move_to_indirect() rejects an indirect descriptor table only when its length is not an exact multiple of sizeof(struct vring_desc). A guest descriptor with VRING_DESC_F_INDIRECT and len == 0 passes that check, so *desc_max becomes 0, yet __vringh_iov() keeps walking the (empty) table and aborts with -ELOOP only after reading one full descriptor past its end -- leaking 16 bytes of memory adjacent to the table into a kernel stack variable. Reject any len smaller than one descriptor, before the existing stride check, so no descriptor is ever fetched from an empty table. Fixes: f87d0fbb5798 ("vringh: host-side implementation of virtio rings.") Cc: stable@vger.kernel.org Assisted-by: Hawkeye:GLM-5.3-flash Assisted-by: Qoder:Qwen3.8-Max Signed-off-by: Fang Xieyan --- drivers/vhost/vringh.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) Leak path: once move_to_indirect() sets *desc_max = 0 and points *descs at the (empty) table, the next __vringh_iov() iteration first runs err = copy(vrh, &desc, &descs[i], sizeof(desc)); i.e. a 16-byte read from descs[0] -- one full struct vring_desc past the end of the table -- *before* the "indirect_count > desc_max" test fires. When the guest page backing the table sits just before a sensitive host page, those 16 bytes are attacker-influenced adjacent memory. The multiple-of-16 stride check is kept for defense in depth. Userspace reproducer (move_to_indirect()/__vringh_iov() extracted verbatim, 2048-byte region followed by a guarded red zone): [VULNERABLE] return=-62 (-ELOOP) OOB-read=YES bytes-past-region=16 [PATCHED ] return=-22 (-EINVAL) OOB-read=no bytes-past-region=0 diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c index 9066f9f..0767748 100644 --- a/drivers/vhost/vringh.c +++ b/drivers/vhost/vringh.c @@ -197,8 +197,9 @@ static int move_to_indirect(const struct vringh *vrh, } len = vringh32_to_cpu(vrh, desc->len); - if (unlikely(len % sizeof(struct vring_desc))) { - vringh_bad("Strange indirect len %u", desc->len); + if (unlikely(len < sizeof(struct vring_desc) || + len % sizeof(struct vring_desc))) { + vringh_bad("Invalid indirect len %u", desc->len); return -EINVAL; } -- 2.50.1