diff options
| author | Prasad J Pandit | 2018-12-12 20:30:34 +0100 |
|---|---|---|
| committer | Marcel Apfelbaum | 2018-12-22 10:09:57 +0100 |
| commit | 0e68373cc2b3a063ce067bc0cc3edaf370752890 (patch) | |
| tree | aaf689ada6d7b8f1cc0dcde50100213a86470762 /scripts/modules | |
| parent | pvrdma: release device resources in case of an error (diff) | |
| download | qemu-0e68373cc2b3a063ce067bc0cc3edaf370752890.tar.gz qemu-0e68373cc2b3a063ce067bc0cc3edaf370752890.tar.xz qemu-0e68373cc2b3a063ce067bc0cc3edaf370752890.zip | |
rdma: check num_sge does not exceed MAX_SGE
rdma back-end has scatter/gather array ibv_sge[MAX_SGE=4] set
to have 4 elements. A guest could send a 'PvrdmaSqWqe' ring element
with 'num_sge' set to > MAX_SGE, which may lead to OOB access issue.
Add check to avoid it.
Reported-by: Saar Amar <saaramar5@gmail.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Reviewed-by: Yuval Shaia <yuval.shaia@oracle.com>
Signed-off-by: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
Diffstat (limited to 'scripts/modules')
0 files changed, 0 insertions, 0 deletions