From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 0E6CA45F19; Mon, 23 Dec 2024 04:29:28 +0100 (CET) Received: from mails.dpdk.org (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id AC18D40263; Mon, 23 Dec 2024 04:29:27 +0100 (CET) Received: from szxga04-in.huawei.com (szxga04-in.huawei.com [45.249.212.190]) by mails.dpdk.org (Postfix) with ESMTP id 2649B40156; Mon, 23 Dec 2024 04:29:25 +0100 (CET) Received: from mail.maildlp.com (unknown [172.19.162.112]) by szxga04-in.huawei.com (SkyGuard) with ESMTP id 4YGk2q0PCYz2DjLn; Mon, 23 Dec 2024 11:26:43 +0800 (CST) Received: from kwepemd500024.china.huawei.com (unknown [7.221.188.194]) by mail.maildlp.com (Postfix) with ESMTPS id B199B1402E2; Mon, 23 Dec 2024 11:29:23 +0800 (CST) Received: from localhost (10.174.242.157) by kwepemd500024.china.huawei.com (7.221.188.194) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Mon, 23 Dec 2024 11:29:23 +0800 From: Yunjian Wang To: CC: , , , , Yunjian Wang , Subject: [PATCH 1/1] vhost: fix missing descriptor chains length checks Date: Mon, 23 Dec 2024 11:29:21 +0800 Message-ID: <0bf28cc647eac66343c39d6acd4df868836e6ae6.1734923187.git.wangyunjian@huawei.com> X-Mailer: git-send-email 1.9.5.msysgit.1 MIME-Version: 1.0 Content-Type: text/plain X-Originating-IP: [10.174.242.157] X-ClientProxiedBy: dggems701-chm.china.huawei.com (10.3.19.178) To kwepemd500024.china.huawei.com (7.221.188.194) X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org The descriptor chains length must be greater than the Virtio-net header size. Otherwise, such descriptor chains sizes implies no packet data. Fixes: fe8477ebbd94 ("vhost: support async packed ring dequeue") Cc: stable@dpdk.org Signed-off-by: Yunjian Wang --- lib/vhost/virtio_net.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/lib/vhost/virtio_net.c b/lib/vhost/virtio_net.c index 69901ab3b5..8fc9bfa056 100644 --- a/lib/vhost/virtio_net.c +++ b/lib/vhost/virtio_net.c @@ -3962,6 +3962,16 @@ virtio_dev_tx_async_single_packed(struct virtio_net *dev, VHOST_ACCESS_RO) < 0)) return -1; + if (unlikely(buf_len <= dev->vhost_hlen)) { + if (!allocerr_warned) { + VHOST_DATA_LOG(dev->ifname, ERR, "Invalid buffer length."); + allocerr_warned = true; + } + return -1; + } + + buf_len -= dev->vhost_hlen; + if (unlikely(virtio_dev_pktmbuf_prep(dev, pkts, buf_len))) { if (!allocerr_warned) { VHOST_DATA_LOG(dev->ifname, ERR, "Failed mbuf alloc of size %d from %s.", -- 2.33.0