On Wed, Nov 06, 2024 at 09:44:39AM +0800, Jason Wang wrote:

quoted

quoted

quoted

        while (vq->split.vring.desc[i].flags & nextflag) {
-               vring_unmap_one_split(vq, i);
+               vring_unmap_one_split(vq, &extra[i]);

Not sure if I've asked this before. But this part seems to deserve an
independent fix for -stable.

What fix?

I meant for hardening we need to check the flags stored in the extra
instead of the descriptor itself as it could be mangled by the device.

Thanks

Good point. Jason, want to cook up a patch?

-- 
MST