On 01/18/2018 05:04 PM, Yongji Xie wrote:
The sg list/indirect descriptor table may be contigious
in GPA but not in HVA address space. But libvhost-user
wasn't aware of that. This would cause out-of-bounds
access. Even a malicious guest could use it to get
information from the vhost-user backend.

Introduce a plen parameter in vu_gpa_to_va() so we can
handle this case, returning the actual mapped length.

Signed-off-by: Yongji Xie <xieyon...@baidu.com>
  contrib/libvhost-user/libvhost-user.c |  133 +++++++++++++++++++++++++++++----
  contrib/libvhost-user/libvhost-user.h |    3 +-
  2 files changed, 122 insertions(+), 14 deletions(-)

Reviewed-by: Maxime Coquelin <maxime.coque...@redhat.com>


Reply via email to