summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDan Carpenter <dan.carpenter@oracle.com>2022-05-23 11:30:57 +0300
committerMichael S. Tsirkin <mst@redhat.com>2022-05-31 12:45:10 -0400
commit1f97b9785076d32fbabb8fa23889f9969c84118d (patch)
tree9e64fc0d244f1d0ddaab94bbd346b6aba607ed63
parent4f58afd6eb177a75dec61c65fdc72db31db93c82 (diff)
vdpasim: Off by one in vdpasim_set_group_asid()
The > comparison needs to be >= to prevent an out of bounds access of the vdpasim->iommu[] array. The vdpasim->iommu[] is allocated in vdpasim_create() and it has vdpasim->dev_attr.nas elements. Fixes: 87e5afeac247 ("vdpasim: control virtqueue support") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Message-Id: <YotGQU1q224RKZR8@kili> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Acked-by: Jason Wang <jasowang@redhat.com>
-rw-r--r--drivers/vdpa/vdpa_sim/vdpa_sim.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/vdpa/vdpa_sim/vdpa_sim.c b/drivers/vdpa/vdpa_sim/vdpa_sim.c
index 50d721072beb..0f2865899647 100644
--- a/drivers/vdpa/vdpa_sim/vdpa_sim.c
+++ b/drivers/vdpa/vdpa_sim/vdpa_sim.c
@@ -567,7 +567,7 @@ static int vdpasim_set_group_asid(struct vdpa_device *vdpa, unsigned int group,
if (group > vdpasim->dev_attr.ngroups)
return -EINVAL;
- if (asid > vdpasim->dev_attr.nas)
+ if (asid >= vdpasim->dev_attr.nas)
return -EINVAL;
iommu = &vdpasim->iommu[asid];