On Fri, Sep 23, 2016 at 09:16:49AM +0200, Maxime Coquelin wrote:
> +             if (vq->desc[desc_indexes[i]].flags & VRING_DESC_F_INDIRECT) {
> +                     if (unlikely(!(dev->features &
> +                                     (1ULL << 
> VIRTIO_RING_F_INDIRECT_DESC)))) {
> +                             RTE_LOG(ERR, VHOST_DATA,
> +                                             "Indirect desc but feature not 
> negotiated.\n");
> +                             break;
> +                     }

I thought the alignment we got before was to follow linux kernel: check
nested indirect only?

> +
> +                     desc = (struct vring_desc *)gpa_to_vva(dev,
> +                                     vq->desc[desc_indexes[i]].addr);

I think we should check the desc addr here. Otherwise we may crash here
if a malicious guest fills some bad addresses.

        --yliu

Reply via email to