0e68373cc2
rdma back-end has scatter/gather array ibv_sge[MAX_SGE=4] set to have 4 elements. A guest could send a 'PvrdmaSqWqe' ring element with 'num_sge' set to > MAX_SGE, which may lead to OOB access issue. Add check to avoid it. Reported-by: Saar Amar <saaramar5@gmail.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Reviewed-by: Yuval Shaia <yuval.shaia@oracle.com> Signed-off-by: Marcel Apfelbaum <marcel.apfelbaum@gmail.com> |
||
---|---|---|
.. | ||
vmw | ||
Makefile.objs | ||
rdma_backend_defs.h | ||
rdma_backend.c | ||
rdma_backend.h | ||
rdma_rm_defs.h | ||
rdma_rm.c | ||
rdma_rm.h | ||
rdma_utils.c | ||
rdma_utils.h | ||
trace-events |