shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-06 19:08:57 +09:00
Code Issues Packages Projects Releases Wiki Activity

virtio-blk: validate num_queues during probe

Browse Source 
If an untrusted device neogitates BLK_F_MQ but advertises a zero
num_queues, the driver may end up trying to allocating zero size
buffers where ZERO_SIZE_PTR is returned which may pass the checking
against the NULL. This will lead unexpected results.

Fixing this by failing the probe in this case.

Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Stefan Hajnoczi <stefanha@redhat.com>
Cc: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Link: https://lore.kernel.org/r/20211019070152.8236-2-jasowang@redhat.com
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
This commit is contained in:
Jason Wang
2021-10-19 15:01:43 +08:00
committed by Michael S. Tsirkin
parent f1429e6c36
commit 6ae6ff6f6e
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/block/virtio_blk.c
View File

@@ -571,6 +571,10 @@ static int init_vq(struct virtio_blk *vblk)
&num_vqs); &num_vqs);
if (err) if (err)
num_vqs = 1; num_vqs = 1;
if (!err && !num_vqs) {
dev_err(&vdev->dev, "MQ advertisted but zero queues reported\n");
return -EINVAL;
}
num_vqs = min_t(unsigned int, num_vqs = min_t(unsigned int,
min_not_zero(num_request_queues, nr_cpu_ids), min_not_zero(num_request_queues, nr_cpu_ids),