From b7aabd7a87cee66ec3c8e010ee45e0ca70d0d914 Mon Sep 17 00:00:00 2001 From: Maxime Coquelin Date: Mon, 25 Jul 2016 16:09:58 +0200 Subject: [PATCH] vhost: fix off-by-one error on descriptor number check nr_desc is not an index but the number of descriptors, so can be equal to the virtqueue size. Fixes: a436f53ebfeb ("vhost: avoid dead loop chain") Signed-off-by: Maxime Coquelin Acked-by: Yuanhan Liu --- lib/librte_vhost/vhost_rxtx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/librte_vhost/vhost_rxtx.c b/lib/librte_vhost/vhost_rxtx.c index bc00518ad2..08a73fd04b 100644 --- a/lib/librte_vhost/vhost_rxtx.c +++ b/lib/librte_vhost/vhost_rxtx.c @@ -748,7 +748,7 @@ copy_desc_to_mbuf(struct virtio_net *dev, struct vhost_virtqueue *vq, break; if (unlikely(desc->next >= vq->size || - ++nr_desc >= vq->size)) + ++nr_desc > vq->size)) return -1; desc = &vq->desc[desc->next]; -- 2.20.1