| Message ID | 20191216023050.48620-1-lihangjing@baidu.com |
|---|---|
| State | New |
| Headers | show |
| Series | virtio-blk: fix out-of-bounds access to bitmap in notify_guest_bh | expand |
On Mon, Dec 16, 2019 at 10:30:50AM +0800, Li hangjing wrote: > From: Li Hangjing <lihangjing@baidu.com> > > When the number of a virtio-blk device's virtqueues is larger than > BITS_PER_LONG, the out-of-bounds access to bitmap[ ] will occur. > > Fixes: e21737ab15 ("virtio-blk: multiqueue batch notify") > Cc: qemu-stable@nongnu.org > Cc: Stefan Hajnoczi <stefanha@redhat.com> > Signed-off-by: Li Hangjing <lihangjing@baidu.com> > Reviewed-by: Xie Yongji <xieyongji@baidu.com> > Reviewed-by: Chai Wen <chaiwen@baidu.com> > --- > hw/block/dataplane/virtio-blk.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) Ouch, thank you for the fix! Applied to my block tree: https://github.com/stefanha/qemu/commits/block Stefan
diff --git a/hw/block/dataplane/virtio-blk.c b/hw/block/dataplane/virtio-blk.c index 119906a5fe..1b52e8159c 100644 --- a/hw/block/dataplane/virtio-blk.c +++ b/hw/block/dataplane/virtio-blk.c @@ -67,7 +67,7 @@ static void notify_guest_bh(void *opaque) memset(s->batch_notify_vqs, 0, sizeof(bitmap)); for (j = 0; j < nvqs; j += BITS_PER_LONG) { - unsigned long bits = bitmap[j]; + unsigned long bits = bitmap[j / BITS_PER_LONG]; while (bits != 0) { unsigned i = j + ctzl(bits);