system/linux
system/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux synced 2024-10-14 23:39:09 +00:00
Code Issues Packages Projects Releases Wiki Activity
linux/drivers/vdpa
History
Dan Carpenter ff9f9c6e74 vduse: fix memory corruption in vduse_dev_ioctl() 
The "config.offset" comes from the user.  There needs to a check to
prevent it being out of bounds.  The "config.offset" and
"dev->config_size" variables are both type u32.  So if the offset if
out of bounds then the "dev->config_size - config.offset" subtraction
results in a very high u32 value.  The out of bounds offset can result
in memory corruption.

Fixes: c8a6153b6c ("vduse: Introduce VDUSE - vDPA Device in Userspace")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/20211208103307.GA3778@kili
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Cc: stable@vger.kernel.org
2021-12-08 14:53:15 -05:00
..
alibaba eni_vdpa: add vDPA driver for Alibaba ENI 2021-11-01 05:23:41 -04:00
ifcvf vdpa: Enable user to set mac and mtu of vdpa device 2021-11-01 05:26:49 -04:00
mlx5 vhost,virtio,vhost: fixes,features 2021-11-03 15:00:39 -07:00
vdpa_sim vdpa_sim: avoid putting an uninitialized iova_domain 2021-11-24 19:00:29 -05:00
vdpa_user vduse: fix memory corruption in vduse_dev_ioctl() 2021-12-08 14:53:15 -05:00
virtio_pci vp_vdpa: add vq irq offloading support 2021-11-01 04:30:34 -04:00
Kconfig eni_vdpa: add vDPA driver for Alibaba ENI 2021-11-01 05:23:41 -04:00
Makefile eni_vdpa: add vDPA driver for Alibaba ENI 2021-11-01 05:23:41 -04:00
vdpa.c vdpa: Enable user to set mac and mtu of vdpa device 2021-11-01 05:26:49 -04:00