Dan Carpenter 51f6302f81 vdpa: check that offsets are within bounds ... commit 3ed21c1451a14d139e1ceb18f2fa70865ce3195a upstream. In this function "c->off" is a u32 and "size" is a long. On 64bit systems if "c->off" is greater than "size" then "size - c->off" is a negative and we always return -E2BIG. But on 32bit systems the subtraction is type promoted to a high positive u32 value and basically any "c->len" is accepted. Fixes: 4c8cf31885 ("vhost: introduce vDPA-based backend") Reported-by: Xie Yongji <xieyongji@bytedance.com> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Link: https://lore.kernel.org/r/20211208103337.GA4047@kili Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-12-22 09:30:51 +01:00
..
iotlb.c
Kconfig
Makefile
net.c	vhost_net: fix OoB on sendmsg() failure.	2021-09-22 12:27:58 +02:00
scsi.c
test.c
test.h
vdpa.c	vdpa: check that offsets are within bounds	2021-12-22 09:30:51 +01:00
vhost.c	vhost: Fix the calculation in vhost_overflow()	2021-08-26 08:35:42 -04:00
vhost.h
vringh.c	vringh: Use wiov->used to check for read/write desc order	2021-09-03 10:09:27 +02:00
vsock.c	vhost/vsock: fix incorrect used length reported to the guest	2021-12-01 09:19:09 +01:00