virtio-blk: add vq_rq[] bounds check in virtio_blk_dma_restart_cb()
authorStefan Hajnoczi <stefanha@redhat.com>
Tue, 6 Feb 2024 19:06:08 +0000 (14:06 -0500)
committerKevin Wolf <kwolf@redhat.com>
Wed, 7 Feb 2024 13:44:13 +0000 (14:44 +0100)
commitf2eea93c6b410efccc18f4b47090b4a4e842afbd
tree67c06d6dfcc23fff60fca3471d6bb2b53f230824
parent5fbcbd50fca67ffe35317f2e86f6822aa22e41c6
virtio-blk: add vq_rq[] bounds check in virtio_blk_dma_restart_cb()

Hanna Czenczek <hreitz@redhat.com> noted that the array index in
virtio_blk_dma_restart_cb() is not bounds-checked:

  g_autofree VirtIOBlockReq **vq_rq = g_new0(VirtIOBlockReq *, num_queues);
  ...
  while (rq) {
      VirtIOBlockReq *next = rq->next;
      uint16_t idx = virtio_get_queue_index(rq->vq);

      rq->next = vq_rq[idx];
                 ^^^^^^^^^^

The code is correct because both rq->vq and vq_rq[] depend on
num_queues, but this is indirect and not 100% obvious. Add an assertion.

Suggested-by: Hanna Czenczek <hreitz@redhat.com>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Hanna Czenczek <hreitz@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-ID: <20240206190610.107963-4-stefanha@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
hw/block/virtio-blk.c