]> Git Repo - linux.git/commit
vhost: block speculation of translated descriptors
authorMichael S. Tsirkin <[email protected]>
Sun, 8 Sep 2019 11:04:08 +0000 (07:04 -0400)
committerMichael S. Tsirkin <[email protected]>
Wed, 11 Sep 2019 19:15:07 +0000 (15:15 -0400)
commita89db445fbd7f1f8457b03759aa7343fa530ef6b
tree83af9e5972b7bc3aef8f075fe6be4022b75c4d54
parentcf8f1696709ad5bb3138ed8c771c2eb98950cd8a
vhost: block speculation of translated descriptors

iovec addresses coming from vhost are assumed to be
pre-validated, but in fact can be speculated to a value
out of range.

Userspace address are later validated with array_index_nospec so we can
be sure kernel info does not leak through these addresses, but vhost
must also not leak userspace info outside the allowed memory table to
guests.

Following the defence in depth principle, make sure
the address is not validated out of node range.

Signed-off-by: Michael S. Tsirkin <[email protected]>
Cc: [email protected]
Acked-by: Jason Wang <[email protected]>
Tested-by: Jason Wang <[email protected]>
drivers/vhost/vhost.c
This page took 0.054246 seconds and 4 git commands to generate.