* [PATCH] virtio-blk: fix out-of-bounds access to bitmap in notify_guest_bh
@ 2019-12-16 2:30 Li hangjing
2019-12-19 16:21 ` Stefan Hajnoczi
0 siblings, 1 reply; 2+ messages in thread
From: Li hangjing @ 2019-12-16 2:30 UTC (permalink / raw)
To: qemu-devel, stefanha; +Cc: lihangjing, xieyongji, qemu-stable, chaiwen
From: Li Hangjing <lihangjing@baidu.com>
When the number of a virtio-blk device's virtqueues is larger than
BITS_PER_LONG, the out-of-bounds access to bitmap[ ] will occur.
Fixes: e21737ab15 ("virtio-blk: multiqueue batch notify")
Cc: qemu-stable@nongnu.org
Cc: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Li Hangjing <lihangjing@baidu.com>
Reviewed-by: Xie Yongji <xieyongji@baidu.com>
Reviewed-by: Chai Wen <chaiwen@baidu.com>
---
hw/block/dataplane/virtio-blk.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/block/dataplane/virtio-blk.c b/hw/block/dataplane/virtio-blk.c
index 119906a5fe..1b52e8159c 100644
--- a/hw/block/dataplane/virtio-blk.c
+++ b/hw/block/dataplane/virtio-blk.c
@@ -67,7 +67,7 @@ static void notify_guest_bh(void *opaque)
memset(s->batch_notify_vqs, 0, sizeof(bitmap));
for (j = 0; j < nvqs; j += BITS_PER_LONG) {
- unsigned long bits = bitmap[j];
+ unsigned long bits = bitmap[j / BITS_PER_LONG];
while (bits != 0) {
unsigned i = j + ctzl(bits);
--
2.15.1.windows.2
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] virtio-blk: fix out-of-bounds access to bitmap in notify_guest_bh
2019-12-16 2:30 [PATCH] virtio-blk: fix out-of-bounds access to bitmap in notify_guest_bh Li hangjing
@ 2019-12-19 16:21 ` Stefan Hajnoczi
0 siblings, 0 replies; 2+ messages in thread
From: Stefan Hajnoczi @ 2019-12-19 16:21 UTC (permalink / raw)
To: Li hangjing; +Cc: chaiwen, xieyongji, qemu-devel, stefanha, qemu-stable
[-- Attachment #1: Type: text/plain, Size: 752 bytes --]
On Mon, Dec 16, 2019 at 10:30:50AM +0800, Li hangjing wrote:
> From: Li Hangjing <lihangjing@baidu.com>
>
> When the number of a virtio-blk device's virtqueues is larger than
> BITS_PER_LONG, the out-of-bounds access to bitmap[ ] will occur.
>
> Fixes: e21737ab15 ("virtio-blk: multiqueue batch notify")
> Cc: qemu-stable@nongnu.org
> Cc: Stefan Hajnoczi <stefanha@redhat.com>
> Signed-off-by: Li Hangjing <lihangjing@baidu.com>
> Reviewed-by: Xie Yongji <xieyongji@baidu.com>
> Reviewed-by: Chai Wen <chaiwen@baidu.com>
> ---
> hw/block/dataplane/virtio-blk.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
Ouch, thank you for the fix! Applied to my block tree:
https://github.com/stefanha/qemu/commits/block
Stefan
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-12-19 16:21 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-12-16 2:30 [PATCH] virtio-blk: fix out-of-bounds access to bitmap in notify_guest_bh Li hangjing
2019-12-19 16:21 ` Stefan Hajnoczi
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).