diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2022-05-23 11:30:57 +0300 |
|---|---|---|
| committer | Michael S. Tsirkin <mst@redhat.com> | 2022-05-31 12:45:10 -0400 |
| commit | 1f97b9785076d32fbabb8fa23889f9969c84118d (patch) | |
| tree | 9e64fc0d244f1d0ddaab94bbd346b6aba607ed63 /drivers/vdpa | |
| parent | 4f58afd6eb177a75dec61c65fdc72db31db93c82 (diff) | |
vdpasim: Off by one in vdpasim_set_group_asid()
The > comparison needs to be >= to prevent an out of bounds access
of the vdpasim->iommu[] array. The vdpasim->iommu[] is allocated in
vdpasim_create() and it has vdpasim->dev_attr.nas elements.
Fixes: 87e5afeac247 ("vdpasim: control virtqueue support")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Message-Id: <YotGQU1q224RKZR8@kili>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Diffstat (limited to 'drivers/vdpa')
| -rw-r--r-- | drivers/vdpa/vdpa_sim/vdpa_sim.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/vdpa/vdpa_sim/vdpa_sim.c b/drivers/vdpa/vdpa_sim/vdpa_sim.c index 50d721072beb..0f2865899647 100644 --- a/drivers/vdpa/vdpa_sim/vdpa_sim.c +++ b/drivers/vdpa/vdpa_sim/vdpa_sim.c @@ -567,7 +567,7 @@ static int vdpasim_set_group_asid(struct vdpa_device *vdpa, unsigned int group, if (group > vdpasim->dev_attr.ngroups) return -EINVAL; - if (asid > vdpasim->dev_attr.nas) + if (asid >= vdpasim->dev_attr.nas) return -EINVAL; iommu = &vdpasim->iommu[asid]; |