From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A4D03C433C1 for ; Thu, 25 Mar 2021 03:03:54 +0000 (UTC) Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by mail.kernel.org (Postfix) with ESMTP id 334C461580 for ; Thu, 25 Mar 2021 03:03:54 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 334C461580 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=intel.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=dev-bounces@dpdk.org Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 927C1140DA2; Thu, 25 Mar 2021 04:03:49 +0100 (CET) Received: from mga02.intel.com (mga02.intel.com [134.134.136.20]) by mails.dpdk.org (Postfix) with ESMTP id 1BE1640147; Thu, 25 Mar 2021 04:03:45 +0100 (CET) IronPort-SDR: BAEmOzRpN/aWNAxmTXkdlw15s0ozRBeVKy9u5CwG5FEq9OYYkIjhCqUMKX31oRh7c8t7IugRSI KKpkVlxXMiUg== X-IronPort-AV: E=McAfee;i="6000,8403,9933"; a="177953067" X-IronPort-AV: E=Sophos;i="5.81,276,1610438400"; d="scan'208";a="177953067" Received: from orsmga008.jf.intel.com ([10.7.209.65]) by orsmga101.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 24 Mar 2021 20:03:39 -0700 IronPort-SDR: vOsGwhMMcyoL5/j2Ya0AV7AzwWrBRToOIq2XjYmvq1zDlKHTWKN3cZdhaB3YmH7WaX4XRAAtsp FB5mDqaoKXzA== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.81,276,1610438400"; d="scan'208";a="415765165" Received: from npg-dpdk-virtual-marvin-dev.sh.intel.com ([10.67.119.108]) by orsmga008.jf.intel.com with ESMTP; 24 Mar 2021 20:03:38 -0700 From: Marvin Liu To: maxime.coquelin@redhat.com, chenbo.xia@intel.com Cc: dev@dpdk.org, Marvin Liu , stable@dpdk.org Date: Thu, 25 Mar 2021 11:01:39 +0800 Message-Id: <20210325030139.2486-3-yong.liu@intel.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20210325030139.2486-1-yong.liu@intel.com> References: <20210226073321.66996-1-yong.liu@intel.com> <20210325030139.2486-1-yong.liu@intel.com> Subject: [dpdk-dev] [PATCH 3/3] vhost: fix potential buffer overflow when batch dequeue X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" Similar as single dequeue, the multiple accesses of descriptor length will lead to potential risk. One-time access of descriptor length can eliminate this risk. Fixes: 75ed51697820 ("vhost: add packed ring batch dequeue") Cc: stable@dpdk.org Signed-off-by: Marvin Liu Reviewed-by: Maxime Coquelin diff --git a/lib/librte_vhost/virtio_net.c b/lib/librte_vhost/virtio_net.c index de43686522..0a7d008a91 100644 --- a/lib/librte_vhost/virtio_net.c +++ b/lib/librte_vhost/virtio_net.c @@ -2318,7 +2318,7 @@ vhost_reserve_avail_batch_packed(struct virtio_net *dev, } vhost_for_each_try_unroll(i, 0, PACKED_BATCH_SIZE) { - pkts[i]->pkt_len = descs[avail_idx + i].len - buf_offset; + pkts[i]->pkt_len = lens[i] - buf_offset; pkts[i]->data_len = pkts[i]->pkt_len; ids[i] = descs[avail_idx + i].id; } -- 2.17.1