> move_to_indirect() accepts an indirect descriptor with a zero length,
> setting desc_max to 0. __vringh_iov() then reads descs[0] before
> checking the descriptor bounds, resulting in an out-of-bounds read.
>
> Reject a zero-length indirect table in move_to_indirect() so the
> caller returns -EINVAL before dereferencing the table. Also use the
> converted length in the warning to report invalid lengths correctly
> when the vring byte order differs from the CPU byte order.
>
> Fixes: f87d0fbb5798 ("vringh: host-side implementation of virtio rings.")
> Cc: [email protected]
> Reviewed-by: Guanglei Zhu <[email protected]>
> Signed-off-by: Fang Xieyan <[email protected]>
Sashiko has reviewed this patch and found no issues.
--
Sashiko AI review ยท
https://sashiko.dev/#/patchset/[email protected]?part=1
