vhost: fix packed ring potential buffer overflow

Similar as split ring, the multiple accesses of descriptor length will
lead to potential risk. One-time access of descriptor length can
eliminate this risk.

Fixes: 2f3225a7d69b ("vhost: add vector filling support for packed ring")
Cc: stable@dpdk.org
Signed-off-by: Marvin Liu <yong.liu@intel.com>
Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com>

diff --git a/lib/librte_vhost/virtio_net.c b/lib/librte_vhost/virtio_net.c
index 852b4ec..d07b30e 100644 (file)
--- a/lib/librte_vhost/virtio_net.c
+++ b/lib/librte_vhost/virtio_net.c
@@ -669,9 +669,10 @@ fill_vec_buf_packed_indirect(struct virtio_net *dev,
                        return -1;
                }
 
-               *len += descs[i].len;
+               dlen = descs[i].len;
+               *len += dlen;
                if (unlikely(map_one_desc(dev, vq, buf_vec, &vec_id,
-                                               descs[i].addr, descs[i].len,
+                                               descs[i].addr, dlen,
                                                perm)))
                        return -1;
        }
@@ -692,6 +693,7 @@ fill_vec_buf_packed(struct virtio_net *dev, struct vhost_virtqueue *vq,
        bool wrap_counter = vq->avail_wrap_counter;
        struct vring_packed_desc *descs = vq->desc_packed;
        uint16_t vec_id = *vec_idx;
+       uint64_t dlen;
 
        if (avail_idx < vq->last_avail_idx)
                wrap_counter ^= 1;
@@ -724,11 +726,12 @@ fill_vec_buf_packed(struct virtio_net *dev, struct vhost_virtqueue *vq,
                                                        len, perm) < 0))
                                return -1;
                } else {
-                       *len += descs[avail_idx].len;
+                       dlen = descs[avail_idx].len;
+                       *len += dlen;
 
                        if (unlikely(map_one_desc(dev, vq, buf_vec, &vec_id,
                                                        descs[avail_idx].addr,
-                                                       descs[avail_idx].len,
+                                                       dlen,
                                                        perm)))
                                return -1;
                }