From: Marvin Liu Date: Wed, 31 Mar 2021 06:49:39 +0000 (+0800) Subject: vhost: fix batch dequeue potential buffer overflow X-Git-Url: http://git.droids-corp.org/?a=commitdiff_plain;h=af584d21bf66047e36ad3b9ccdcfd83ecdccd5db;p=dpdk.git vhost: fix batch dequeue potential buffer overflow Similar as single dequeue, the multiple accesses of descriptor length will lead to potential risk. One-time access of descriptor length can eliminate this risk. Fixes: 75ed51697820 ("vhost: add packed ring batch dequeue") Cc: stable@dpdk.org Signed-off-by: Marvin Liu Reviewed-by: Maxime Coquelin --- diff --git a/lib/librte_vhost/virtio_net.c b/lib/librte_vhost/virtio_net.c index d07b30ed7f..7f621fb6dd 100644 --- a/lib/librte_vhost/virtio_net.c +++ b/lib/librte_vhost/virtio_net.c @@ -2318,7 +2318,7 @@ vhost_reserve_avail_batch_packed(struct virtio_net *dev, } vhost_for_each_try_unroll(i, 0, PACKED_BATCH_SIZE) { - pkts[i]->pkt_len = descs[avail_idx + i].len - buf_offset; + pkts[i]->pkt_len = lens[i] - buf_offset; pkts[i]->data_len = pkts[i]->pkt_len; ids[i] = descs[avail_idx + i].id; }