From: Li Hangjing Date: Mon, 16 Dec 2019 02:30:50 +0000 (+0800) Subject: virtio-blk: fix out-of-bounds access to bitmap in notify_guest_bh X-Git-Tag: v4.2.1~149 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=def30090ad7917c9a6c68065922759dd83900d6f;p=thirdparty%2Fqemu.git virtio-blk: fix out-of-bounds access to bitmap in notify_guest_bh When the number of a virtio-blk device's virtqueues is larger than BITS_PER_LONG, the out-of-bounds access to bitmap[ ] will occur. Fixes: e21737ab15 ("virtio-blk: multiqueue batch notify") Cc: qemu-stable@nongnu.org Cc: Stefan Hajnoczi Signed-off-by: Li Hangjing Reviewed-by: Xie Yongji Reviewed-by: Chai Wen Message-id: 20191216023050.48620-1-lihangjing@baidu.com Message-Id: <20191216023050.48620-1-lihangjing@baidu.com> Signed-off-by: Stefan Hajnoczi (cherry picked from commit 725fe5d10dbd4259b1853b7d253cef83a3c0d22a) Signed-off-by: Michael Roth --- diff --git a/hw/block/dataplane/virtio-blk.c b/hw/block/dataplane/virtio-blk.c index 119906a5fe7..1b52e8159c8 100644 --- a/hw/block/dataplane/virtio-blk.c +++ b/hw/block/dataplane/virtio-blk.c @@ -67,7 +67,7 @@ static void notify_guest_bh(void *opaque) memset(s->batch_notify_vqs, 0, sizeof(bitmap)); for (j = 0; j < nvqs; j += BITS_PER_LONG) { - unsigned long bits = bitmap[j]; + unsigned long bits = bitmap[j / BITS_PER_LONG]; while (bits != 0) { unsigned i = j + ctzl(bits);