Re: [PATCH] vduse: fix memory corruption in vduse_dev_ioctl()

[Yongji Xie <xieyongji@xxxxxxxxxxxxx>]

On Tue, Dec 7, 2021 at 6:46 PM Dan Carpenter <dan.carpenter@xxxxxxxxxx> wrote:
>
> The "config.offset" comes from the user.  There needs to a check to
> prevent it being out of bounds.  The "config.offset" and
> "dev->config_size" variables are both type u32.  So if the offset if
> out of bounds then the "dev->config_size - config.offset" subtraction
> results in a very high u32 value.
>

Thanks for catching this! I think we also need a fix for
vhost_vdpa_config_validate().

Thanks,
Yongji