vhost: fix batch dequeue potential buffer overflow

Similar as single dequeue, the multiple accesses of descriptor length
will lead to potential risk. One-time access of descriptor length can
eliminate this risk.

Fixes: 75ed51697820 ("vhost: add packed ring batch dequeue")
Cc: stable@dpdk.org
Signed-off-by: Marvin Liu <yong.liu@intel.com>
Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com>

diff --git a/lib/librte_vhost/virtio_net.c b/lib/librte_vhost/virtio_net.c
index d07b30ed7fc7b3db2f4f2758010e6ddd55ee43bb..7f621fb6dd03d4600f58bd9128ec031e0b45f968 100644 (file)
--- a/lib/librte_vhost/virtio_net.c
+++ b/lib/librte_vhost/virtio_net.c
@@ -2318,7 +2318,7 @@ vhost_reserve_avail_batch_packed(struct virtio_net *dev,
        }
 
        vhost_for_each_try_unroll(i, 0, PACKED_BATCH_SIZE) {
-               pkts[i]->pkt_len = descs[avail_idx + i].len - buf_offset;
+               pkts[i]->pkt_len = lens[i] - buf_offset;
                pkts[i]->data_len = pkts[i]->pkt_len;
                ids[i] = descs[avail_idx + i].id;
        }