move_to_indirect() accepts an indirect descriptor with a zero length, setting desc_max to 0. __vringh_iov() then reads descs[0] before checking the descriptor bounds, resulting in an out-of-bounds read. Reject a zero-length indirect table in move_to_indirect() so the caller returns -EINVAL before dereferencing the table. Also use the converted length in the warning to report invalid lengths correctly when the vring byte order differs from the CPU byte order. Fixes: f87d0fbb5798 ("vringh: host-side implementation of virtio rings.") Cc: stable@vger.kernel.org Reviewed-by: Guanglei Zhu Signed-off-by: Fang Xieyan --- drivers/vhost/vringh.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c index 9066f9f12ba1..ce4f5a02c8d2 100644 --- a/drivers/vhost/vringh.c +++ b/drivers/vhost/vringh.c @@ -197,8 +197,8 @@ static int move_to_indirect(const struct vringh *vrh, } len = vringh32_to_cpu(vrh, desc->len); - if (unlikely(len % sizeof(struct vring_desc))) { - vringh_bad("Strange indirect len %u", desc->len); + if (unlikely(!len || len % sizeof(struct vring_desc))) { + vringh_bad("Strange indirect len %u", len); return -EINVAL; } -- 2.50.1