qemu-devel
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [PATCH v3] hw/cxl: Fix out of bound array access


From: Michael Tokarev
Subject: Re: [PATCH v3] hw/cxl: Fix out of bound array access
Date: Thu, 14 Sep 2023 15:36:05 +0300
User-agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Thunderbird/102.15.0

14.09.2023 10:06, Dmitry Frolov wrote:
According to cxl_interleave_ways_enc(), fw->num_targets is allowed to be up
to 16. This also corresponds to CXL specs. So, the fw->target_hbs[] array
is iterated from 0 to 15. But it is statically declared of length 8. Thus,
out of bound array access may occur.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

v2: assert added
v3: assert removed

So it's the same as the initial submission.

/mjt



reply via email to

[Prev in Thread] Current Thread [Next in Thread]