public/qemu
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

hw/xen: fix off-by-one in xen_evtchn_set_gsi()

Browse source 
Coverity points out (CID 1508128) a bounds checking error. We need to check
for gsi >= IOAPIC_NUM_PINS, not just greater-than.

Also fix up an assert() that has the same problem, that Coverity didn't see.

Fixes: 4f81baa33e ("hw/xen: Support GSI mapping to PIRQ")
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230801175747.145906-2-dwmw2@infradead.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
This commit is contained in:
David Woodhouse 2023-04-07 17:12:00 +02:00 committed by Philippe Mathieu-Daudé
parent 802341823f
commit cf885b1957
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
hw/i386/kvm/xen_evtchn.c
View file

@ -1587,7 +1587,7 @@ static int allocate_pirq(XenEvtchnState *s, int type, int gsi)
found:
pirq_inuse_word(s, pirq) |= pirq_inuse_bit(pirq);
if (gsi >= 0) {
assert(gsi <= IOAPIC_NUM_PINS);
assert(gsi < IOAPIC_NUM_PINS);
s->gsi_pirq[gsi] = pirq;
}
s->pirq[pirq].gsi = gsi;
@ -1601,7 +1601,7 @@ bool xen_evtchn_set_gsi(int gsi, int level)
assert(qemu_mutex_iothread_locked());
if (!s || gsi < 0 || gsi > IOAPIC_NUM_PINS) {
if (!s || gsi < 0 || gsi >= IOAPIC_NUM_PINS) {
return false;
}