Reference in a new issue

Blame

Copy permalink

Reference in a new issue

Copy permalink

Yousef Alhouseen 0619aaa34c vhost/vdpa: reject overflowing PA map page counts on 32-bit ... vhost_vdpa_pa_map() adds the IOVA page offset to the user-controlled map size before computing the number of pages to pin. On 32-bit systems, where unsigned long is narrower than u64, that addition can overflow and the code can pin and map fewer pages than the requested IOTLB range. Reject sizes that overflow the unsigned long page-count calculation. Fixes: 22af48cf91 ("vdpa: factor out vhost_vdpa_pa_map() and vhost_vdpa_pa_unmap()") Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Message-ID: <CAMuQ4bX-iDvcUOPPY+NLz95tkRJYwWqvzAr=U48uNaub_HZLGw@mail.gmail.com>		History 2026-08-03 15:21:54 -04:00
..
iotlb.c	vhost_iotlb: bound map allocation in add_range	2026-08-03 15:21:54 -04:00
Kconfig	vhost: Reintroduce kthread API and add mode selection	2025-08-01 09:11:09 -04:00
Makefile	vhost: introduce vDPA-based backend	2020-04-02 10:41:40 -04:00
net.c	Revert "vhost-net: wake queue of tun/tap after ptr_ring consume"	2026-07-29 17:12:27 -07:00
scsi.c	scsi: vhost-scsi: Report direction completion support	2026-02-28 21:04:03 -05:00
test.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
test.h	tools/virtio: Add --reset	2020-06-22 12:34:21 -04:00
vdpa.c	vhost/vdpa: reject overflowing PA map page counts on 32-bit	2026-08-03 15:21:54 -04:00
vhost.c	vhost_iotlb: bound map allocation in add_range	2026-08-03 15:21:54 -04:00
vhost.h	kcov: refactor common handle ID into kcov_common_handle_id	2026-05-28 21:24:45 -07:00
vringh.c	treewide: Replace kmalloc with kmalloc_obj for non-scalar types	2026-02-21 01:02:28 -08:00
vsock.c	vhost/vsock: Refuse the connection immediately when guest isn't ready	2026-06-10 02:14:01 -04:00