david.venhoff/QEMU-Nyx-fork
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

hw/rdma: Fix possible out of bounds access to GID table

Browse Source 
Array size is MAX_PORT_GIDS, let's make sure the given index is in
range.

While there limit device table size to 1.

Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Yuval Shaia <yuval.shaia@oracle.com>
Reviewed-by: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
Message-Id: <20180430200223.4119-5-marcel.apfelbaum@gmail.com>
This commit is contained in:
Yuval Shaia 2018-04-30 23:02:20 +03:00 committed by Marcel Apfelbaum
parent b9e34872b9
commit c387e8a4ec
2 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
hw/rdma/rdma_rm_defs.h
View File

@ -20,9 +20,9 @@
#define MAX_PORTS 1 #define MAX_PORTS 1
#define MAX_PORT_GIDS 1 #define MAX_PORT_GIDS 1
#define MAX_GIDS MAX_PORT_GIDS
#define MAX_PORT_PKEYS 1 #define MAX_PORT_PKEYS 1
#define MAX_PKEYS MAX_PORT_PKEYS #define MAX_PKEYS MAX_PORT_PKEYS
#define MAX_GIDS 2048
#define MAX_UCS 512 #define MAX_UCS 512
#define MAX_MR_SIZE (1UL << 27) #define MAX_MR_SIZE (1UL << 27)
#define MAX_QP 1024 #define MAX_QP 1024

8
hw/rdma/vmw/pvrdma_cmd.c
View File

@ -576,7 +576,7 @@ static int create_bind(PVRDMADev *dev, union pvrdma_cmd_req *req,
pr_dbg("index=%d\n", cmd->index); pr_dbg("index=%d\n", cmd->index);
if (cmd->index > MAX_PORT_GIDS) { if (cmd->index >= MAX_PORT_GIDS) {
return -EINVAL; return -EINVAL;
} }
@ -603,7 +603,11 @@ static int destroy_bind(PVRDMADev *dev, union pvrdma_cmd_req *req,
{ {
struct pvrdma_cmd_destroy_bind *cmd = &req->destroy_bind; struct pvrdma_cmd_destroy_bind *cmd = &req->destroy_bind;
pr_dbg("clear index %d\n", cmd->index); pr_dbg("index=%d\n", cmd->index);
if (cmd->index >= MAX_PORT_GIDS) {
return -EINVAL;
}
memset(dev->rdma_dev_res.ports[0].gid_tbl[cmd->index].raw, 0, memset(dev->rdma_dev_res.ports[0].gid_tbl[cmd->index].raw, 0,
sizeof(dev->rdma_dev_res.ports[0].gid_tbl[cmd->index].raw)); sizeof(dev->rdma_dev_res.ports[0].gid_tbl[cmd->index].raw));