motorhead/qemu
1
0
Fork 0
mirror of https://github.com/Motorhead1991/qemu.git synced 2025-08-03 15:53:54 -06:00
Code Issues Projects Releases Packages Wiki Activity Actions

hw/rdma: Fix possible out of bounds access to GID table

Browse source 
Array size is MAX_PORT_GIDS, let's make sure the given index is in
range.

While there limit device table size to 1.

Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Yuval Shaia <yuval.shaia@oracle.com>
Reviewed-by: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
Message-Id: <20180430200223.4119-5-marcel.apfelbaum@gmail.com>
This commit is contained in:
Yuval Shaia 2018-04-30 23:02:20 +03:00 • committed by Marcel Apfelbaum
parent b9e34872b9
commit c387e8a4ec
2 changed files with 7 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

8
hw/rdma/vmw/pvrdma_cmd.c
View file

@ -576,7 +576,7 @@ static int create_bind(PVRDMADev *dev, union pvrdma_cmd_req *req,
pr_dbg("index=%d\n", cmd->index);
if (cmd->index > MAX_PORT_GIDS) {
if (cmd->index >= MAX_PORT_GIDS) {
return -EINVAL;
}
@ -603,7 +603,11 @@ static int destroy_bind(PVRDMADev *dev, union pvrdma_cmd_req *req,
{
struct pvrdma_cmd_destroy_bind *cmd = &req->destroy_bind;
pr_dbg("clear index %d\n", cmd->index);
pr_dbg("index=%d\n", cmd->index);
if (cmd->index >= MAX_PORT_GIDS) {
return -EINVAL;
}
memset(dev->rdma_dev_res.ports[0].gid_tbl[cmd->index].raw, 0,
sizeof(dev->rdma_dev_res.ports[0].gid_tbl[cmd->index].raw));