mirror of
https://github.com/cloud-hypervisor/cloud-hypervisor.git
synced 2026-08-05 02:19:16 +00:00
Drop inflate or deflate descriptors whose len exceeds the Linux driver maximum of VIRTIO_BALLOON_ARRAY_PFNS_MAX PFN entries of 4 bytes each. Without the cap, a guest can submit a descriptor with a huge len over a small backing and drive an unbounded warn loop in the device thread. Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>