From c6ae7de0defc1ac4c9036a6a3395eb196422bbf7 Mon Sep 17 00:00:00 2001 From: Maxime Coquelin Date: Tue, 23 Jan 2018 09:51:29 +0100 Subject: [PATCH] vhost: fix indirect descriptors table translation size This patch fixes the size passed at the indirect descriptor table translation time, which is the len field of the descriptor, and not a single descriptor. This issue has been assigned CVE-2018-1059. Fixes: 62fdb8255ae7 ("vhost: use the guest IOVA to host VA helper") Signed-off-by: Maxime Coquelin --- lib/librte_vhost/virtio_net.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/librte_vhost/virtio_net.c b/lib/librte_vhost/virtio_net.c index ed7198dbbc..108f4deff2 100644 --- a/lib/librte_vhost/virtio_net.c +++ b/lib/librte_vhost/virtio_net.c @@ -1261,7 +1261,7 @@ rte_vhost_dequeue_burst(int vid, uint16_t queue_id, desc = (struct vring_desc *)(uintptr_t) vhost_iova_to_vva(dev, vq, vq->desc[desc_indexes[i]].addr, - sizeof(*desc), + vq->desc[desc_indexes[i]].len, VHOST_ACCESS_RO); if (unlikely(!desc)) break; -- 2.20.1