virtio-blk: fix out-of-bounds access to bitmap in notify_guest_bh
When the number of a virtio-blk device's virtqueues is larger than
BITS_PER_LONG, the out-of-bounds access to bitmap[ ] will occur.
Fixes: e21737ab15
("virtio-blk: multiqueue batch notify")
Cc: qemu-stable@nongnu.org
Cc: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Li Hangjing <lihangjing@baidu.com>
Reviewed-by: Xie Yongji <xieyongji@baidu.com>
Reviewed-by: Chai Wen <chaiwen@baidu.com>
Message-id: 20191216023050.48620-1-lihangjing@baidu.com
Message-Id: <20191216023050.48620-1-lihangjing@baidu.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
This commit is contained in:
parent
f21673c35e
commit
725fe5d10d
|
@ -67,7 +67,7 @@ static void notify_guest_bh(void *opaque)
|
|||
memset(s->batch_notify_vqs, 0, sizeof(bitmap));
|
||||
|
||||
for (j = 0; j < nvqs; j += BITS_PER_LONG) {
|
||||
unsigned long bits = bitmap[j];
|
||||
unsigned long bits = bitmap[j / BITS_PER_LONG];
|
||||
|
||||
while (bits != 0) {
|
||||
unsigned i = j + ctzl(bits);
|
||||
|
|
Loading…
Reference in New Issue