[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 3/3] virtio-blk: fix out-of-bounds access to bitmap in notify_gues
From: |
Stefan Hajnoczi |
Subject: |
[PULL 3/3] virtio-blk: fix out-of-bounds access to bitmap in notify_guest_bh |
Date: |
Fri, 20 Dec 2019 10:25:20 +0000 |
From: Li Hangjing <address@hidden>
When the number of a virtio-blk device's virtqueues is larger than
BITS_PER_LONG, the out-of-bounds access to bitmap[ ] will occur.
Fixes: e21737ab15 ("virtio-blk: multiqueue batch notify")
Cc: address@hidden
Cc: Stefan Hajnoczi <address@hidden>
Signed-off-by: Li Hangjing <address@hidden>
Reviewed-by: Xie Yongji <address@hidden>
Reviewed-by: Chai Wen <address@hidden>
Message-id: address@hidden
Message-Id: <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>
---
hw/block/dataplane/virtio-blk.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/block/dataplane/virtio-blk.c b/hw/block/dataplane/virtio-blk.c
index 119906a5fe..1b52e8159c 100644
--- a/hw/block/dataplane/virtio-blk.c
+++ b/hw/block/dataplane/virtio-blk.c
@@ -67,7 +67,7 @@ static void notify_guest_bh(void *opaque)
memset(s->batch_notify_vqs, 0, sizeof(bitmap));
for (j = 0; j < nvqs; j += BITS_PER_LONG) {
- unsigned long bits = bitmap[j];
+ unsigned long bits = bitmap[j / BITS_PER_LONG];
while (bits != 0) {
unsigned i = j + ctzl(bits);
--
2.23.0