diff options
| author | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-06-20 08:59:23 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-06-20 08:59:23 +0200 |
| commit | e8f4118f4297f93e82ebcf4dd1eb6e48fead592e (patch) | |
| tree | 7cc982375122242b71036c8b8154d972da1b84f7 /drivers/vhost/vringh.c | |
| parent | de9257ae1d3b0d8856955045d194e3ff4f278394 (diff) | |
| parent | a111daf0c53ae91e71fd2bfe7497862d14132e3e (diff) | |
Merge 5.19-rc3 into staging-next
This resolves the merge issue with:
drivers/staging/r8188eu/os_dep/ioctl_linux.c
Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/vhost/vringh.c')
| -rw-r--r-- | drivers/vhost/vringh.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c index 14e2043d7685..eab55accf381 100644 --- a/drivers/vhost/vringh.c +++ b/drivers/vhost/vringh.c @@ -292,7 +292,7 @@ __vringh_iov(struct vringh *vrh, u16 i, int (*copy)(const struct vringh *vrh, void *dst, const void *src, size_t len)) { - int err, count = 0, up_next, desc_max; + int err, count = 0, indirect_count = 0, up_next, desc_max; struct vring_desc desc, *descs; struct vringh_range range = { -1ULL, 0 }, slowrange; bool slow = false; @@ -349,7 +349,12 @@ __vringh_iov(struct vringh *vrh, u16 i, continue; } - if (count++ == vrh->vring.num) { + if (up_next == -1) + count++; + else + indirect_count++; + + if (count > vrh->vring.num || indirect_count > desc_max) { vringh_bad("Descriptor loop in %p", descs); err = -ELOOP; goto fail; @@ -411,6 +416,7 @@ __vringh_iov(struct vringh *vrh, u16 i, i = return_from_indirect(vrh, &up_next, &descs, &desc_max); slow = false; + indirect_count = 0; } else break; } |