On Wed, Oct 21, 2026 at 03:02:42PM +0800, Fang Xieyan wrote:
> move_to_indirect() accepts an indirect descriptor with a zero length,
> setting desc_max to 0. __vringh_iov() then reads descs[0] before
> checking the descriptor bounds, resulting in an out-of-bounds read.
>
> Reject a zero-length indirect table in move_to_indirect() so the
> caller returns -EINVAL before dereferencing the table. Also use the
> converted length in the warning to report invalid lengths correctly
> when the vring byte order differs from the CPU byte order.
>
> Fixes: f87d0fbb5798 ("vringh: host-side implementation of virtio rings.")
> Cc: [email protected]
> Reviewed-by: Guanglei Zhu <[email protected]>
> Signed-off-by: Fang Xieyan <[email protected]>
Isn't this already addressed by
Subject: [PATCH v2] vringh: reject empty / undersized indirect descriptor tables
that you posted previously?
> ---
> drivers/vhost/vringh.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c
> index 9066f9f12ba1..ce4f5a02c8d2 100644
> --- a/drivers/vhost/vringh.c
> +++ b/drivers/vhost/vringh.c
> @@ -197,8 +197,8 @@ static int move_to_indirect(const struct vringh *vrh,
> }
>
> len = vringh32_to_cpu(vrh, desc->len);
> - if (unlikely(len % sizeof(struct vring_desc))) {
> - vringh_bad("Strange indirect len %u", desc->len);
> + if (unlikely(!len || len % sizeof(struct vring_desc))) {
> + vringh_bad("Strange indirect len %u", len);
> return -EINVAL;
> }
>
> --
> 2.50.1
