From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.7 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B7FD6C433B4 for ; Wed, 19 May 2021 13:39:34 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 964416135A for ; Wed, 19 May 2021 13:39:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1346637AbhESNkx (ORCPT ); Wed, 19 May 2021 09:40:53 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57792 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240097AbhESNkx (ORCPT ); Wed, 19 May 2021 09:40:53 -0400 Received: from mail-ed1-x534.google.com (mail-ed1-x534.google.com [IPv6:2a00:1450:4864:20::534]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 701C3C061763 for ; Wed, 19 May 2021 06:39:33 -0700 (PDT) Received: by mail-ed1-x534.google.com with SMTP id o5so6422810edc.5 for ; Wed, 19 May 2021 06:39:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bytedance-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=ZyIq8u+kwqwBpbcwfduylW+9xPyGO1H5rtatjl1f/C8=; b=xs/S/LlOVbGml0EAnOsGRxZ5oyqDBbSJlCsgVvbQ04i5427YcKz67n0cj1OtSeZJzl 3OctonqM0oElTfaoTOk7R2GorMPYS4s6Btg8XNc/c8YJCgYkjK+9gWKXqHAD42DxLpI8 u88O6hu8P5tyhEqbon4FApOFc19n66atecuVED7etO6q1DkSFutUnSZJ47B113wTUxY4 BDyFvGJ7MTYq9/FGHolluJ7KGdFbHah2Ii04NPVk3Do6Edo/rTmDaygSrsV/k7OCxbIf 5fhm7wm6SKx4287C/a43687P2ouGxwFMVU1e5nxsCdXnJ4V1slDmpOxWqN3L8omzqx2q Gnng== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=ZyIq8u+kwqwBpbcwfduylW+9xPyGO1H5rtatjl1f/C8=; b=qLAGYo1PnF7IBwFGXV+ynBwuafgFaQyno5YpSqNZTmpfk1IBJx9pwMOxQ3XrKj7vSR dsonG0qRJeao35QT1I3cOBa3Cxt6Ectk4bx3xfz1FYOqFru54IrG9mBVCeONmBzC+I7D AVsyJVp4zlBGCdMVcebjugUr1pdj7KwkwscBrEtv8+vAjxqIC89pZSMlGbmhg6mTMF54 fOel1271mvCMLMUJfVQLHgu251ovhRPoSXygHtcW3BP77pFKvhLQYtt++OwliECtpU0O 3X+sqL6VcSBXX+gZYkFf/vkSxawqmlmJwiY5PsQWyld4imlBYAB71gC3m1ji4efNapAJ fIGg== X-Gm-Message-State: AOAM531v5t/ihdhO3SAcAbAnibh99ORopuENT1+Z1YRg/QL/cHCswxZn L+JLtLgxWd49dVGl2Im/orcisur16JqqtqWayf3K X-Google-Smtp-Source: ABdhPJyUaoeoU6jHmwL2wRih6mMfwzvW50aSrjBZb35A6Wf6KcfF+IKFvuHwvdNQjGh/v4RZkom8EsJySMDZrk7j/3M= X-Received: by 2002:a05:6402:4252:: with SMTP id g18mr14312783edb.195.1621431571306; Wed, 19 May 2021 06:39:31 -0700 (PDT) MIME-Version: 1.0 References: <20210517095513.850-1-xieyongji@bytedance.com> <20210517095513.850-5-xieyongji@bytedance.com> In-Reply-To: <20210517095513.850-5-xieyongji@bytedance.com> From: Yongji Xie Date: Wed, 19 May 2021 21:39:20 +0800 Message-ID: Subject: Re: [PATCH v7 04/12] virtio-blk: Add validation for block size in config space To: "Michael S. Tsirkin" , Jason Wang , Stefan Hajnoczi , Stefano Garzarella , Parav Pandit , Christoph Hellwig , Christian Brauner , Randy Dunlap , Matthew Wilcox , viro@zeniv.linux.org.uk, Jens Axboe , bcrl@kvack.org, Jonathan Corbet , =?UTF-8?Q?Mika_Penttil=C3=A4?= , Dan Carpenter , joro@8bytes.org Cc: virtualization , netdev@vger.kernel.org, kvm , linux-fsdevel@vger.kernel.org, iommu@lists.linux-foundation.org, linux-kernel Content-Type: text/plain; charset="UTF-8" Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org On Mon, May 17, 2021 at 5:56 PM Xie Yongji wrote: > > This ensures that we will not use an invalid block size > in config space (might come from an untrusted device). > > Signed-off-by: Xie Yongji > --- > drivers/block/virtio_blk.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c > index ebb4d3fe803f..c848aa36d49b 100644 > --- a/drivers/block/virtio_blk.c > +++ b/drivers/block/virtio_blk.c > @@ -826,7 +826,7 @@ static int virtblk_probe(struct virtio_device *vdev) > err = virtio_cread_feature(vdev, VIRTIO_BLK_F_BLK_SIZE, > struct virtio_blk_config, blk_size, > &blk_size); > - if (!err) > + if (!err && blk_size > 0 && blk_size <= max_size) The check here is incorrect. I will use PAGE_SIZE as the maximum boundary in the new version. Thanks, Yongji