From: Ferruh Yigit <ferruh.yigit@intel.com> To: Maxime Coquelin <maxime.coquelin@redhat.com>, Chenbo Xia <chenbo.xia@intel.com>, Zhihong Wang <zhihong.wang@intel.com>, Fan Zhang <roy.fan.zhang@intel.com> Cc: dev@dpdk.org, Ferruh Yigit <ferruh.yigit@intel.com>, stable@dpdk.org Subject: [dpdk-stable] [PATCH 2/6] vhost/crypto: fix incorrect descriptor deduction Date: Mon, 28 Sep 2020 11:59:14 +0100 Message-ID: <20200928105918.740807-2-ferruh.yigit@intel.com> (raw) In-Reply-To: <20200928105918.740807-1-ferruh.yigit@intel.com> From: Fan Zhang <roy.fan.zhang@intel.com> This patch fixes the incorrect descriptor deduction for vhost crypto. CVE-2020-14378 Fixes: 16d2e718b8ce ("vhost/crypto: fix possible out of bound access") Cc: stable@dpdk.org Signed-off-by: Fan Zhang <roy.fan.zhang@intel.com> Acked-by: Chenbo Xia <chenbo.xia@intel.com> --- lib/librte_vhost/vhost_crypto.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/lib/librte_vhost/vhost_crypto.c b/lib/librte_vhost/vhost_crypto.c index 0f9df4059d..86747dd5f3 100644 --- a/lib/librte_vhost/vhost_crypto.c +++ b/lib/librte_vhost/vhost_crypto.c @@ -530,13 +530,14 @@ move_desc(struct vring_desc *head, struct vring_desc **cur_desc, int left = size - desc->len; while ((desc->flags & VRING_DESC_F_NEXT) && left > 0) { - (*nb_descs)--; if (unlikely(*nb_descs == 0 || desc->next >= vq_size)) return -1; desc = &head[desc->next]; rte_prefetch0(&head[desc->next]); left -= desc->len; + if (left > 0) + (*nb_descs)--; } if (unlikely(left > 0)) -- 2.26.2
next prev parent reply other threads:[~2020-09-28 10:59 UTC|newest] Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top 2020-09-28 10:59 [dpdk-stable] [PATCH 1/6] vhost/crypto: fix pool allocation Ferruh Yigit 2020-09-28 10:59 ` Ferruh Yigit [this message] 2020-09-28 10:59 ` [dpdk-stable] [PATCH 3/6] vhost/crypto: fix missed request check for copy mode Ferruh Yigit 2020-09-28 10:59 ` [dpdk-stable] [PATCH 4/6] vhost/crypto: fix incorrect write back source Ferruh Yigit 2020-09-28 10:59 ` [dpdk-stable] [PATCH 5/6] vhost/crypto: fix data length check Ferruh Yigit 2020-09-28 10:59 ` [dpdk-stable] [PATCH 6/6] vhost/crypto: fix possible TOCTOU attack Ferruh Yigit 2020-09-28 15:19 ` Thomas Monjalon
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20200928105918.740807-2-ferruh.yigit@intel.com \ --to=ferruh.yigit@intel.com \ --cc=chenbo.xia@intel.com \ --cc=dev@dpdk.org \ --cc=maxime.coquelin@redhat.com \ --cc=roy.fan.zhang@intel.com \ --cc=stable@dpdk.org \ --cc=zhihong.wang@intel.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
patches for DPDK stable branches This inbox may be cloned and mirrored by anyone: git clone --mirror https://inbox.dpdk.org/stable/0 stable/git/0.git # If you have public-inbox 1.1+ installed, you may # initialize and index your mirror using the following commands: public-inbox-init -V2 stable stable/ https://inbox.dpdk.org/stable \ stable@dpdk.org public-inbox-index stable Example config snippet for mirrors. Newsgroup available over NNTP: nntp://inbox.dpdk.org/inbox.dpdk.stable AGPL code for this site: git clone https://public-inbox.org/public-inbox.git