summaryrefslogtreecommitdiffstats
path: root/drivers/vhost
diff options
context:
space:
mode:
authorJason Wang <jasowang@redhat.com>2019-04-09 12:10:25 +0800
committerDavid S. Miller <davem@davemloft.net>2019-04-10 22:45:38 -0700
commit813dbeb656d6c90266f251d8bd2b02d445afa63f (patch)
tree24909b6cd09af83979b11b7e7b6f5b7cc2d2ba35 /drivers/vhost
parentb4f47f3848eb70986f75d06112af7b48b7f5f462 (diff)
downloadlinux-813dbeb656d6c90266f251d8bd2b02d445afa63f.tar.gz
linux-813dbeb656d6c90266f251d8bd2b02d445afa63f.tar.bz2
linux-813dbeb656d6c90266f251d8bd2b02d445afa63f.zip
vhost: reject zero size iova range
We used to accept zero size iova range which will lead a infinite loop in translate_desc(). Fixing this by failing the request in this case. Reported-by: syzbot+d21e6e297322a900c128@syzkaller.appspotmail.com Fixes: 6b1e6cc7 ("vhost: new device IOTLB API") Signed-off-by: Jason Wang <jasowang@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/vhost')
-rw-r--r--drivers/vhost/vhost.c6
1 files changed, 5 insertions, 1 deletions
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index 5ace833de746..351af88231ad 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -911,8 +911,12 @@ static int vhost_new_umem_range(struct vhost_umem *umem,
u64 start, u64 size, u64 end,
u64 userspace_addr, int perm)
{
- struct vhost_umem_node *tmp, *node = kmalloc(sizeof(*node), GFP_ATOMIC);
+ struct vhost_umem_node *tmp, *node;
+ if (!size)
+ return -EFAULT;
+
+ node = kmalloc(sizeof(*node), GFP_ATOMIC);
if (!node)
return -ENOMEM;