[PULL,03/16] virtio-blk: add vq_rq[] bounds check in virtio_blk_dma_restart_cb()

Commit Message

Kevin Wolf Feb. 7, 2024, 9:55 p.m. UTC

From: Stefan Hajnoczi <[e-mail]>

Hanna Czenczek <[e-mail]> noted that the array index in
virtio_blk_dma_restart_cb() is not bounds-checked:

  g_autofree VirtIOBlockReq **vq_rq = g_new0(VirtIOBlockReq *, num_queues);
  ...
  while (rq) {
      VirtIOBlockReq *next = rq->next;
      uint16_t idx = virtio_get_queue_index(rq->vq);

      rq->next = vq_rq[idx];
                 ^^^^^^^^^^

The code is correct because both rq->vq and vq_rq[] depend on
num_queues, but this is indirect and not 100% obvious. Add an assertion.

Suggested-by: Hanna Czenczek <[e-mail]>
Reviewed-by: Manos Pitsidianakis <[e-mail]>
Reviewed-by: Hanna Czenczek <[e-mail]>
Signed-off-by: Stefan Hajnoczi <[e-mail]>
Message-ID: <[e-mail]>
Reviewed-by: Kevin Wolf <[e-mail]>
Reviewed-by: Michael S. Tsirkin <[e-mail]>
Signed-off-by: Kevin Wolf <[e-mail]>
---
 hw/block/virtio-blk.c | 2 ++
 1 file changed, 2 insertions(+)

Patch

diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
index e430ba583c..31212506ca 100644
--- a/hw/block/virtio-blk.c
+++ b/hw/block/virtio-blk.c
@@ -1209,6 +1209,8 @@  static void virtio_blk_dma_restart_cb(void *opaque, bool running,
         VirtIOBlockReq *next = rq->next;
         uint16_t idx = virtio_get_queue_index(rq->vq);
 
+        /* Only num_queues vqs were created so vq_rq[idx] is within bounds */
+        assert(idx < num_queues);
         rq->next = vq_rq[idx];
         vq_rq[idx] = rq;
         rq = next;