vhost: make sure log_num < in_num (ba03ee62) · Commits · e / devices / android_kernel_fairphone_FP4

commit 060423bfdee3f8bc6e2c1bac97de24d5415e2bc4 upstream. The code assumes log_num < in_num everywhere, and that is true as long as in_num is incremented by descriptor iov count, and log_num by 1. However this breaks if there's a zero sized descriptor. As a result, if a malicious guest creates a vring desc with desc.len = 0, it may cause the host kernel to crash by overflowing the log array. This bug can be triggered during the VM migration. There's no need to log when desc.len = 0, so just don't increment log_num in this case. Fixes: ("vhost_net: a kernel-level virtio server") Cc: stable@vger.kernel.org Reviewed-by:

Lidong Chen <lidongchen@tencent.com> Signed-off-by:

ruippan <ruippan@tencent.com> Signed-off-by:

yongduan <yongduan@tencent.com> Acked-by:

Michael S. Tsirkin <mst@redhat.com> Reviewed-by:

Tyler Hicks <tyhicks@canonical.com> Signed-off-by:

Michael S. Tsirkin <mst@redhat.com> Signed-off-by:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drivers/vhost/vhost.c

+2 −2

Original line number	Original line	Diff line number	Diff line
	@@ -2073,7 +2073,7 @@ static int get_indirect(struct vhost_virtqueue *vq,
	/* If this is an input descriptor, increment that count. */		/* If this is an input descriptor, increment that count. */
	if (access == VHOST_ACCESS_WO) {		if (access == VHOST_ACCESS_WO) {
	*in_num += ret;		*in_num += ret;
	if (unlikely(log)) {		if (unlikely(log && ret)) {
	log[*log_num].addr = vhost64_to_cpu(vq, desc.addr);		log[*log_num].addr = vhost64_to_cpu(vq, desc.addr);
	log[*log_num].len = vhost32_to_cpu(vq, desc.len);		log[*log_num].len = vhost32_to_cpu(vq, desc.len);
	++*log_num;		++*log_num;
	@@ -2216,7 +2216,7 @@ int vhost_get_vq_desc(struct vhost_virtqueue *vq,
	/* If this is an input descriptor,		/* If this is an input descriptor,
	* increment that count. */		* increment that count. */
	*in_num += ret;		*in_num += ret;
	if (unlikely(log)) {		if (unlikely(log && ret)) {
	log[*log_num].addr = vhost64_to_cpu(vq, desc.addr);		log[*log_num].addr = vhost64_to_cpu(vq, desc.addr);
	log[*log_num].len = vhost32_to_cpu(vq, desc.len);		log[*log_num].len = vhost32_to_cpu(vq, desc.len);
	++*log_num;		++*log_num;