[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH 1/2] megasas: use unsigned type for reply_queue_head
|
From: |
P J P |
|
Subject: |
[PATCH 1/2] megasas: use unsigned type for reply_queue_head |
|
Date: |
Thu, 7 May 2020 16:27:17 +0530 |
From: Prasad J Pandit <address@hidden>
A guest user may set 's->reply_queue_head' MegasasState field to
a negative value. Later in 'megasas_lookup_frame' it is used to
index into s->frames[] array. Use unsigned type to avoid OOB
access issue.
Reported-by: Ren Ding <address@hidden>
Signed-off-by: Prasad J Pandit <address@hidden>
---
hw/scsi/megasas.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c
index af18c88b65..433353bad0 100644
--- a/hw/scsi/megasas.c
+++ b/hw/scsi/megasas.c
@@ -112,7 +112,7 @@ typedef struct MegasasState {
uint64_t reply_queue_pa;
void *reply_queue;
int reply_queue_len;
- int reply_queue_head;
+ uint16_t reply_queue_head;
int reply_queue_tail;
uint64_t consumer_pa;
uint64_t producer_pa;
--
2.25.4