)]}'
{
  "commit": "6fcf5ebafad65adc19a616260ca7dc90005785d1",
  "tree": "c72c4ce798e93b8a65d57247b5749b8f26d95f3b",
  "parents": [
    "4e06566dbd1b1251c2788af26a30bd148d4eb6c1"
  ],
  "author": {
    "name": "Jonah Palmer",
    "email": "jonah.palmer@oracle.com",
    "time": "Mon Jul 21 15:02:08 2025 +0000"
  },
  "committer": {
    "name": "Michael S. Tsirkin",
    "email": "mst@redhat.com",
    "time": "Fri Aug 01 08:32:36 2025 -0400"
  },
  "message": "virtio: fix off-by-one and invalid access in virtqueue_ordered_fill\n\nCommit b44135daa372 introduced virtqueue_ordered_fill for\nVIRTIO_F_IN_ORDER support but had a few issues:\n\n* Conditional while loop used \u0027steps \u003c\u003d max_steps\u0027 but should\u0027ve been\n  \u0027steps \u003c max_steps\u0027 since reaching steps \u003d\u003d max_steps would indicate\n  that we didn\u0027t find an element, which is an error. Without this\n  change, the code would attempt to read invalid data at an index\n  outside of our search range.\n\n* Incremented \u0027steps\u0027 using the next chain\u0027s ndescs instead of the\n  current one.\n\nThis patch corrects the loop bounds and synchronizes \u0027steps\u0027 and index\nincrements.\n\nWe also add a defensive sanity check against malicious or invalid\ndescriptor counts to avoid a potential infinite loop and DoS.\n\nFixes: b44135daa372 (\"virtio: virtqueue_ordered_fill - VIRTIO_F_IN_ORDER support\")\nReported-by: terrynini \u003cterrynini38514@gmail.com\u003e\nSigned-off-by: Jonah Palmer \u003cjonah.palmer@oracle.com\u003e\nMessage-Id: \u003c20250721150208.2409779-1-jonah.palmer@oracle.com\u003e\nReviewed-by: Si-Wei Liu \u003csi-wei.liu@oracle.com\u003e\nAcked-by: Jason Wang \u003cjasowang@redhat.com\u003e\nReviewed-by: Michael S. Tsirkin \u003cmst@redhat.com\u003e\nSigned-off-by: Michael S. Tsirkin \u003cmst@redhat.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "2ab1d20769495ea39445b87e3673b076ad172510",
      "old_mode": 33188,
      "old_path": "hw/virtio/virtio.c",
      "new_id": "9a81ad912e013fc254899c4e55cff1f76a6112a4",
      "new_mode": 33188,
      "new_path": "hw/virtio/virtio.c"
    }
  ]
}