnet_tx_header entries from an SLIST.
    
    * This should avoid crashes from memory-corruption or use-after-free in
      if_vtnet(9), when running in KVM on Linux, using Linux's vhost-net
      in-kernel virtqueue accelerator.

Summary of changes:
 sys/dev/virtual/virtio/net/if_vtnet.c    | 30 +++++++++++++++++++++++-------
 sys/dev/virtual/virtio/net/if_vtnetvar.h |  6 ++++--
 2 files changed, 27 insertions(+), 9 deletions(-)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/d8c85757e795ea753bd0625eb344c8220e7a048e


-- 
DragonFly BSD source repository



More information about the Commits mailing list