From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id CBFA7A034F for ; Wed, 31 Mar 2021 08:50:31 +0200 (CEST) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id C34F2140DFC; Wed, 31 Mar 2021 08:50:31 +0200 (CEST) Received: from mga12.intel.com (mga12.intel.com [192.55.52.136]) by mails.dpdk.org (Postfix) with ESMTP id 5BD6340141; Wed, 31 Mar 2021 08:50:26 +0200 (CEST) IronPort-SDR: 2nihPO6LDUIWXoVnmfHEkj7L2O3bhSRvJ28h3VOkaF5BTQoPRhwTRB5YiOe5J3MoZ8Ahhu9EdK 23CJVsLd7srg== X-IronPort-AV: E=McAfee;i="6000,8403,9939"; a="171342648" X-IronPort-AV: E=Sophos;i="5.81,293,1610438400"; d="scan'208";a="171342648" Received: from fmsmga002.fm.intel.com ([10.253.24.26]) by fmsmga106.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 30 Mar 2021 23:50:26 -0700 IronPort-SDR: 7hfoDcLe91dmALr+U849qe+d/nxYSrsWX74o+WtmSfLkFAmZQtJFHcQN0vTyzEG3UrPiGFFlFK gtKcHIL4PYCA== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.81,293,1610438400"; d="scan'208";a="445526314" Received: from npg-dpdk-virtual-marvin-dev.sh.intel.com ([10.67.119.108]) by fmsmga002.fm.intel.com with ESMTP; 30 Mar 2021 23:50:24 -0700 From: Marvin Liu To: maxime.coquelin@redhat.com, chenbo.xia@intel.com Cc: dev@dpdk.org, Marvin Liu , stable@dpdk.org Date: Wed, 31 Mar 2021 14:49:38 +0800 Message-Id: <20210331064939.56107-2-yong.liu@intel.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20210331064939.56107-1-yong.liu@intel.com> References: <20210331064939.56107-1-yong.liu@intel.com> Subject: [dpdk-stable] [PATCH 2/3] vhost: fix packed ring potential buffer overflow X-BeenThere: stable@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: patches for DPDK stable branches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: stable-bounces@dpdk.org Sender: "stable" Similar as split ring, the multiple accesses of descriptor length will lead to potential risk. One-time access of descriptor length can eliminate this risk. Fixes: 2f3225a7d69b ("vhost: add vector filling support for packed ring") Cc: stable@dpdk.org Signed-off-by: Marvin Liu Reviewed-by: Maxime Coquelin diff --git a/lib/librte_vhost/virtio_net.c b/lib/librte_vhost/virtio_net.c index 576a0a20c0..de43686522 100644 --- a/lib/librte_vhost/virtio_net.c +++ b/lib/librte_vhost/virtio_net.c @@ -669,9 +669,10 @@ fill_vec_buf_packed_indirect(struct virtio_net *dev, return -1; } - *len += descs[i].len; + dlen = descs[i].len; + *len += dlen; if (unlikely(map_one_desc(dev, vq, buf_vec, &vec_id, - descs[i].addr, descs[i].len, + descs[i].addr, dlen, perm))) return -1; } @@ -692,6 +693,7 @@ fill_vec_buf_packed(struct virtio_net *dev, struct vhost_virtqueue *vq, bool wrap_counter = vq->avail_wrap_counter; struct vring_packed_desc *descs = vq->desc_packed; uint16_t vec_id = *vec_idx; + uint64_t dlen; if (avail_idx < vq->last_avail_idx) wrap_counter ^= 1; @@ -724,11 +726,12 @@ fill_vec_buf_packed(struct virtio_net *dev, struct vhost_virtqueue *vq, len, perm) < 0)) return -1; } else { - *len += descs[avail_idx].len; + dlen = descs[avail_idx].len; + *len += dlen; if (unlikely(map_one_desc(dev, vq, buf_vec, &vec_id, descs[avail_idx].addr, - descs[avail_idx].len, + dlen, perm))) return -1; } -- 2.17.1