[RFC 1/2] virtio_net: timeout control virtqueue commands

["Eugenio Pérez" <eperezma@redhat.com>]

An userland device implemented through VDUSE could take rtnl forever if
the virtio-net driver is running on top of virtio_vdpa.  Let's break the
device if it does not return the buffer in a longer-than-assumible
timeout.

A less agressive path can be taken to recover the device, like only
resetting the control virtqueue.  However, the state of the device after
this action is taken races, as the vq could be reset after the device
writes the OK.  Leaving TODO anyway.

Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
---
 drivers/net/virtio_net.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 31bd32bdecaf..ed68ad69a019 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -3576,6 +3576,7 @@ static bool virtnet_send_command_reply(struct virtnet_info *vi, u8 class, u8 cmd
 {
 	struct scatterlist *sgs[5], hdr, stat;
 	u32 out_num = 0, tmp, in_num = 0;
+	unsigned long end_time;
 	bool ok;
 	int ret;
 
@@ -3614,11 +3615,20 @@ static bool virtnet_send_command_reply(struct virtnet_info *vi, u8 class, u8 cmd
 
 	/* Spin for a response, the kick causes an ioport write, trapping
 	 * into the hypervisor, so the request should be handled immediately.
+	 *
+	 * Long timeout so a malicious device is not able to lock rtnl forever.
 	 */
+	end_time = jiffies + 30 * HZ;
 	while (!virtqueue_get_buf(vi->cvq, &tmp) &&
 	       !virtqueue_is_broken(vi->cvq)) {
 		cond_resched();
 		cpu_relax();
+
+		if (time_after(end_time, jiffies)) {
+			/* TODO Reset vq if possible? */
+			virtio_break_device(vi->vdev);
+			break;
+		}
 	}
 
 unlock:
-- 
2.51.0