From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id CBEF3A0A02 for ; Thu, 25 Mar 2021 04:03:50 +0100 (CET) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id B1804140DAC; Thu, 25 Mar 2021 04:03:50 +0100 (CET) Received: from mga02.intel.com (mga02.intel.com [134.134.136.20]) by mails.dpdk.org (Postfix) with ESMTP id 1BE1640147; Thu, 25 Mar 2021 04:03:45 +0100 (CET) IronPort-SDR: BAEmOzRpN/aWNAxmTXkdlw15s0ozRBeVKy9u5CwG5FEq9OYYkIjhCqUMKX31oRh7c8t7IugRSI KKpkVlxXMiUg== X-IronPort-AV: E=McAfee;i="6000,8403,9933"; a="177953067" X-IronPort-AV: E=Sophos;i="5.81,276,1610438400"; d="scan'208";a="177953067" Received: from orsmga008.jf.intel.com ([10.7.209.65]) by orsmga101.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 24 Mar 2021 20:03:39 -0700 IronPort-SDR: vOsGwhMMcyoL5/j2Ya0AV7AzwWrBRToOIq2XjYmvq1zDlKHTWKN3cZdhaB3YmH7WaX4XRAAtsp FB5mDqaoKXzA== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.81,276,1610438400"; d="scan'208";a="415765165" Received: from npg-dpdk-virtual-marvin-dev.sh.intel.com ([10.67.119.108]) by orsmga008.jf.intel.com with ESMTP; 24 Mar 2021 20:03:38 -0700 From: Marvin Liu To: maxime.coquelin@redhat.com, chenbo.xia@intel.com Cc: dev@dpdk.org, Marvin Liu , stable@dpdk.org Date: Thu, 25 Mar 2021 11:01:39 +0800 Message-Id: <20210325030139.2486-3-yong.liu@intel.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20210325030139.2486-1-yong.liu@intel.com> References: <20210226073321.66996-1-yong.liu@intel.com> <20210325030139.2486-1-yong.liu@intel.com> Subject: [dpdk-stable] [PATCH 3/3] vhost: fix potential buffer overflow when batch dequeue X-BeenThere: stable@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: patches for DPDK stable branches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: stable-bounces@dpdk.org Sender: "stable" Similar as single dequeue, the multiple accesses of descriptor length will lead to potential risk. One-time access of descriptor length can eliminate this risk. Fixes: 75ed51697820 ("vhost: add packed ring batch dequeue") Cc: stable@dpdk.org Signed-off-by: Marvin Liu Reviewed-by: Maxime Coquelin diff --git a/lib/librte_vhost/virtio_net.c b/lib/librte_vhost/virtio_net.c index de43686522..0a7d008a91 100644 --- a/lib/librte_vhost/virtio_net.c +++ b/lib/librte_vhost/virtio_net.c @@ -2318,7 +2318,7 @@ vhost_reserve_avail_batch_packed(struct virtio_net *dev, } vhost_for_each_try_unroll(i, 0, PACKED_BATCH_SIZE) { - pkts[i]->pkt_len = descs[avail_idx + i].len - buf_offset; + pkts[i]->pkt_len = lens[i] - buf_offset; pkts[i]->data_len = pkts[i]->pkt_len; ids[i] = descs[avail_idx + i].id; } -- 2.17.1