Re: [PATCH v2] vduse: Fix off by one in vduse_dev_mmap()

2024-02-28 Thread Dan Carpenter
On Wed, Feb 28, 2024 at 12:53:28PM -0500, Stefan Hajnoczi wrote: > On Wed, 28 Feb 2024 at 12:44, Dan Carpenter wrote: > > > > The dev->vqs[] array has "dev->vq_num" elements. It's allocated in > > vduse_dev_init_vqs(). Thus, this > comparison needs to be >= to avoid > > reading one element

Re: [PATCH v2] vduse: Fix off by one in vduse_dev_mmap()

2024-02-28 Thread Stefan Hajnoczi
On Wed, 28 Feb 2024 at 12:44, Dan Carpenter wrote: > > The dev->vqs[] array has "dev->vq_num" elements. It's allocated in > vduse_dev_init_vqs(). Thus, this > comparison needs to be >= to avoid > reading one element beyond the end of the array. > > Add an array_index_nospec() as well to prevent

[PATCH v2] vduse: Fix off by one in vduse_dev_mmap()

2024-02-28 Thread Dan Carpenter
The dev->vqs[] array has "dev->vq_num" elements. It's allocated in vduse_dev_init_vqs(). Thus, this > comparison needs to be >= to avoid reading one element beyond the end of the array. Add an array_index_nospec() as well to prevent speculation issues. Fixes: 316ecd1346b0 ("vduse: Add file