Re: [PATCH v3] vduse: Fix off by one in vduse_dev_mmap()

2024-03-19 Thread Michael S. Tsirkin
On Wed, Feb 28, 2024 at 09:24:07PM +0300, Dan Carpenter wrote: > The dev->vqs[] array has "dev->vq_num" elements. It's allocated in > vduse_dev_init_vqs(). Thus, this > comparison needs to be >= to avoid > reading one element beyond the end of the array. > > Add an array_index_nospec() as well t

Re: [PATCH v3] vduse: Fix off by one in vduse_dev_mmap()

2024-02-28 Thread Cindy Lu
On Thu, Feb 29, 2024 at 3:19 AM Stefan Hajnoczi wrote: > > On Wed, 28 Feb 2024 at 13:24, Dan Carpenter wrote: > > > > The dev->vqs[] array has "dev->vq_num" elements. It's allocated in > > vduse_dev_init_vqs(). Thus, this > comparison needs to be >= to avoid > > reading one element beyond the e

Re: [PATCH v3] vduse: Fix off by one in vduse_dev_mmap()

2024-02-28 Thread Stefan Hajnoczi
On Wed, 28 Feb 2024 at 13:24, Dan Carpenter wrote: > > The dev->vqs[] array has "dev->vq_num" elements. It's allocated in > vduse_dev_init_vqs(). Thus, this > comparison needs to be >= to avoid > reading one element beyond the end of the array. > > Add an array_index_nospec() as well to prevent

[PATCH v3] vduse: Fix off by one in vduse_dev_mmap()

2024-02-28 Thread Dan Carpenter
The dev->vqs[] array has "dev->vq_num" elements. It's allocated in vduse_dev_init_vqs(). Thus, this > comparison needs to be >= to avoid reading one element beyond the end of the array. Add an array_index_nospec() as well to prevent speculation issues. Fixes: 316ecd1346b0 ("vduse: Add file oper