[PATCH] vhost/vringh: reject zero-length indirect descriptor tables

[Fang Xieyan <fangxy@xiaopeng.com>]

move_to_indirect() accepts an indirect descriptor with a zero length,
setting desc_max to 0. __vringh_iov() then reads descs[0] before
checking the descriptor bounds, resulting in an out-of-bounds read.

Reject a zero-length indirect table in move_to_indirect() so the
caller returns -EINVAL before dereferencing the table. Also use the
converted length in the warning to report invalid lengths correctly
when the vring byte order differs from the CPU byte order.

Fixes: f87d0fbb5798 ("vringh: host-side implementation of virtio rings.")
Cc: stable@vger.kernel.org
Reviewed-by: Guanglei Zhu <zhugl3@xiaopeng.com>
Signed-off-by: Fang Xieyan <fangxy@xiaopeng.com>
---
 drivers/vhost/vringh.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c
index 9066f9f12ba1..ce4f5a02c8d2 100644
--- a/drivers/vhost/vringh.c
+++ b/drivers/vhost/vringh.c
@@ -197,8 +197,8 @@ static int move_to_indirect(const struct vringh *vrh,
 	}
 
 	len = vringh32_to_cpu(vrh, desc->len);
-	if (unlikely(len % sizeof(struct vring_desc))) {
-		vringh_bad("Strange indirect len %u", desc->len);
+	if (unlikely(!len || len % sizeof(struct vring_desc))) {
+		vringh_bad("Strange indirect len %u", len);
 		return -EINVAL;
 	}
 
-- 
2.50.1