shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-07 11:26:02 +09:00
Code Issues Packages Projects Releases Wiki Activity

UPSTREAM: virtio-blk: validate num_queues during probe

Browse Source 
If an untrusted device neogitates BLK_F_MQ but advertises a zero
num_queues, the driver may end up trying to allocating zero size
buffers where ZERO_SIZE_PTR is returned which may pass the checking
against the NULL. This will lead unexpected results.

Fixing this by failing the probe in this case.

Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Stefan Hajnoczi <stefanha@redhat.com>
Cc: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Link: https://lore.kernel.org/r/20211019070152.8236-2-jasowang@redhat.com
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
(cherry picked from commit 6ae6ff6f6e)
Bug: 196772804
Signed-off-by: Keir Fraser <keirf@google.com>
Change-Id: I8a4dbd80bdf8e7d41013e43d069b04af9c35e200
This commit is contained in:
Jason Wang
2021-10-19 15:01:43 +08:00
committed by Keir Fraser
parent e085ccb3db
commit 03094c3abe
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/block/virtio_blk.c
View File

@@ -499,6 +499,10 @@ static int init_vq(struct virtio_blk *vblk)
&num_vqs);
if (err)
num_vqs = 1;
if (!err && !num_vqs) {
dev_err(&vdev->dev, "MQ advertisted but zero queues reported\n");
return -EINVAL;
}
num_vqs = min_t(unsigned int, nr_cpu_ids, num_vqs);