vhost/net: length miscalculation
commit8b38694a2d
vhost/net: virtio 1.0 byte swap had this chunk: - heads[headcount - 1].len += datalen; + heads[headcount - 1].len = cpu_to_vhost32(vq, len - datalen); This adds datalen with the wrong sign, causing guest panics. Fixes:8b38694a2d
Reported-by: Alex Williamson <alex.williamson@redhat.com> Suggested-by: Greg Kurz <gkurz@linux.vnet.ibm.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
This commit is contained in:
parent
a1eb03f546
commit
99975cc6ad
|
@ -538,7 +538,7 @@ static int get_rx_bufs(struct vhost_virtqueue *vq,
|
|||
++headcount;
|
||||
seg += in;
|
||||
}
|
||||
heads[headcount - 1].len = cpu_to_vhost32(vq, len - datalen);
|
||||
heads[headcount - 1].len = cpu_to_vhost32(vq, len + datalen);
|
||||
*iovcount = seg;
|
||||
if (unlikely(log))
|
||||
*log_num = nlogs;
|
||||
|
|
Loading…
Reference in a new issue