queue-5.0/vhost-reject-zero-size-iova-range.patch

   1 From foo@baz Sat Apr 20 16:43:09 CEST 2019
   2 From: Jason Wang <jasowang@redhat.com>
   3 Date: Tue, 9 Apr 2019 12:10:25 +0800
   4 Subject: vhost: reject zero size iova range
   5
   6 From: Jason Wang <jasowang@redhat.com>
   7
   8 [ Upstream commit 813dbeb656d6c90266f251d8bd2b02d445afa63f ]
   9
  10 We used to accept zero size iova range which will lead a infinite loop
  11 in translate_desc(). Fixing this by failing the request in this case.
  12
  13 Reported-by: syzbot+d21e6e297322a900c128@syzkaller.appspotmail.com
  14 Fixes: 6b1e6cc7 ("vhost: new device IOTLB API")
  15 Signed-off-by: Jason Wang <jasowang@redhat.com>
  16 Acked-by: Michael S. Tsirkin <mst@redhat.com>
  17 Signed-off-by: David S. Miller <davem@davemloft.net>
  18 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  19 ---
  20  drivers/vhost/vhost.c |    6 +++++-
  21  1 file changed, 5 insertions(+), 1 deletion(-)
  22
  23 --- a/drivers/vhost/vhost.c
  24 +++ b/drivers/vhost/vhost.c
  25 @@ -911,8 +911,12 @@ static int vhost_new_umem_range(struct v
  26                                 u64 start, u64 size, u64 end,
  27                                 u64 userspace_addr, int perm)
  28  {
  29 -       struct vhost_umem_node *tmp, *node = kmalloc(sizeof(*node), GFP_ATOMIC);
  30 +       struct vhost_umem_node *tmp, *node;
  31
  32 +       if (!size)
  33 +               return -EFAULT;
  34 +
  35 +       node = kmalloc(sizeof(*node), GFP_ATOMIC);
  36         if (!node)
  37                 return -ENOMEM;
  38