From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mx1.redhat.com (mx3-rdu2.redhat.com [66.187.233.73]) by dpdk.org (Postfix) with ESMTP id 148024C6F for ; Mon, 23 Apr 2018 18:01:14 +0200 (CEST) Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.rdu2.redhat.com [10.11.54.5]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id B27DD427095B for ; Mon, 23 Apr 2018 16:01:13 +0000 (UTC) Received: from localhost.localdomain (ovpn-112-58.ams2.redhat.com [10.36.112.58]) by smtp.corp.redhat.com (Postfix) with ESMTP id 0B2A283B9C; Mon, 23 Apr 2018 16:01:12 +0000 (UTC) From: Maxime Coquelin To: stable@dpdk.org Cc: Maxime Coquelin Date: Mon, 23 Apr 2018 18:00:37 +0200 Message-Id: <20180423160047.21457-2-maxime.coquelin@redhat.com> In-Reply-To: <20180423160047.21457-1-maxime.coquelin@redhat.com> References: <20180423160047.21457-1-maxime.coquelin@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.11.54.5 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.7]); Mon, 23 Apr 2018 16:01:13 +0000 (UTC) X-Greylist: inspected by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.7]); Mon, 23 Apr 2018 16:01:13 +0000 (UTC) for IP:'10.11.54.5' DOMAIN:'int-mx05.intmail.prod.int.rdu2.redhat.com' HELO:'smtp.corp.redhat.com' FROM:'maxime.coquelin@redhat.com' RCPT:'' Subject: [dpdk-stable] [PATCH v17.11 LTS 01/11] vhost: fix indirect descriptors table translation size X-BeenThere: stable@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: patches for DPDK stable branches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 23 Apr 2018 16:01:14 -0000 This patch fixes the size passed at the indirect descriptor table translation time, which is the len field of the descriptor, and not a single descriptor. This issue has been assigned CVE-2018-1059. Fixes: 62fdb8255ae7 ("vhost: use the guest IOVA to host VA helper") Signed-off-by: Maxime Coquelin --- lib/librte_vhost/virtio_net.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/librte_vhost/virtio_net.c b/lib/librte_vhost/virtio_net.c index d34703074..cb1d0cfc4 100644 --- a/lib/librte_vhost/virtio_net.c +++ b/lib/librte_vhost/virtio_net.c @@ -1328,7 +1328,7 @@ rte_vhost_dequeue_burst(int vid, uint16_t queue_id, desc = (struct vring_desc *)(uintptr_t) vhost_iova_to_vva(dev, vq, vq->desc[desc_indexes[i]].addr, - sizeof(*desc), + vq->desc[desc_indexes[i]].len, VHOST_ACCESS_RO); if (unlikely(!desc)) break; -- 2.14.3