mirror of
https://github.com/Motorhead1991/qemu.git
synced 2026-03-01 07:34:35 -07:00
293084a719
The sg list/indirect descriptor table may be contigious in GPA but not in HVA address space. But libvhost-user wasn't aware of that. This would cause out-of-bounds access. Even a malicious guest could use it to get information from the vhost-user backend. Introduce a plen parameter in vu_gpa_to_va() so we can handle this case, returning the actual mapped length. Signed-off-by: Yongji Xie <xieyongji@baidu.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com> |
||
|---|---|---|
| .. | ||
| ivshmem-client | ||
| ivshmem-server | ||
| libvhost-user | ||
| systemd | ||
| vhost-user-blk | ||
| vhost-user-scsi | ||