d/numam-dpdk
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

vhost: fix queue number check when setting inflight FD

Browse Source 
In function vhost_user_set_inflight_fd, queue number in inflight
message is used to access virtqueue. However, queue number could
be larger than VHOST_MAX_VRING and cause write OOB as this number
will be used to write inflight info in virtqueue structure. This
patch checks the queue number to avoid the issue and also make
sure virtqueues are allocated before setting inflight information.

Fixes: ad0a4ae491 ("vhost: checkout resubmit inflight information")
Cc: stable@dpdk.org

Reported-by: Wenxiang Qian <leonwxqian@gmail.com>
Signed-off-by: Chenbo Xia <chenbo.xia@intel.com>
Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com>
This commit is contained in:
Chenbo Xia 2022-02-14 16:32:37 +08:00 committed by David Marchand
parent 312b94ef88
commit 6442c329b9
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
lib/vhost/vhost_user.c
View File

@ -2883,6 +2883,9 @@ vhost_user_check_and_alloc_queue_pair(struct virtio_net *dev,
case VHOST_USER_SET_VRING_ADDR:
vring_idx = ctx->msg.payload.addr.index;
break;
case VHOST_USER_SET_INFLIGHT_FD:
vring_idx = ctx->msg.payload.inflight.num_queues - 1;
break;
default:
return 0;
}