summaryrefslogtreecommitdiff
path: root/sys/dev
diff options
context:
space:
mode:
authorriastradh <riastradh@NetBSD.org>2023-03-29 09:44:25 +0000
committerriastradh <riastradh@NetBSD.org>2023-03-29 09:44:25 +0000
commit78bb5a5eff4435db6e6022e3a3b6f6ff0322703b (patch)
tree7f5949144326608a5ee0dfae3dfc55deef88485c /sys/dev
parentdc4b17131318dd924a6bfe78f606b960f36e4c44 (diff)
virtio(4): Fix sizing of virtqueue allocation.
vq->vq_avail[0].ring is a zero-length array, and thus sizeof is zero; likewise vq->vq_used[0].ring. Use vq->vq_avail[0].ring[0] and vq->vq_used[0].ring[0] to fix this and restore the previous allocation sizing logic. XXX We shouldn't use zero-length arrays here -- they are asking for trouble like this, and C99 has a standard way to express what we're actually trying to get at it, flexible array members. PR kern/57304 Reported-by: syzbot+7fb1047f5dfa33b26331@syzkaller.appspotmail.com
Diffstat (limited to 'sys/dev')
-rw-r--r--sys/dev/pci/virtio.c8
1 files changed, 4 insertions, 4 deletions
diff --git a/sys/dev/pci/virtio.c b/sys/dev/pci/virtio.c
index bfe3b28d6a9..4250c1f567e 100644
--- a/sys/dev/pci/virtio.c
+++ b/sys/dev/pci/virtio.c
@@ -1,4 +1,4 @@
-/* $NetBSD: virtio.c,v 1.71 2023/03/27 14:56:40 nakayama Exp $ */
+/* $NetBSD: virtio.c,v 1.72 2023/03/29 09:44:25 riastradh Exp $ */
/*
* Copyright (c) 2020 The NetBSD Foundation, Inc.
@@ -28,7 +28,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: virtio.c,v 1.71 2023/03/27 14:56:40 nakayama Exp $");
+__KERNEL_RCSID(0, "$NetBSD: virtio.c,v 1.72 2023/03/29 09:44:25 riastradh Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@@ -784,9 +784,9 @@ virtio_alloc_vq(struct virtio_softc *sc, struct virtqueue *vq,
size_desc = sizeof(vq->vq_desc[0]) * vq_num;
size_avail = sizeof(uint16_t) * hdrlen
- + sizeof(vq->vq_avail[0].ring) * vq_num;
+ + sizeof(vq->vq_avail[0].ring[0]) * vq_num;
size_used = sizeof(uint16_t) *hdrlen
- + sizeof(vq->vq_used[0].ring) * vq_num;
+ + sizeof(vq->vq_used[0].ring[0]) * vq_num;
size_indirect = (sc->sc_indirect && maxnsegs >= MINSEG_INDIRECT) ?
sizeof(struct vring_desc) * maxnsegs * vq_num : 0;