Home Home > GIT Browse > SLE15
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorTakashi Iwai <tiwai@suse.de>2019-09-17 10:48:57 +0200
committerTakashi Iwai <tiwai@suse.de>2019-09-17 10:48:57 +0200
commit50a17dfdbeb63119252bda932f47317fe8b0a620 (patch)
treeba2b68c3f7658e49e61bd24f74a6335ddc613a9a
parentcbe58dd3768d3373ace855f501056777bace42fd (diff)
vhost: make sure log_num < in_num (bsc#1150112,CVE-2019-14835).
-rw-r--r--drivers/vhost/vhost.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index b8c6a4889d8c..79f7297cc23d 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -2052,7 +2052,7 @@ static int get_indirect(struct vhost_virtqueue *vq,
/* If this is an input descriptor, increment that count. */
if (access == VHOST_ACCESS_WO) {
*in_num += ret;
- if (unlikely(log)) {
+ if (unlikely(log && ret)) {
log[*log_num].addr = vhost64_to_cpu(vq, desc.addr);
log[*log_num].len = vhost32_to_cpu(vq, desc.len);
++*log_num;
@@ -2195,7 +2195,7 @@ int vhost_get_vq_desc(struct vhost_virtqueue *vq,
/* If this is an input descriptor,
* increment that count. */
*in_num += ret;
- if (unlikely(log)) {
+ if (unlikely(log && ret)) {
log[*log_num].addr = vhost64_to_cpu(vq, desc.addr);
log[*log_num].len = vhost32_to_cpu(vq, desc.len);
++*log_num;