Commit 99975cc6 authored Jan 07, 2015 by Michael S. Tsirkin

vhost/net: length miscalculation



commit 8b38694a
    vhost/net: virtio 1.0 byte swap
had this chunk:
-       heads[headcount - 1].len += datalen;
+       heads[headcount - 1].len = cpu_to_vhost32(vq, len - datalen);

This adds datalen with the wrong sign, causing guest panics.

Fixes: 8b38694a
Reported-by: Alex Williamson <alex.williamson@redhat.com>
Suggested-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

parent a1eb03f5

drivers/vhost/net.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -538,7 +538,7 @@ static int get_rx_bufs(struct vhost_virtqueue *vq,
		++headcount;
		seg += in;
		}
		heads[headcount - 1].len = cpu_to_vhost32(vq, len - datalen);
		heads[headcount - 1].len = cpu_to_vhost32(vq, len + datalen);
		*iovcount = seg;
		if (unlikely(log))
		*log_num = nlogs;