diff options
| author | riastradh <riastradh@NetBSD.org> | 2023-03-29 09:44:25 +0000 |
|---|---|---|
| committer | riastradh <riastradh@NetBSD.org> | 2023-03-29 09:44:25 +0000 |
| commit | 78bb5a5eff4435db6e6022e3a3b6f6ff0322703b (patch) | |
| tree | 7f5949144326608a5ee0dfae3dfc55deef88485c /sys/dev | |
| parent | dc4b17131318dd924a6bfe78f606b960f36e4c44 (diff) | |
virtio(4): Fix sizing of virtqueue allocation.
vq->vq_avail[0].ring is a zero-length array, and thus sizeof is zero;
likewise vq->vq_used[0].ring.
Use vq->vq_avail[0].ring[0] and vq->vq_used[0].ring[0] to fix this
and restore the previous allocation sizing logic.
XXX We shouldn't use zero-length arrays here -- they are asking for
trouble like this, and C99 has a standard way to express what we're
actually trying to get at it, flexible array members.
PR kern/57304
Reported-by: syzbot+7fb1047f5dfa33b26331@syzkaller.appspotmail.com
Diffstat (limited to 'sys/dev')
| -rw-r--r-- | sys/dev/pci/virtio.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/sys/dev/pci/virtio.c b/sys/dev/pci/virtio.c index bfe3b28d6a9..4250c1f567e 100644 --- a/sys/dev/pci/virtio.c +++ b/sys/dev/pci/virtio.c @@ -1,4 +1,4 @@ -/* $NetBSD: virtio.c,v 1.71 2023/03/27 14:56:40 nakayama Exp $ */ +/* $NetBSD: virtio.c,v 1.72 2023/03/29 09:44:25 riastradh Exp $ */ /* * Copyright (c) 2020 The NetBSD Foundation, Inc. @@ -28,7 +28,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: virtio.c,v 1.71 2023/03/27 14:56:40 nakayama Exp $"); +__KERNEL_RCSID(0, "$NetBSD: virtio.c,v 1.72 2023/03/29 09:44:25 riastradh Exp $"); #include <sys/param.h> #include <sys/systm.h> @@ -784,9 +784,9 @@ virtio_alloc_vq(struct virtio_softc *sc, struct virtqueue *vq, size_desc = sizeof(vq->vq_desc[0]) * vq_num; size_avail = sizeof(uint16_t) * hdrlen - + sizeof(vq->vq_avail[0].ring) * vq_num; + + sizeof(vq->vq_avail[0].ring[0]) * vq_num; size_used = sizeof(uint16_t) *hdrlen - + sizeof(vq->vq_used[0].ring) * vq_num; + + sizeof(vq->vq_used[0].ring[0]) * vq_num; size_indirect = (sc->sc_indirect && maxnsegs >= MINSEG_INDIRECT) ? sizeof(struct vring_desc) * maxnsegs * vq_num : 0; |
