vhost: fix translated address not checked
authorMarvin Liu <yong.liu@intel.com>
Mon, 18 May 2020 13:17:02 +0000 (14:17 +0100)
committerDavid Marchand <david.marchand@redhat.com>
Mon, 18 May 2020 13:22:42 +0000 (15:22 +0200)
commit97ecc1c85c95c13bc66a87435758e93406c35c48
tree7f926a8673e59ffc2472ef24be57d6f3774b64d1
parentacd4c92fa693bbea695f2bb42bb93fb8567c3ca5
vhost: fix translated address not checked

Malicious guest can construct desc with invalid address and zero buffer
length. That will request vhost to check both translated address and
translated data length. This patch will add missed address check.

CVE-2020-10725
Fixes: 75ed51697820 ("vhost: add packed ring batch dequeue")
Fixes: ef861692c398 ("vhost: add packed ring batch enqueue")
Cc: stable@dpdk.org
Signed-off-by: Marvin Liu <yong.liu@intel.com>
Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com>
lib/librte_vhost/virtio_net.c