yongduan 8d8276867b vhost: make sure log_num < in_num ...

commit 060423bfde upstream.

The code assumes log_num < in_num everywhere, and that is true as long as
in_num is incremented by descriptor iov count, and log_num by 1. However
this breaks if there's a zero sized descriptor.

As a result, if a malicious guest creates a vring desc with desc.len = 0,
it may cause the host kernel to crash by overflowing the log array. This
bug can be triggered during the VM migration.

There's no need to log when desc.len = 0, so just don't increment log_num
in this case.

Fixes: 3a4d5c94e9 ("vhost_net: a kernel-level virtio server")
Cc: stable@vger.kernel.org
Reviewed-by: Lidong Chen <lidongchen@tencent.com>
Signed-off-by: ruippan <ruippan@tencent.com>
Signed-off-by: yongduan <yongduan@tencent.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Tyler Hicks <tyhicks@canonical.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2019-09-16 08:19:34 +02:00

..

Kconfig

vhost: split out vringh Kconfig

2016-08-02 16:54:28 +03:00

Kconfig.vringh

vhost: split out vringh Kconfig

2016-08-02 16:54:28 +03:00

Makefile

VSOCK: Add Makefile and Kconfig

2016-08-02 02:57:30 +03:00

net.c

vhost_net: fix possible infinite loop

2019-08-25 10:51:42 +02:00

scsi.c

vhost: scsi: add weight support

2019-08-25 10:51:42 +02:00

test.c

vhost/test: fix build for vhost test

2019-09-16 08:19:33 +02:00

test.h

vhost test module

2010-12-09 16:00:21 +02:00

vhost.c

vhost: make sure log_num < in_num

2019-09-16 08:19:34 +02:00

vhost.h

vhost: introduce vhost_exceeds_weight()

2019-08-25 10:51:41 +02:00

vringh.c

vringh: update for virtio 1.0 APIs

2014-12-15 23:49:28 +02:00

vsock.c

vhost: introduce vhost_exceeds_weight()

2019-08-25 10:51:41 +02:00