diff options
| author | Li Hangjing | 2019-12-16 03:30:50 +0100 |
|---|---|---|
| committer | Stefan Hajnoczi | 2019-12-19 17:20:25 +0100 |
| commit | 725fe5d10dbd4259b1853b7d253cef83a3c0d22a (patch) | |
| tree | 56ed8920d017771de4acea80e07f186c546ffe5e /hw/block | |
| parent | docs: fix rst syntax errors in unbuilt docs (diff) | |
| download | qemu-725fe5d10dbd4259b1853b7d253cef83a3c0d22a.tar.gz qemu-725fe5d10dbd4259b1853b7d253cef83a3c0d22a.tar.xz qemu-725fe5d10dbd4259b1853b7d253cef83a3c0d22a.zip | |
virtio-blk: fix out-of-bounds access to bitmap in notify_guest_bh
When the number of a virtio-blk device's virtqueues is larger than
BITS_PER_LONG, the out-of-bounds access to bitmap[ ] will occur.
Fixes: e21737ab15 ("virtio-blk: multiqueue batch notify")
Cc: qemu-stable@nongnu.org
Cc: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Li Hangjing <lihangjing@baidu.com>
Reviewed-by: Xie Yongji <xieyongji@baidu.com>
Reviewed-by: Chai Wen <chaiwen@baidu.com>
Message-id: 20191216023050.48620-1-lihangjing@baidu.com
Message-Id: <20191216023050.48620-1-lihangjing@baidu.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Diffstat (limited to 'hw/block')
| -rw-r--r-- | hw/block/dataplane/virtio-blk.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/hw/block/dataplane/virtio-blk.c b/hw/block/dataplane/virtio-blk.c index 119906a5fe..1b52e8159c 100644 --- a/hw/block/dataplane/virtio-blk.c +++ b/hw/block/dataplane/virtio-blk.c @@ -67,7 +67,7 @@ static void notify_guest_bh(void *opaque) memset(s->batch_notify_vqs, 0, sizeof(bitmap)); for (j = 0; j < nvqs; j += BITS_PER_LONG) { - unsigned long bits = bitmap[j]; + unsigned long bits = bitmap[j / BITS_PER_LONG]; while (bits != 0) { unsigned i = j + ctzl(bits); |