From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from dpdk.org (dpdk.org [92.243.14.124]) by dpdk.space (Postfix) with ESMTP id 4FD80A0096 for ; Fri, 15 Mar 2019 10:22:44 +0100 (CET) Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id 3026B2C17; Fri, 15 Mar 2019 10:22:43 +0100 (CET) Received: from mga18.intel.com (mga18.intel.com [134.134.136.126]) by dpdk.org (Postfix) with ESMTP id B38B82C17 for ; Fri, 15 Mar 2019 10:22:41 +0100 (CET) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga002.fm.intel.com ([10.253.24.26]) by orsmga106.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 15 Mar 2019 02:22:40 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.58,481,1544515200"; d="scan'208";a="151955004" Received: from dpdk-tbie.sh.intel.com ([10.67.104.173]) by fmsmga002.fm.intel.com with ESMTP; 15 Mar 2019 02:22:39 -0700 From: Tiwei Bie To: yskoh@mellanox.com, stable@dpdk.org Cc: maxime.coquelin@redhat.com, zhihong.wang@intel.com Date: Fri, 15 Mar 2019 17:21:32 +0800 Message-Id: <20190315092132.4106-1-tiwei.bie@intel.com> X-Mailer: git-send-email 2.17.1 Subject: [dpdk-stable] [PATCH 17.11] vhost: fix access for indirect descriptors X-BeenThere: stable@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: patches for DPDK stable branches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: stable-bounces@dpdk.org Sender: "stable" [ backported from upstream commit 48006390003b81f6d5c7b78e3f02ed49d1049945 ] Fix a possible out of bound access which may happen when handling indirect descs in split ring. Fixes: 1be4ebb1c464 ("vhost: support indirect descriptor in mergeable Rx") Reported-by: Haiyue Wang Signed-off-by: Tiwei Bie Reviewed-by: Maxime Coquelin --- lib/librte_vhost/virtio_net.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/lib/librte_vhost/virtio_net.c b/lib/librte_vhost/virtio_net.c index 3e2935992..07d4609ee 100644 --- a/lib/librte_vhost/virtio_net.c +++ b/lib/librte_vhost/virtio_net.c @@ -565,6 +565,7 @@ fill_vec_buf(struct virtio_net *dev, struct vhost_virtqueue *vq, uint16_t idx = vq->avail->ring[avail_idx & (vq->size - 1)]; uint32_t vec_id = *vec_idx; uint32_t len = 0; + uint32_t nr_descs = vq->size; uint64_t dlen; struct vring_desc *descs = vq->desc; struct vring_desc *idesc = NULL; @@ -576,6 +577,7 @@ fill_vec_buf(struct virtio_net *dev, struct vhost_virtqueue *vq, if (vq->desc[idx].flags & VRING_DESC_F_INDIRECT) { dlen = vq->desc[idx].len; + nr_descs = dlen / sizeof(struct vring_desc); descs = (struct vring_desc *)(uintptr_t) vhost_iova_to_vva(dev, vq, vq->desc[idx].addr, &dlen, @@ -599,7 +601,7 @@ fill_vec_buf(struct virtio_net *dev, struct vhost_virtqueue *vq, } while (1) { - if (unlikely(vec_id >= BUF_VECTOR_MAX || idx >= vq->size)) { + if (unlikely(vec_id >= BUF_VECTOR_MAX || idx >= nr_descs)) { free_ind_table(idesc); return -1; } -- 2.17.1