Commit 0e398290 authored by Xie Yongji's avatar Xie Yongji Committed by Michael S. Tsirkin
Browse files

vhost-vdpa: Fix integer overflow in vhost_vdpa_process_iotlb_update() 



The "msg->iova + msg->size" addition can have an integer overflow
if the iotlb message is from a malicious user space application.
So let's fix it.

Fixes: 1b48dc03 ("vhost: vdpa: report iova range")
Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarXie Yongji <xieyongji@bytedance.com>
Acked-by: default avatarJason Wang <jasowang@redhat.com>
Link: https://lore.kernel.org/r/20210728130756.97-1-xieyongji@bytedance.com


Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
parent 43bb40c5

drivers/vhost/vdpa.c

+2 −1
Original line number Diff line number Diff line
@@ -614,7 +614,8 @@ static int vhost_vdpa_process_iotlb_update(struct vhost_vdpa *v, 
	long pinned;

	int ret = 0;



	if (msg->iova < v->range.first ||

	if (msg->iova < v->range.first || !msg->size ||

	    msg->iova > U64_MAX - msg->size + 1 ||

	    msg->iova + msg->size - 1 > v->range.last)

		return -EINVAL;