Jason Wang e7f9c883b9 UPSTREAM: virtio-blk: validate num_queues during probe ...

If an untrusted device neogitates BLK_F_MQ but advertises a zero
num_queues, the driver may end up trying to allocating zero size
buffers where ZERO_SIZE_PTR is returned which may pass the checking
against the NULL. This will lead unexpected results.

Fixing this by failing the probe in this case.

Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Stefan Hajnoczi <stefanha@redhat.com>
Cc: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Link: https://lore.kernel.org/r/20211019070152.8236-2-jasowang@redhat.com
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
(cherry picked from commit 6ae6ff6f6e)
Bug: 196772804
Signed-off-by: Keir Fraser <keirf@google.com>
Change-Id: I8a4dbd80bdf8e7d41013e43d069b04af9c35e200

2022-03-08 09:46:52 +00:00

..

aoe

block: lift setting the readahead size into the block layer

2020-09-24 13:43:39 -06:00

drbd

Merge tag 'block-5.10-2020-10-12' of git://git.kernel.dk/linux-block

2020-10-13 12:12:44 -07:00

mtip32xx

blk-mq: move failure injection out of blk_mq_complete_request

2020-06-24 09:15:57 -06:00

paride

paride/pcd: use bdev_check_media_change

2020-09-10 09:32:31 -06:00

rnbd

block/rnbd-clt: Check the return value of the function rtrs_clt_query

2021-05-19 10:13:06 +02:00

rsxx

block: rsxx: fix error return code of rsxx_pci_probe()

2021-03-17 17:06:33 +01:00

xen-blkback

Merge remote-tracking branch 'aosp/upstream-f2fs-stable-linux-5.10.y' into android13-5.10

2021-10-13 09:50:36 -07:00

zram

Merge 5.10.80 into android13-5.10

2021-11-19 07:47:18 +01:00

amiflop.c

amiflop: use bdev_check_media_change

2020-09-10 09:32:30 -06:00

ataflop.c

ataflop: use bdev_check_media_change

2020-09-10 09:32:30 -06:00

brd.c

bdi: remove BDI_CAP_SYNCHRONOUS_IO

2020-09-24 13:43:39 -06:00

cryptoloop.c

cryptoloop: add a deprecation warning

2021-09-08 08:49:01 +02:00

floppy.c

floppy: Add max size check for user space request

2022-01-27 10:54:14 +01:00

Kconfig

cryptoloop: add a deprecation warning

2021-09-08 08:49:01 +02:00

loop.c

Merge 5.10.81 into android13-5.10

2021-11-21 14:21:53 +01:00

loop.h

block/loop: Use global lock for ioctl() operation.

2018-11-08 06:30:11 -07:00

Makefile

block/rnbd: include client and server modules into kernel compilation

2020-05-17 18:57:17 -03:00

nbd.c

Revert "block: nbd: add sanity check for first_minor"

2021-09-16 12:51:23 +02:00

null_blk_main.c

null_blk: fix command timeout completion handling

2021-04-16 11:43:21 +02:00

null_blk_trace.c

null_blk: add tracepoint helpers for zoned mode

2020-03-27 13:39:10 -06:00

null_blk_trace.h

null_blk: add tracepoint helpers for zoned mode

2020-03-27 13:39:10 -06:00

null_blk_zoned.c

drivers/block/null_blk/main: Fix a double free in null_init.

2021-05-14 09:50:28 +02:00

null_blk.h

null_blk: fix command timeout completion handling

2021-04-16 11:43:21 +02:00

pktcdvd.c

pktcdvd: use blkdev_get_by_dev instead of open coding it

2020-09-23 10:43:19 -06:00

ps3disk.c

ps3disk: use the default segment boundary

2020-05-19 00:10:35 +10:00

ps3vram.c

block: move ->make_request_fn to struct block_device_operations

2020-07-01 07:27:24 -06:00

rbd_types.h

libceph, rbd: replace zero-length array with flexible-array

2020-06-01 13:22:53 +02:00

rbd.c

rbd: always kick acquire on "acquired" and "released" notifications

2021-07-28 14:35:46 +02:00

skd_main.c

skd_main: remove unused including <linux/version.h>

2020-10-17 08:11:14 -06:00

skd_s1120.h

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 497

2019-06-19 17:09:53 +02:00

sunvdc.c

compat_ioctl: block: handle cdrom compat ioctl in non-cdrom drivers

2020-01-03 09:33:15 +01:00

swim3.c

swim3: use bdev_check_media_changed

2020-09-10 09:32:31 -06:00

swim_asm.S

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152

2019-05-30 11:26:32 -07:00

swim.c

swim: simplify media change handling

2020-09-10 09:32:30 -06:00

sx8.c

sx8: use a per-host tag_set

2018-11-09 08:14:14 -07:00

umem.c

umem: fix error return code in mm_pci_probe()

2021-03-30 14:31:50 +02:00

umem.h

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 348

2019-06-05 17:37:08 +02:00

virtio_blk.c

UPSTREAM: virtio-blk: validate num_queues during probe

2022-03-08 09:46:52 +00:00

xen-blkfront.c

xen/blkfront: harden blkfront against event channel storms

2021-12-22 09:30:59 +01:00

xsysace.c

xsysace: use platform_get_resource() and platform_get_irq_optional()

2020-10-29 08:22:33 -06:00

z2ram.c

mm: reorder includes after introduction of linux/pgtable.h

2020-06-09 09:39:13 -07:00