Displaying 5 results from an estimated 5 matches for "vring_free_split".
2023 May 26
1
[PATCH] virtio_ring: validate used buffer length
...> vq->split.buflen[i])) {
+ BAD_RING(vq, "used len %d is larger than max in buffer len %u\n",
+ *len, vq->split.buflen[i]);
+ return NULL;
+ }
/* detach_buf_split clears data, so grab it now. */
ret = vq->split.desc_state[i].data;
@@ -1085,10 +1105,25 @@ static void vring_free_split(struct vring_virtqueue_split *vring_split,
vring_split->queue_dma_addr,
dma_dev);
+ kfree(vring_split->buflen);
kfree(vring_split->desc_state);
kfree(vring_split->desc_extra);
}
+static bool vring_needs_used_validation(const struct virtio_device *vdev)
+{
+ /*
+ * Se...
2023 May 31
1
[PATCH] virtio_ring: validate used buffer length
...t; > > + }
> > > > > > >
> > > > > > > /* detach_buf_split clears data, so grab it now. */
> > > > > > > ret = vq->split.desc_state[i].data;
> > > > > > > @@ -1085,10 +1105,25 @@ static void vring_free_split(struct vring_virtqueue_split *vring_split,
> > > > > > > vring_split->queue_dma_addr,
> > > > > > > dma_dev);
> > > > > > >
> > > > > > > + kfree(vring_split->...
2023 May 31
1
[PATCH] virtio_ring: validate used buffer length
...> > > > > > > >
> > > > > > > > /* detach_buf_split clears data, so grab it now. */
> > > > > > > > ret = vq->split.desc_state[i].data;
> > > > > > > > @@ -1085,10 +1105,25 @@ static void vring_free_split(struct vring_virtqueue_split *vring_split,
> > > > > > > > vring_split->queue_dma_addr,
> > > > > > > > dma_dev);
> > > > > > > >
> > > > > > > > + kf...
2023 Jun 01
1
[PATCH] virtio_ring: validate used buffer length
...> > > > > > > >
> > > > > > > > /* detach_buf_split clears data, so grab it now. */
> > > > > > > > ret = vq->split.desc_state[i].data;
> > > > > > > > @@ -1085,10 +1105,25 @@ static void vring_free_split(struct vring_virtqueue_split *vring_split,
> > > > > > > > vring_split->queue_dma_addr,
> > > > > > > > dma_dev);
> > > > > > > >
> > > > > > > > + kf...
2023 Jun 01
1
[PATCH] virtio_ring: validate used buffer length
...> > > > >
> > > > > > > > > /* detach_buf_split clears data, so grab it now. */
> > > > > > > > > ret = vq->split.desc_state[i].data;
> > > > > > > > > @@ -1085,10 +1105,25 @@ static void vring_free_split(struct vring_virtqueue_split *vring_split,
> > > > > > > > > vring_split->queue_dma_addr,
> > > > > > > > > dma_dev);
> > > > > > > > >
> > > > > > >...