From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 739D3A034F for ; Wed, 31 Mar 2021 08:50:32 +0200 (CEST) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id E2584140E01; Wed, 31 Mar 2021 08:50:31 +0200 (CEST) Received: from mga12.intel.com (mga12.intel.com [192.55.52.136]) by mails.dpdk.org (Postfix) with ESMTP id B9AB4140DED; Wed, 31 Mar 2021 08:50:30 +0200 (CEST) IronPort-SDR: RNz9v9qRRQKEYdBnfOosr1ssKFWoDrsG04Rv+SsIiczXEjHT4CVZ4VEn8uvBzddOo3HKtjRzX3 9F6MI2GbGClw== X-IronPort-AV: E=McAfee;i="6000,8403,9939"; a="171342653" X-IronPort-AV: E=Sophos;i="5.81,293,1610438400"; d="scan'208";a="171342653" Received: from fmsmga002.fm.intel.com ([10.253.24.26]) by fmsmga106.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 30 Mar 2021 23:50:30 -0700 IronPort-SDR: sK7mZ7yYxpwppE48tI+JGQjz8OGSXcYro2bd1LMeO5QgrlBFVsRS7aKeD4U3jbU22ZBanuwEe9 2rij4LkhNXMg== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.81,293,1610438400"; d="scan'208";a="445526432" Received: from npg-dpdk-virtual-marvin-dev.sh.intel.com ([10.67.119.108]) by fmsmga002.fm.intel.com with ESMTP; 30 Mar 2021 23:50:26 -0700 From: Marvin Liu To: maxime.coquelin@redhat.com, chenbo.xia@intel.com Cc: dev@dpdk.org, Marvin Liu , stable@dpdk.org Date: Wed, 31 Mar 2021 14:49:39 +0800 Message-Id: <20210331064939.56107-3-yong.liu@intel.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20210331064939.56107-1-yong.liu@intel.com> References: <20210331064939.56107-1-yong.liu@intel.com> Subject: [dpdk-stable] [PATCH 3/3] vhost: fix potential buffer overflow when batch dequeue X-BeenThere: stable@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: patches for DPDK stable branches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: stable-bounces@dpdk.org Sender: "stable" Similar as single dequeue, the multiple accesses of descriptor length will lead to potential risk. One-time access of descriptor length can eliminate this risk. Fixes: 75ed51697820 ("vhost: add packed ring batch dequeue") Cc: stable@dpdk.org Signed-off-by: Marvin Liu Reviewed-by: Maxime Coquelin diff --git a/lib/librte_vhost/virtio_net.c b/lib/librte_vhost/virtio_net.c index de43686522..0a7d008a91 100644 --- a/lib/librte_vhost/virtio_net.c +++ b/lib/librte_vhost/virtio_net.c @@ -2318,7 +2318,7 @@ vhost_reserve_avail_batch_packed(struct virtio_net *dev, } vhost_for_each_try_unroll(i, 0, PACKED_BATCH_SIZE) { - pkts[i]->pkt_len = descs[avail_idx + i].len - buf_offset; + pkts[i]->pkt_len = lens[i] - buf_offset; pkts[i]->data_len = pkts[i]->pkt_len; ids[i] = descs[avail_idx + i].id; } -- 2.17.1