From: Stefano Garzarella Date: Thu, 26 Oct 2023 19:54:51 +0000 (-0400) Subject: vringh: don't use vringh_kiov_advance() in vringh_iov_xfer() X-Git-Tag: Ubuntu-6.2.0-39.40~18 X-Git-Url: https://git.proxmox.com/?a=commitdiff_plain;h=cc2d14b18a3f10598c831ba2cbd8b5dce0ce4dea;p=mirror_ubuntu-kernels.git vringh: don't use vringh_kiov_advance() in vringh_iov_xfer() In the while loop of vringh_iov_xfer(), `partlen` could be 0 if one of the `iov` has 0 lenght. In this case, we should skip the iov and go to the next one. But calling vringh_kiov_advance() with 0 lenght does not cause the advancement, since it returns immediately if asked to advance by 0 bytes. Let's restore the code that was there before commit b8c06ad4d67d ("vringh: implement vringh_kiov_advance()"), avoiding using vringh_kiov_advance(). Fixes: b8c06ad4d67d ("vringh: implement vringh_kiov_advance()") Cc: stable@vger.kernel.org Reported-by: Jason Wang Signed-off-by: Stefano Garzarella Acked-by: Jason Wang Signed-off-by: David S. Miller (cherry picked from commit 7aed44babc7f97e82b38e9a68515e699692cc100) CVE-2023-5158 Signed-off-by: Yuxuan Luo Acked-by: Stefan Bader Acked-by: Roxana Nicolescu Signed-off-by: Roxana Nicolescu --- diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c index 33eb941fcf15..10bfc5f1c50d 100644 --- a/drivers/vhost/vringh.c +++ b/drivers/vhost/vringh.c @@ -123,8 +123,18 @@ static inline ssize_t vringh_iov_xfer(struct vringh *vrh, done += partlen; len -= partlen; ptr += partlen; + iov->consumed += partlen; + iov->iov[iov->i].iov_len -= partlen; + iov->iov[iov->i].iov_base += partlen; - vringh_kiov_advance(iov, partlen); + if (!iov->iov[iov->i].iov_len) { + /* Fix up old iov element then increment. */ + iov->iov[iov->i].iov_len = iov->consumed; + iov->iov[iov->i].iov_base -= iov->consumed; + + iov->consumed = 0; + iov->i++; + } } return done; }