diff mbox series

[4/6] vhost: fix possible out of bound access in vector filling

Message ID 20190104040642.27463-5-tiwei.bie@intel.com (mailing list archive)
State Accepted, archived
Delegated to: Maxime Coquelin
Headers
Series Some fixes for vhost |

Checks

Context Check Description
ci/checkpatch success coding style OK
ci/Intel-compilation success Compilation OK

Commit Message

Tiwei Bie Jan. 4, 2019, 4:06 a.m. UTC 
  Fixes: 7f74b95c444f ("vhost: pre update used ring for Tx and Rx")
Cc: stable@dpdk.org

Signed-off-by: Tiwei Bie <tiwei.bie@intel.com>
---
 lib/librte_vhost/virtio_net.c | 3 +++
 1 file changed, 3 insertions(+)

Comments

Maxime Coquelin Jan. 4, 2019, 8:46 a.m. UTC | #1 
On 1/4/19 5:06 AM, Tiwei Bie wrote:
> Fixes: 7f74b95c444f ("vhost: pre update used ring for Tx and Rx")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Tiwei Bie <tiwei.bie@intel.com>
> ---
>   lib/librte_vhost/virtio_net.c | 3 +++
>   1 file changed, 3 insertions(+)
> 

Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com>

Thanks,
Maxime
diff mbox series

Patch

diff --git a/lib/librte_vhost/virtio_net.c b/lib/librte_vhost/virtio_net.c
index 474acf64d..d64c355b9 100644
--- a/lib/librte_vhost/virtio_net.c
+++ b/lib/librte_vhost/virtio_net.c
@@ -312,6 +312,9 @@  fill_vec_buf_split(struct virtio_net *dev, struct vhost_virtqueue *vq,
 	struct vring_desc *descs = vq->desc;
 	struct vring_desc *idesc = NULL;
 
+	if (unlikely(idx >= vq->size))
+		return -1;
+
 	*desc_chain_head = idx;
 
 	if (vq->desc[idx].flags & VRING_DESC_F_INDIRECT) {