]> git.droids-corp.org - dpdk.git/commitdiff
vhost/crypto: fix data length check
authorFan Zhang <roy.fan.zhang@intel.com>
Mon, 28 Sep 2020 10:59:17 +0000 (11:59 +0100)
committerThomas Monjalon <thomas@monjalon.net>
Mon, 28 Sep 2020 11:19:13 +0000 (13:19 +0200)
This patch fixes the incorrect data length check to vhost crypto.
Instead of blindly accepting the descriptor length as data length, the
change compare the request provided data length and descriptor length
first. The security issue CVE-2020-14374 is not fixed alone by this
patch, part of the fix is done through:
"vhost/crypto: fix missed request check for copy mode".

CVE-2020-14374
Fixes: 3c79609fda7c ("vhost/crypto: handle virtually non-contiguous buffers")
Cc: stable@dpdk.org
Signed-off-by: Fan Zhang <roy.fan.zhang@intel.com>
Acked-by: Chenbo Xia <chenbo.xia@intel.com>
lib/librte_vhost/vhost_crypto.c

index f1cc32a9b22eae4ecad50341497364ec56549b3a..cf9aa2566b6e6b5fb56033f00327c3e71a3c4cce 100644 (file)
@@ -624,7 +624,7 @@ copy_data(void *dst_data, struct vhost_crypto_data_req *vc_req,
                desc = &vc_req->head[desc->next];
                rte_prefetch0(&vc_req->head[desc->next]);
                to_copy = RTE_MIN(desc->len, (uint32_t)left);
-               dlen = desc->len;
+               dlen = to_copy;
                src = IOVA_TO_VVA(uint8_t *, vc_req, desc->addr, &dlen,
                                VHOST_ACCESS_RO);
                if (unlikely(!src || !dlen)) {