From nobody Tue May 14 08:14:46 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1576463558; cv=none; d=zohomail.com; s=zohoarc; b=HiAfyTBi2GrJIsvu4eE5BowU2qiENgOM5xFjD9puJSJfqaK2664irzQrXylLxwNQTKkw2YiBpCj86as90WGBnKdbGMo/CvC+wuUDjJ/FhjEgo3FxAQq++KrMXmR1oWjLfdod1WHVc7pw25pePOw+YRYYQu0lKrbBe9+y9tfoFUk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1576463558; h=Content-Type:Cc:Date:From:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:To; bh=xnZz2yhxxfwJ5Gv4gXw2cYnG2JE23l+xCle06jNz/u8=; b=V/BmzYCD4NE8rOAX0zASoQMa9LhySorHe3cFHqGYsjYxQhQEPh2EeU7UiAA5d9C5q0u9/wTqpcUjHbLLJoN1lh2RKsEgyuDWA67zciJdQpp7z10bWoHEo5XuZc7kEVY6gwe7Elkn3AiyX3OgKMWyO/Ughu2ZuHL9pbxxKSCg99A= ARC-Authentication-Results: i=1; mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1576463558019656.940886786812; Sun, 15 Dec 2019 18:32:38 -0800 (PST) Received: from localhost ([::1]:45508 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1iggBX-0003Tg-NW for importer@patchew.org; Sun, 15 Dec 2019 21:32:35 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]:34832) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1iggAd-00033V-8S for qemu-devel@nongnu.org; Sun, 15 Dec 2019 21:31:40 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1iggAX-0001BC-Bx for qemu-devel@nongnu.org; Sun, 15 Dec 2019 21:31:34 -0500 Received: from mx24.baidu.com ([111.206.215.185]:53500 helo=baidu.com) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1iggAW-0008SU-Ts; Sun, 15 Dec 2019 21:31:33 -0500 Received: from BC-Mail-Ex07.internal.baidu.com (unknown [172.31.51.47]) by Forcepoint Email with ESMTPS id C89E09132E2D8EE03B4D; Mon, 16 Dec 2019 10:31:17 +0800 (CST) Received: from BJHW-Mail-Ex03.internal.baidu.com (10.127.64.13) by BC-Mail-EX07.internal.baidu.com (172.31.51.47) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1531.3; Mon, 16 Dec 2019 10:31:17 +0800 Received: from DDAFF7EBB9FF247.internal.baidu.com (172.31.63.8) by BJHW-Mail-Ex03.internal.baidu.com (10.127.64.13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5; Mon, 16 Dec 2019 10:31:17 +0800 From: Li hangjing To: , Subject: [PATCH] virtio-blk: fix out-of-bounds access to bitmap in notify_guest_bh Date: Mon, 16 Dec 2019 10:30:50 +0800 Message-ID: <20191216023050.48620-1-lihangjing@baidu.com> X-Mailer: git-send-email 2.15.1.windows.2 MIME-Version: 1.0 X-Originating-IP: [172.31.63.8] X-ClientProxiedBy: BC-Mail-Ex21.internal.baidu.com (172.31.51.15) To BJHW-Mail-Ex03.internal.baidu.com (10.127.64.13) X-Baidu-BdMsfe-DateCheck: 1_BJHW-Mail-Ex03_2019-12-16 10:31:17:609 X-Baidu-BdMsfe-VirusCheck: BJHW-Mail-Ex03_GRAY_Inside_WithoutAtta_2019-12-16 10:31:17:640 X-Baidu-BdMsfe-DateCheck: 1_BJHW-Mail-Ex03_2019-12-16 10:31:17:672 X-Baidu-BdMsfe-DateCheck: 1_BC-Mail-Ex07_2019-12-16 10:31:17:787 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 111.206.215.185 X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: lihangjing@baidu.com, xieyongji@baidu.com, qemu-stable@nongnu.org, chaiwen@baidu.com Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Li Hangjing When the number of a virtio-blk device's virtqueues is larger than BITS_PER_LONG, the out-of-bounds access to bitmap[ ] will occur. Fixes: e21737ab15 ("virtio-blk: multiqueue batch notify") Cc: qemu-stable@nongnu.org Cc: Stefan Hajnoczi Signed-off-by: Li Hangjing Reviewed-by: Xie Yongji Reviewed-by: Chai Wen --- hw/block/dataplane/virtio-blk.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/block/dataplane/virtio-blk.c b/hw/block/dataplane/virtio-bl= k.c index 119906a5fe..1b52e8159c 100644 --- a/hw/block/dataplane/virtio-blk.c +++ b/hw/block/dataplane/virtio-blk.c @@ -67,7 +67,7 @@ static void notify_guest_bh(void *opaque) memset(s->batch_notify_vqs, 0, sizeof(bitmap)); =20 for (j =3D 0; j < nvqs; j +=3D BITS_PER_LONG) { - unsigned long bits =3D bitmap[j]; + unsigned long bits =3D bitmap[j / BITS_PER_LONG]; =20 while (bits !=3D 0) { unsigned i =3D j + ctzl(bits); --=20 2.15.1.windows.2