search for: vring_free_split

Displaying 5 results from an estimated 5 matches for "vring_free_split".

2023 May 26
1
[PATCH] virtio_ring: validate used buffer length
...> vq->split.buflen[i])) { + BAD_RING(vq, "used len %d is larger than max in buffer len %u\n", + *len, vq->split.buflen[i]); + return NULL; + } /* detach_buf_split clears data, so grab it now. */ ret = vq->split.desc_state[i].data; @@ -1085,10 +1105,25 @@ static void vring_free_split(struct vring_virtqueue_split *vring_split, vring_split->queue_dma_addr, dma_dev); + kfree(vring_split->buflen); kfree(vring_split->desc_state); kfree(vring_split->desc_extra); } +static bool vring_needs_used_validation(const struct virtio_device *vdev) +{ + /* + * Se...
2023 May 31
1
[PATCH] virtio_ring: validate used buffer length
...t; > > + } > > > > > > > > > > > > > > /* detach_buf_split clears data, so grab it now. */ > > > > > > > ret = vq->split.desc_state[i].data; > > > > > > > @@ -1085,10 +1105,25 @@ static void vring_free_split(struct vring_virtqueue_split *vring_split, > > > > > > > vring_split->queue_dma_addr, > > > > > > > dma_dev); > > > > > > > > > > > > > > + kfree(vring_split->...
2023 May 31
1
[PATCH] virtio_ring: validate used buffer length
...> > > > > > > > > > > > > > > > /* detach_buf_split clears data, so grab it now. */ > > > > > > > > ret = vq->split.desc_state[i].data; > > > > > > > > @@ -1085,10 +1105,25 @@ static void vring_free_split(struct vring_virtqueue_split *vring_split, > > > > > > > > vring_split->queue_dma_addr, > > > > > > > > dma_dev); > > > > > > > > > > > > > > > > + kf...
2023 Jun 01
1
[PATCH] virtio_ring: validate used buffer length
...> > > > > > > > > > > > > > > > /* detach_buf_split clears data, so grab it now. */ > > > > > > > > ret = vq->split.desc_state[i].data; > > > > > > > > @@ -1085,10 +1105,25 @@ static void vring_free_split(struct vring_virtqueue_split *vring_split, > > > > > > > > vring_split->queue_dma_addr, > > > > > > > > dma_dev); > > > > > > > > > > > > > > > > + kf...
2023 Jun 01
1
[PATCH] virtio_ring: validate used buffer length
...> > > > > > > > > > > > > > /* detach_buf_split clears data, so grab it now. */ > > > > > > > > > ret = vq->split.desc_state[i].data; > > > > > > > > > @@ -1085,10 +1105,25 @@ static void vring_free_split(struct vring_virtqueue_split *vring_split, > > > > > > > > > vring_split->queue_dma_addr, > > > > > > > > > dma_dev); > > > > > > > > > > > > > > > &gt...