Commit e79b431f authored by Jason Wang's avatar Jason Wang Committed by Michael S. Tsirkin

vhost: vsock: add weight support

This patch will check the weight and exit the loop if we exceeds the
weight. This is useful for preventing vsock kthread from hogging cpu
which is guest triggerable. The weight can help to avoid starving the
request from on direction while another direction is being processed.

The value of weight is picked from vhost-net.

This addresses CVE-2019-3900.

Cc: Stefan Hajnoczi <stefanha@redhat.com>
Fixes: 433fc58e ("VSOCK: Introduce vhost_vsock.ko")
Signed-off-by: default avatarJason Wang <jasowang@redhat.com>
Reviewed-by: default avatarStefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
parent e2412c07
...@@ -86,6 +86,7 @@ vhost_transport_do_send_pkt(struct vhost_vsock *vsock, ...@@ -86,6 +86,7 @@ vhost_transport_do_send_pkt(struct vhost_vsock *vsock,
struct vhost_virtqueue *vq) struct vhost_virtqueue *vq)
{ {
struct vhost_virtqueue *tx_vq = &vsock->vqs[VSOCK_VQ_TX]; struct vhost_virtqueue *tx_vq = &vsock->vqs[VSOCK_VQ_TX];
int pkts = 0, total_len = 0;
bool added = false; bool added = false;
bool restart_tx = false; bool restart_tx = false;
...@@ -97,7 +98,7 @@ vhost_transport_do_send_pkt(struct vhost_vsock *vsock, ...@@ -97,7 +98,7 @@ vhost_transport_do_send_pkt(struct vhost_vsock *vsock,
/* Avoid further vmexits, we're already processing the virtqueue */ /* Avoid further vmexits, we're already processing the virtqueue */
vhost_disable_notify(&vsock->dev, vq); vhost_disable_notify(&vsock->dev, vq);
for (;;) { do {
struct virtio_vsock_pkt *pkt; struct virtio_vsock_pkt *pkt;
struct iov_iter iov_iter; struct iov_iter iov_iter;
unsigned out, in; unsigned out, in;
...@@ -182,8 +183,9 @@ vhost_transport_do_send_pkt(struct vhost_vsock *vsock, ...@@ -182,8 +183,9 @@ vhost_transport_do_send_pkt(struct vhost_vsock *vsock,
*/ */
virtio_transport_deliver_tap_pkt(pkt); virtio_transport_deliver_tap_pkt(pkt);
total_len += pkt->len;
virtio_transport_free_pkt(pkt); virtio_transport_free_pkt(pkt);
} } while(likely(!vhost_exceeds_weight(vq, ++pkts, total_len)));
if (added) if (added)
vhost_signal(&vsock->dev, vq); vhost_signal(&vsock->dev, vq);
...@@ -358,7 +360,7 @@ static void vhost_vsock_handle_tx_kick(struct vhost_work *work) ...@@ -358,7 +360,7 @@ static void vhost_vsock_handle_tx_kick(struct vhost_work *work)
struct vhost_vsock *vsock = container_of(vq->dev, struct vhost_vsock, struct vhost_vsock *vsock = container_of(vq->dev, struct vhost_vsock,
dev); dev);
struct virtio_vsock_pkt *pkt; struct virtio_vsock_pkt *pkt;
int head; int head, pkts = 0, total_len = 0;
unsigned int out, in; unsigned int out, in;
bool added = false; bool added = false;
...@@ -368,7 +370,7 @@ static void vhost_vsock_handle_tx_kick(struct vhost_work *work) ...@@ -368,7 +370,7 @@ static void vhost_vsock_handle_tx_kick(struct vhost_work *work)
goto out; goto out;
vhost_disable_notify(&vsock->dev, vq); vhost_disable_notify(&vsock->dev, vq);
for (;;) { do {
u32 len; u32 len;
if (!vhost_vsock_more_replies(vsock)) { if (!vhost_vsock_more_replies(vsock)) {
...@@ -409,9 +411,11 @@ static void vhost_vsock_handle_tx_kick(struct vhost_work *work) ...@@ -409,9 +411,11 @@ static void vhost_vsock_handle_tx_kick(struct vhost_work *work)
else else
virtio_transport_free_pkt(pkt); virtio_transport_free_pkt(pkt);
vhost_add_used(vq, head, sizeof(pkt->hdr) + len); len += sizeof(pkt->hdr);
vhost_add_used(vq, head, len);
total_len += len;
added = true; added = true;
} } while(likely(!vhost_exceeds_weight(vq, ++pkts, total_len)));
no_more_replies: no_more_replies:
if (added) if (added)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment