diff options
| author |   Krishna Kumar <krkumar2@in.ibm.com> | 2010-05-25 11:10:36 +0530 |
|---|---|---|
| committer |   Michael S. Tsirkin <mst@redhat.com> | 2010-05-27 12:19:02 +0300 |
| commit | 0f3d9a17469d71ba1bab79c07c8eecb9e26e60af (patch) | |
| tree | a94a0c4e8a224261b3e2cb6f1329056f80d4e7b2 /drivers/vhost | |
| parent | net: fix lock_sock_bh/unlock_sock_bh (diff) | |
| download | linux-dev-0f3d9a17469d71ba1bab79c07c8eecb9e26e60af.tar.xz linux-dev-0f3d9a17469d71ba1bab79c07c8eecb9e26e60af.zip | |
vhost: Fix host panic if ioctl called with wrong index
Missed a boundary value check in vhost_set_vring. The host panics if
idx == nvqs is used in ioctl commands in vhost_virtqueue_init.
Signed-off-by: Krishna Kumar <krkumar2@in.ibm.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Diffstat (limited to 'drivers/vhost')
| -rw-r--r-- | drivers/vhost/vhost.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c index 750effe0f98b..44f123abb0f4 100644 --- a/drivers/vhost/vhost.c +++ b/drivers/vhost/vhost.c @@ -374,7 +374,7 @@ static long vhost_set_vring(struct vhost_dev *d, int ioctl, void __user *argp) r = get_user(idx, idxp); if (r < 0) return r; - if (idx > d->nvqs) + if (idx >= d->nvqs) return -ENOBUFS; vq = d->vqs + idx; |