Home Home > GIT Browse > SLE12-SP5-AZURE
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDenis Kirjanov <dkirjanov@suse.com>2019-09-19 09:29:34 +0300
committerDenis Kirjanov <dkirjanov@suse.com>2019-09-19 09:29:34 +0300
commit7e12c8de90d17bdf232b659fb5859b9d64677931 (patch)
tree5fc1fb2da815a8070370d87bf23712256017aca8
parent4ca7881527a7d52e34570f869b9c5ace8ae9bfbc (diff)
vhost: make sure log_num < in_num (bsc#1150112,CVE-2019-14835).
-rw-r--r--drivers/vhost/vhost.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index 9fd44d2b7562..48579d6801c8 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -2091,7 +2091,7 @@ static int get_indirect(struct vhost_virtqueue *vq,
/* If this is an input descriptor, increment that count. */
if (access == VHOST_ACCESS_WO) {
*in_num += ret;
- if (unlikely(log)) {
+ if (unlikely(log && ret)) {
log[*log_num].addr = vhost64_to_cpu(vq, desc.addr);
log[*log_num].len = vhost32_to_cpu(vq, desc.len);
++*log_num;
@@ -2234,7 +2234,7 @@ int vhost_get_vq_desc(struct vhost_virtqueue *vq,
/* If this is an input descriptor,
* increment that count. */
*in_num += ret;
- if (unlikely(log)) {
+ if (unlikely(log && ret)) {
log[*log_num].addr = vhost64_to_cpu(vq, desc.addr);
log[*log_num].len = vhost32_to_cpu(vq, desc.len);
++*log_num;