summaryrefslogtreecommitdiff
path: root/drivers/vhost/vdpa.c
diff options
context:
space:
mode:
authorJae Hyun Yoo <jae.hyun.yoo@linux.intel.com>2021-10-01 21:38:40 +0300
committerJae Hyun Yoo <jae.hyun.yoo@linux.intel.com>2021-10-01 21:40:21 +0300
commit9c881021a269af242594e2dfc79f1c4701404887 (patch)
treec8ec14f412d7ea35009b2dee08770082ddbb5c6e /drivers/vhost/vdpa.c
parente9479d98b87227b8b7502c4c1e778887b23799f1 (diff)
parentcf06e1ab1c3ed354da5873e646f2164fea147c88 (diff)
downloadlinux-dev-5.10-intel.tar.xz
Merge branch 'dev-5.10' into dev-5.10-inteldev-5.10-intel
Pull 5.10.67 stable from OpenBMC upstream. Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@linux.intel.com>
Diffstat (limited to 'drivers/vhost/vdpa.c')
-rw-r--r--drivers/vhost/vdpa.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c
index 80184153ac7d..c4d53ff06bf8 100644
--- a/drivers/vhost/vdpa.c
+++ b/drivers/vhost/vdpa.c
@@ -623,7 +623,8 @@ static int vhost_vdpa_process_iotlb_update(struct vhost_vdpa *v,
long pinned;
int ret = 0;
- if (msg->iova < v->range.first ||
+ if (msg->iova < v->range.first || !msg->size ||
+ msg->iova > U64_MAX - msg->size + 1 ||
msg->iova + msg->size - 1 > v->range.last)
return -EINVAL;