lkml.org 
[lkml]   [2021]   [Dec]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.15 023/177] vdpa: check that offsets are within bounds
    Date
    From: Dan Carpenter <dan.carpenter@oracle.com>

    commit 3ed21c1451a14d139e1ceb18f2fa70865ce3195a upstream.

    In this function "c->off" is a u32 and "size" is a long. On 64bit systems
    if "c->off" is greater than "size" then "size - c->off" is a negative and
    we always return -E2BIG. But on 32bit systems the subtraction is type
    promoted to a high positive u32 value and basically any "c->len" is
    accepted.

    Fixes: 4c8cf31885f6 ("vhost: introduce vDPA-based backend")
    Reported-by: Xie Yongji <xieyongji@bytedance.com>
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Link: https://lore.kernel.org/r/20211208103337.GA4047@kili
    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/vhost/vdpa.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/drivers/vhost/vdpa.c
    +++ b/drivers/vhost/vdpa.c
    @@ -197,7 +197,7 @@ static int vhost_vdpa_config_validate(st
    struct vdpa_device *vdpa = v->vdpa;
    long size = vdpa->config->get_config_size(vdpa);

    - if (c->len == 0)
    + if (c->len == 0 || c->off > size)
    return -EINVAL;

    if (c->len > size - c->off)

    \
     
     \ /
      Last update: 2021-12-20 15:57    [W:5.343 / U:0.112 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site