virtio-blk: fix out-of-bounds access to bitmap in notify_guest_bh

[PATCH] virtio-blk: fix out-of-bounds access to bitmap in notify_guest_bh

Li hangjing posted 1 patch 4 years, 4 months ago

Download mbox

Test asan failed

Test checkpatch failed

Test FreeBSD failed

Test docker-mingw@fedora failed

Test docker-clang@ubuntu failed

Test docker-quick@centos7 failed

Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/20191216023050.48620-1-lihangjing@baidu.com

Maintainers: Stefan Hajnoczi <stefanha@redhat.com>, Kevin Wolf <kwolf@redhat.com>, Max Reitz <mreitz@redhat.com>

hw/block/dataplane/virtio-blk.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

Expand all Fold all

[PATCH] virtio-blk: fix out-of-bounds access to bitmap in notify_guest_bh

Posted by Li hangjing 4 years, 4 months ago

From: Li Hangjing <lihangjing@baidu.com>

When the number of a virtio-blk device's virtqueues is larger than
BITS_PER_LONG, the out-of-bounds access to bitmap[ ] will occur.

Fixes: e21737ab15 ("virtio-blk: multiqueue batch notify")
Cc: qemu-stable@nongnu.org
Cc: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Li Hangjing <lihangjing@baidu.com>
Reviewed-by: Xie Yongji <xieyongji@baidu.com>
Reviewed-by: Chai Wen <chaiwen@baidu.com>
---
 hw/block/dataplane/virtio-blk.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/block/dataplane/virtio-blk.c b/hw/block/dataplane/virtio-blk.c
index 119906a5fe..1b52e8159c 100644
--- a/hw/block/dataplane/virtio-blk.c
+++ b/hw/block/dataplane/virtio-blk.c
@@ -67,7 +67,7 @@ static void notify_guest_bh(void *opaque)
     memset(s->batch_notify_vqs, 0, sizeof(bitmap));
 
     for (j = 0; j < nvqs; j += BITS_PER_LONG) {
-        unsigned long bits = bitmap[j];
+        unsigned long bits = bitmap[j / BITS_PER_LONG];
 
         while (bits != 0) {
             unsigned i = j + ctzl(bits);
-- 
2.15.1.windows.2

Re: [PATCH] virtio-blk: fix out-of-bounds access to bitmap in notify_guest_bh

Posted by Stefan Hajnoczi 4 years, 4 months ago

On Mon, Dec 16, 2019 at 10:30:50AM +0800, Li hangjing wrote:
> From: Li Hangjing <lihangjing@baidu.com>
> 
> When the number of a virtio-blk device's virtqueues is larger than
> BITS_PER_LONG, the out-of-bounds access to bitmap[ ] will occur.
> 
> Fixes: e21737ab15 ("virtio-blk: multiqueue batch notify")
> Cc: qemu-stable@nongnu.org
> Cc: Stefan Hajnoczi <stefanha@redhat.com>
> Signed-off-by: Li Hangjing <lihangjing@baidu.com>
> Reviewed-by: Xie Yongji <xieyongji@baidu.com>
> Reviewed-by: Chai Wen <chaiwen@baidu.com>
> ---
>  hw/block/dataplane/virtio-blk.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Ouch, thank you for the fix!  Applied to my block tree:
https://github.com/stefanha/qemu/commits/block

Stefan