Message ID | 1427384162-4994-3-git-send-email-cornelia.huck@de.ibm.com |
---|---|
State | New |
Headers | show |
Am 26.03.2015 um 16:36 schrieb Cornelia Huck: > Processing for READ_VQ_CONF needs to check whether the requested queue > value is actually in the supported range and post a channel program > check if not. > > Cc: qemu-stable@nongnu.org > Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com> > Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com> Acked-by: Christian Borntraeger <borntraeger@de.ibm.com> > --- > hw/s390x/virtio-ccw.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/hw/s390x/virtio-ccw.c b/hw/s390x/virtio-ccw.c > index ceb6a45..d32ecaf 100644 > --- a/hw/s390x/virtio-ccw.c > +++ b/hw/s390x/virtio-ccw.c > @@ -549,6 +549,10 @@ static int virtio_ccw_cb(SubchDev *sch, CCW1 ccw) > ret = -EFAULT; > } else { > vq_config.index = lduw_be_phys(&address_space_memory, ccw.cda); > + if (vq_config.index >= VIRTIO_PCI_QUEUE_MAX) { > + ret = -EINVAL; > + break; > + } > vq_config.num_max = virtio_queue_get_num(vdev, > vq_config.index); > stw_be_phys(&address_space_memory, >
diff --git a/hw/s390x/virtio-ccw.c b/hw/s390x/virtio-ccw.c index ceb6a45..d32ecaf 100644 --- a/hw/s390x/virtio-ccw.c +++ b/hw/s390x/virtio-ccw.c @@ -549,6 +549,10 @@ static int virtio_ccw_cb(SubchDev *sch, CCW1 ccw) ret = -EFAULT; } else { vq_config.index = lduw_be_phys(&address_space_memory, ccw.cda); + if (vq_config.index >= VIRTIO_PCI_QUEUE_MAX) { + ret = -EINVAL; + break; + } vq_config.num_max = virtio_queue_get_num(vdev, vq_config.index); stw_be_phys(&address_space_memory,