linux/drivers/vhost
Michael S. Tsirkin ee05d6939e vhost-net: fix range checking in mrg bufs case
In mergeable buffer case, we use headcount, log_num
and seg as indexes in same-size arrays, and
we know that headcount <= seg and
log_num equals either 0 or seg.

Therefore, the right thing to do is range-check seg,
not headcount as we do now: these will be different
if guest chains s/g descriptors (this does not
happen now, but we can not trust the guest).

Long term, we should add BUG_ON checks to verify
two other indexes are what we think they should be.

Reported-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2010-09-14 15:22:41 +02:00
..
Kconfig net/macvtap: add vhost support 2010-02-18 14:08:38 -08:00
Makefile vhost_net: a kernel-level virtio server 2010-01-15 01:43:29 -08:00
net.c vhost-net: fix range checking in mrg bufs case 2010-09-14 15:22:41 +02:00
vhost.c vhost: error handling fix 2010-09-06 09:49:39 +03:00
vhost.h vhost-net: mergeable buffers support 2010-07-28 15:45:36 +03:00