[PATCH] vringh: reject empty / undersized indirect descriptor tables

[Fang Xieyan <fangxy@xiaopeng.com>]

move_to_indirect() rejects an indirect descriptor table only when its
length is not an exact multiple of sizeof(struct vring_desc).  A guest
descriptor with VRING_DESC_F_INDIRECT and len == 0 passes that check, so
*desc_max becomes 0, yet __vringh_iov() keeps walking the (empty) table
and aborts with -ELOOP only after reading one full descriptor past its
end -- leaking 16 bytes of memory adjacent to the table into a kernel
stack variable.

Reject any len smaller than one descriptor, before the existing stride
check, so no descriptor is ever fetched from an empty table.

Fixes: f87d0fbb5798 ("vringh: host-side implementation of virtio rings.")
Cc: stable@vger.kernel.org
Assisted-by: Hawkeye:GLM-5.3-flash
Assisted-by: Qoder:Qwen3.8-Max
Signed-off-by: Fang Xieyan <fangxy@xiaopeng.com>
---
 drivers/vhost/vringh.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

Leak path: once move_to_indirect() sets *desc_max = 0 and points *descs
at the (empty) table, the next __vringh_iov() iteration first runs

	err = copy(vrh, &desc, &descs[i], sizeof(desc));

i.e. a 16-byte read from descs[0] -- one full struct vring_desc past the
end of the table -- *before* the "indirect_count > desc_max" test fires.
When the guest page backing the table sits just before a sensitive host
page, those 16 bytes are attacker-influenced adjacent memory.

The multiple-of-16 stride check is kept for defense in depth.

Userspace reproducer (move_to_indirect()/__vringh_iov() extracted verbatim,
2048-byte region followed by a guarded red zone):

    [VULNERABLE] return=-62 (-ELOOP)  OOB-read=YES  bytes-past-region=16
    [PATCHED   ] return=-22 (-EINVAL) OOB-read=no   bytes-past-region=0

diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c
index 9066f9f..0767748 100644
--- a/drivers/vhost/vringh.c
+++ b/drivers/vhost/vringh.c
@@ -197,8 +197,9 @@ static int move_to_indirect(const struct vringh *vrh,
 	}
 
 	len = vringh32_to_cpu(vrh, desc->len);
-	if (unlikely(len % sizeof(struct vring_desc))) {
-		vringh_bad("Strange indirect len %u", desc->len);
+	if (unlikely(len < sizeof(struct vring_desc) ||
+		     len % sizeof(struct vring_desc))) {
+		vringh_bad("Invalid indirect len %u", desc->len);
 		return -EINVAL;
 	}
 
-- 
2.50.1