Commit 1f97b978 authored by Dan Carpenter's avatar Dan Carpenter Committed by Michael S. Tsirkin
Browse files

vdpasim: Off by one in vdpasim_set_group_asid() 



The > comparison needs to be >= to prevent an out of bounds access
of the vdpasim->iommu[] array.  The vdpasim->iommu[] is allocated in
vdpasim_create() and it has vdpasim->dev_attr.nas elements.

Fixes: 87e5afeac247 ("vdpasim: control virtqueue support")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Message-Id: <YotGQU1q224RKZR8@kili>
Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
Acked-by: default avatarJason Wang <jasowang@redhat.com>
parent 4f58afd6

drivers/vdpa/vdpa_sim/vdpa_sim.c

+1 −1
Original line number Diff line number Diff line
@@ -567,7 +567,7 @@ static int vdpasim_set_group_asid(struct vdpa_device *vdpa, unsigned int group, 
	if (group > vdpasim->dev_attr.ngroups)

		return -EINVAL;



	if (asid > vdpasim->dev_attr.nas)

	if (asid >= vdpasim->dev_attr.nas)

		return -EINVAL;



	iommu = &vdpasim->iommu[asid];