Michael S. Tsirkin 46aa92d1ba vhost/net: fix heads usage of ubuf_info ...

ubuf info allocator uses guest controlled head as an index,
so a malicious guest could put the same head entry in the ring twice,
and we will get two callbacks on the same value.
To fix use upend_idx which is guaranteed to be unique.

Reported-by: Rusty Russell <rusty@rustcorp.com.au>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Cc: stable@kernel.org
Signed-off-by: David S. Miller <davem@davemloft.net>

2013-03-17 14:28:54 -04:00

..

Kconfig

drivers/vhost: remove depends on CONFIG_EXPERIMENTAL

2013-01-21 14:52:45 -08:00

Kconfig.tcm

drivers/vhost: remove depends on CONFIG_EXPERIMENTAL

2013-01-21 14:52:45 -08:00

Makefile

tcm_vhost: Initial merge for vhost level target fabric driver

2012-07-29 13:49:10 -07:00

net.c

vhost/net: fix heads usage of ubuf_info

2013-03-17 14:28:54 -04:00

tcm_vhost.c

tcm_vhost: Multi-queue support

2013-02-13 11:30:14 -08:00

tcm_vhost.h

tcm_vhost: Multi-queue support

2013-02-13 11:30:14 -08:00

test.c

…

test.h

…

vhost.c

vhost_net: handle polling errors when setting backend

2013-01-29 15:43:03 -05:00

vhost.h

vhost_net: handle polling errors when setting backend

2013-01-29 15:43:03 -05:00