Re: [PATCH v2] vringh: reject empty / undersized indirect descriptor tables

[sashiko-bot@kernel.org]

> move_to_indirect() validates an indirect descriptor table only with
> "len % sizeof(struct vring_desc)".  A descriptor flagged
> VRING_DESC_F_INDIRECT with len == 0 passes that test, so *desc_max is
> set to 0 while *descs points at the empty table.  __vringh_iov() then
> copies one struct vring_desc from descs[0] -- 16 bytes past the end of
> the table -- before the "indirect_count > desc_max" loop detection
> aborts the walk.  The over-read value is discarded when the walk aborts
> and is never used to map anything, but the access itself is out of
> bounds.
> 
> Reject any len smaller than one descriptor, alongside the existing
> stride check, so an empty table is refused with -EINVAL and no
> descriptor is ever fetched from it.
> 
> Fixes: f87d0fbb5798 ("vringh: host-side implementation of virtio rings.")
> Cc: stable@vger.kernel.org
> Assisted-by: Hawkeye:GLM-5.3-flash
> Assisted-by: Qoder:Qwen3.8-Max
> Signed-off-by: Fang Xieyan <fangxy@xiaopeng.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260926160755.21485-1-fangxy@xiaopeng.com?part=1