From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 7435BA034F; Wed, 31 Mar 2021 08:50:27 +0200 (CEST) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 5FDF94069E; Wed, 31 Mar 2021 08:50:27 +0200 (CEST) Received: from mga12.intel.com (mga12.intel.com [192.55.52.136]) by mails.dpdk.org (Postfix) with ESMTP id 75B3740141; Wed, 31 Mar 2021 08:50:25 +0200 (CEST) IronPort-SDR: 4DDXmY8GJscooazN308DnRULITeXKXHFKWN1ZyQqZkxnlD/dIq6vB5Xn1NB4kA6HFVJFAIDzlp 977kZnN0RGOw== X-IronPort-AV: E=McAfee;i="6000,8403,9939"; a="171342646" X-IronPort-AV: E=Sophos;i="5.81,293,1610438400"; d="scan'208";a="171342646" Received: from fmsmga002.fm.intel.com ([10.253.24.26]) by fmsmga106.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 30 Mar 2021 23:50:24 -0700 IronPort-SDR: kAzwI261UI9e7fNYUwc4Ne4lvkD8wh/svw/nMWD5/BpjNLf2hb4zy0mu2nHNs8liA8+aPjxe8x XccY9zcXbGcw== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.81,293,1610438400"; d="scan'208";a="445526235" Received: from npg-dpdk-virtual-marvin-dev.sh.intel.com ([10.67.119.108]) by fmsmga002.fm.intel.com with ESMTP; 30 Mar 2021 23:50:21 -0700 From: Marvin Liu To: maxime.coquelin@redhat.com, chenbo.xia@intel.com Cc: dev@dpdk.org, Marvin Liu , stable@dpdk.org Date: Wed, 31 Mar 2021 14:49:37 +0800 Message-Id: <20210331064939.56107-1-yong.liu@intel.com> X-Mailer: git-send-email 2.17.1 Subject: [dpdk-dev] [PATCH 1/3] vhost: fix split ring potential buffer overflow X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" In vhost datapath, descriptor's length are mostly used in two coherent operations. First step is used for address translation, second step is used for memory transaction from guest to host. But the iterval between two steps will give a window for malicious guest, in which can change descriptor length after vhost calcuated buffer size. Thus may lead to buffer overflow in vhost side. This potential risk can be eliminated by accessing the descriptor length once. Fixes: 1be4ebb1c464 ("vhost: support indirect descriptor in mergeable Rx") Cc: stable@dpdk.org Signed-off-by: Marvin Liu Reviewed-by: Maxime Coquelin diff --git a/lib/librte_vhost/virtio_net.c b/lib/librte_vhost/virtio_net.c index 583bf379c6..576a0a20c0 100644 --- a/lib/librte_vhost/virtio_net.c +++ b/lib/librte_vhost/virtio_net.c @@ -548,10 +548,11 @@ fill_vec_buf_split(struct virtio_net *dev, struct vhost_virtqueue *vq, return -1; } - len += descs[idx].len; + dlen = descs[idx].len; + len += dlen; if (unlikely(map_one_desc(dev, vq, buf_vec, &vec_id, - descs[idx].addr, descs[idx].len, + descs[idx].addr, dlen, perm))) { free_ind_table(idesc); return -1; -- 2.17.1