From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 7C57FA0A0A for ; Thu, 25 Mar 2021 04:03:48 +0100 (CET) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 6C4FD140D9D; Thu, 25 Mar 2021 04:03:48 +0100 (CET) Received: from mga02.intel.com (mga02.intel.com [134.134.136.20]) by mails.dpdk.org (Postfix) with ESMTP id 47E9B40147; Thu, 25 Mar 2021 04:03:45 +0100 (CET) IronPort-SDR: U0GnNEjxZX3htXsqEyVhkKfoLyr2/6p4Fgr2GBOku/T5fuRIzWI8HBxM5xKrtKsCf7orNaA+7b TiLAsf03yNdQ== X-IronPort-AV: E=McAfee;i="6000,8403,9933"; a="177953064" X-IronPort-AV: E=Sophos;i="5.81,276,1610438400"; d="scan'208";a="177953064" Received: from orsmga008.jf.intel.com ([10.7.209.65]) by orsmga101.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 24 Mar 2021 20:03:38 -0700 IronPort-SDR: 3uFccTf8yuT32VYtMTbRn1cP3ipCC53NpkD88ePlSclKdu1hOQuhfCUjS68JTEnGxpu2NeSX/Q sFU3rtHxVMtA== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.81,276,1610438400"; d="scan'208";a="415765155" Received: from npg-dpdk-virtual-marvin-dev.sh.intel.com ([10.67.119.108]) by orsmga008.jf.intel.com with ESMTP; 24 Mar 2021 20:03:36 -0700 From: Marvin Liu To: maxime.coquelin@redhat.com, chenbo.xia@intel.com Cc: dev@dpdk.org, Marvin Liu , stable@dpdk.org Date: Thu, 25 Mar 2021 11:01:38 +0800 Message-Id: <20210325030139.2486-2-yong.liu@intel.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20210325030139.2486-1-yong.liu@intel.com> References: <20210226073321.66996-1-yong.liu@intel.com> <20210325030139.2486-1-yong.liu@intel.com> Subject: [dpdk-stable] [PATCH 2/3] vhost: fix packed ring potential buffer overflow X-BeenThere: stable@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: patches for DPDK stable branches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: stable-bounces@dpdk.org Sender: "stable" Similar as split ring, the multiple accesses of descriptor length will lead to potential risk. One-time access of descriptor length can eliminate this risk. Fixes: 2f3225a7d69b ("vhost: add vector filling support for packed ring") Cc: stable@dpdk.org Signed-off-by: Marvin Liu Reviewed-by: Maxime Coquelin diff --git a/lib/librte_vhost/virtio_net.c b/lib/librte_vhost/virtio_net.c index 576a0a20c0..de43686522 100644 --- a/lib/librte_vhost/virtio_net.c +++ b/lib/librte_vhost/virtio_net.c @@ -669,9 +669,10 @@ fill_vec_buf_packed_indirect(struct virtio_net *dev, return -1; } - *len += descs[i].len; + dlen = descs[i].len; + *len += dlen; if (unlikely(map_one_desc(dev, vq, buf_vec, &vec_id, - descs[i].addr, descs[i].len, + descs[i].addr, dlen, perm))) return -1; } @@ -692,6 +693,7 @@ fill_vec_buf_packed(struct virtio_net *dev, struct vhost_virtqueue *vq, bool wrap_counter = vq->avail_wrap_counter; struct vring_packed_desc *descs = vq->desc_packed; uint16_t vec_id = *vec_idx; + uint64_t dlen; if (avail_idx < vq->last_avail_idx) wrap_counter ^= 1; @@ -724,11 +726,12 @@ fill_vec_buf_packed(struct virtio_net *dev, struct vhost_virtqueue *vq, len, perm) < 0)) return -1; } else { - *len += descs[avail_idx].len; + dlen = descs[avail_idx].len; + *len += dlen; if (unlikely(map_one_desc(dev, vq, buf_vec, &vec_id, descs[avail_idx].addr, - descs[avail_idx].len, + dlen, perm))) return -1; } -- 2.17.1