On Mon, 2011-10-03 at 20:40 +0200, Michael S. Tsirkin wrote: > On Wed, Sep 28, 2011 at 05:40:55PM +0300, Sasha Levin wrote: > > This patch prevents a NULL dereference when the user has passed a length > > longer than an actual buffer to virtio-net. > > > > Cc: Rusty Russell <[email protected]> > > Cc: "Michael S. Tsirkin" <[email protected]> > > Cc: [email protected] > > Cc: [email protected] > > Cc: [email protected] > > Signed-off-by: Sasha Levin <[email protected]> > > --- > > drivers/net/virtio_net.c | 12 +++++++++++- > > 1 files changed, 11 insertions(+), 1 deletions(-) > > > > diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c > > index bde0dec..4a53d2a 100644 > > --- a/drivers/net/virtio_net.c > > +++ b/drivers/net/virtio_net.c > > @@ -208,12 +208,22 @@ static struct sk_buff *page_to_skb(struct > > virtnet_info *vi, > > return NULL; > > } > > > > - while (len) { > > + while (len && page) { > > set_skb_frag(skb, page, offset, &len); > > page = (struct page *)page->private; > > offset = 0; > > } > > > > + /* > > + * This is the case where we ran out of pages in our linked list, but > > + * supposedly have more data to read. > > Again, let's clarify that this only happens with broken devices.
I think that the code within the if() makes it clear that it isn't the regular path. -- Sasha. -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
