before caluclating payload letght, otherwise size->len can
underflow.
https://virtuozzo.atlassian.net/browse/VSTOR-134034
Signed-off-by: Andrey Zhadchenko <[email protected]>
---
drivers/vhost/blk.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/vhost/blk.c b/drivers/vhost/blk.c
index 00101816e7694..fb70b381eae92 100644
--- a/drivers/vhost/blk.c
+++ b/drivers/vhost/blk.c
@@ -458,6 +458,9 @@ static int vhost_blk_req_handle(struct vhost_virtqueue *vq,
req->iov = blk_vq->iov;
req->bio_err = 0;
+ if (iov_length(vq->iov, total_iov_nr) < sizeof(status))
+ return -EINVAL;
+
req->len = iov_length(vq->iov, total_iov_nr) - sizeof(status);
req->iov_nr = move_iovec(vq->iov, req->iov, req->len, total_iov_nr,
ARRAY_SIZE(blk_vq->iov));
--
2.43.5
_______________________________________________
Devel mailing list
[email protected]
https://lists.openvz.org/mailman/listinfo/devel
