| commit | 1e7aed70144b4673fc26e73062064b6724795e5f | |
| author | Prasad J Pandit <pjp@fedoraproject.org> | |
| Wed, 27 Jul 2016 15:37:56 +0000 (27 21:07 +0530) | ||
| committer | Michael S. Tsirkin <mst@redhat.com> | |
| Thu, 28 Jul 2016 21:07:10 +0000 (29 00:07 +0300) | ||
| tree | d6cf8775d16eeb42d4e292a33568b9715fedae63 | treesnapshot (tar.gz zip) |
| parent | 9a4c0e220d8a4f82b5665d0ee95ef94d8e1509d5 | commitdiff |
virtio: check vring descriptor buffer length
virtio back end uses set of buffers to facilitate I/O operations.
An infinite loop unfolds in virtqueue_pop() if a buffer was
of zero size. Add check to avoid it.
Reported-by: Li Qiang <liqiang6-s@360.cn>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
virtio back end uses set of buffers to facilitate I/O operations.
An infinite loop unfolds in virtqueue_pop() if a buffer was
of zero size. Add check to avoid it.
Reported-by: Li Qiang <liqiang6-s@360.cn>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
| hw/virtio/virtio.c | diffblobblamehistory |