[2/3] vhost: fix packed ring potential buffer overflow
Checks
Commit Message
Similar as split ring, the multiple accesses of descriptor length will
lead to potential risk. One-time access of descriptor length can
eliminate this risk.
Fixes: 2f3225a7d69b ("vhost: add vector filling support for packed ring")
Cc: stable@dpdk.org
Signed-off-by: Marvin Liu <yong.liu@intel.com>
Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com>
@@ -669,9 +669,10 @@ fill_vec_buf_packed_indirect(struct virtio_net *dev,
return -1;
}
- *len += descs[i].len;
+ dlen = descs[i].len;
+ *len += dlen;
if (unlikely(map_one_desc(dev, vq, buf_vec, &vec_id,
- descs[i].addr, descs[i].len,
+ descs[i].addr, dlen,
perm)))
return -1;
}
@@ -692,6 +693,7 @@ fill_vec_buf_packed(struct virtio_net *dev, struct vhost_virtqueue *vq,
bool wrap_counter = vq->avail_wrap_counter;
struct vring_packed_desc *descs = vq->desc_packed;
uint16_t vec_id = *vec_idx;
+ uint64_t dlen;
if (avail_idx < vq->last_avail_idx)
wrap_counter ^= 1;
@@ -724,11 +726,12 @@ fill_vec_buf_packed(struct virtio_net *dev, struct vhost_virtqueue *vq,
len, perm) < 0))
return -1;
} else {
- *len += descs[avail_idx].len;
+ dlen = descs[avail_idx].len;
+ *len += dlen;
if (unlikely(map_one_desc(dev, vq, buf_vec, &vec_id,
descs[avail_idx].addr,
- descs[avail_idx].len,
+ dlen,
perm)))
return -1;
}