Dan Carpenter
2021-Dec-07 11:30 UTC
[PATCH] vduse: fix memory corruption in vduse_dev_ioctl()
On Tue, Dec 07, 2021 at 07:19:35PM +0800, Yongji Xie wrote:> On Tue, Dec 7, 2021 at 6:46 PM Dan Carpenter <dan.carpenter at oracle.com> wrote: > > > > The "config.offset" comes from the user. There needs to a check to > > prevent it being out of bounds. The "config.offset" and > > "dev->config_size" variables are both type u32. So if the offset if > > out of bounds then the "dev->config_size - config.offset" subtraction > > results in a very high u32 value. > > > > Thanks for catching this! I think we also need a fix for > vhost_vdpa_config_validate().Okay. I just sent v2. I'll send a v3. vhost_vdpa_config_validate() uses long type for "size" so the subtract works okay on a 64bit system. regards, dan carpenter