Re: [PATCH] vduse: fix memory corruption in vduse_dev_ioctl()
From: Dan Carpenter <hidden>
Date: 2021-12-07 11:30:42
Also in:
kernel-janitors
On Tue, Dec 07, 2021 at 07:19:35PM +0800, Yongji Xie wrote:
On Tue, Dec 7, 2021 at 6:46 PM Dan Carpenter [off-list ref] wrote:quoted
The "config.offset" comes from the user. There needs to a check to prevent it being out of bounds. The "config.offset" and "dev->config_size" variables are both type u32. So if the offset if out of bounds then the "dev->config_size - config.offset" subtraction results in a very high u32 value.Thanks for catching this! I think we also need a fix for vhost_vdpa_config_validate().
Okay. I just sent v2. I'll send a v3. vhost_vdpa_config_validate() uses long type for "size" so the subtract works okay on a 64bit system. regards, dan carpenter _______________________________________________ Virtualization mailing list Virtualization@lists.linux-foundation.org https://lists.linuxfoundation.org/mailman/listinfo/virtualization