virtio-blk: validate num_queues during probe
authorJason Wang <jasowang@redhat.com>
Tue, 19 Oct 2021 07:01:43 +0000 (15:01 +0800)
committerMichael S. Tsirkin <mst@redhat.com>
Mon, 1 Nov 2021 09:26:48 +0000 (05:26 -0400)
commit6ae6ff6f6e7d2f304a12a53af8298e4f16ad633e
tree4a2beb6835b7b4412ba05db98f1cdb1919de256a
parentf1429e6c36f5d12c9ea6edf6d704445fb048e8a6
virtio-blk: validate num_queues during probe

If an untrusted device neogitates BLK_F_MQ but advertises a zero
num_queues, the driver may end up trying to allocating zero size
buffers where ZERO_SIZE_PTR is returned which may pass the checking
against the NULL. This will lead unexpected results.

Fixing this by failing the probe in this case.

Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Stefan Hajnoczi <stefanha@redhat.com>
Cc: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Link: https://lore.kernel.org/r/20211019070152.8236-2-jasowang@redhat.com
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
drivers/block/virtio_blk.c