vhost: split out-of-order used ring batches at every wrap

When a completion batch larger than the remaining space in the used
ring is added without VIRTIO_F_IN_ORDER, vhost_add_used_n_ooo() splits
it at the ring boundary only once. vhost-net can batch up to
VHOST_NET_BATCH TX completions, so with a queue smaller than half the
batch the tail of the second chunk runs past the end of the used ring
and into whatever follows it in the vhost owner's address space: with
a 32 entry queue, last_used_idx % 32 == 3 and a 64 entry batch, three
used entries are written past the ring.

To fix, keep splitting the remaining batch at each wrap until it is
exhausted.

Cc: stable@vger.kernel.org
Reported-by: Seohyeon Maeng <bioloidgp@gmail.com>
Cc: minki@morningstarsec.dev
Fixes: 2b3b35eb989 ("vhost_net: batch used ring update in rx")
Fixes: 4afb52c2af44 ("vhost_net: batch update used ring for datacopy TX")
Cc: Jason Wang <jasowangio@gmail.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

0 files changed, 0 insertions, 0 deletions