Commit 4e39ecad authored by Xiaoguang Wang's avatar Xiaoguang Wang Committed by Michael S. Tsirkin
Browse files

vp_vdpa: fix id_table array not null terminated error 



Allocate one extra virtio_device_id as null terminator, otherwise
vdpa_mgmtdev_get_classes() may iterate multiple times and visit
undefined memory.

Fixes: ffbda8e9 ("vdpa/vp_vdpa : add vdpa tool support in vp_vdpa")
Cc: stable@vger.kernel.org
Suggested-by: default avatarParav Pandit <parav@nvidia.com>
Signed-off-by: default avatarAngus Chen <angus.chen@jaguarmicro.com>
Signed-off-by: default avatarXiaoguang Wang <lege.wang@jaguarmicro.com>
Message-Id: <20241105133518.1494-1-lege.wang@jaguarmicro.com>
Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
Reviewed-by: default avatarParav Pandit <parav@nvidia.com>
Acked-by: default avatarJason Wang <jasowang@redhat.com>
parent 97ee04fe

drivers/vdpa/virtio_pci/vp_vdpa.c

+7 −3
Original line number Diff line number Diff line
@@ -612,7 +612,11 @@ static int vp_vdpa_probe(struct pci_dev *pdev, const struct pci_device_id *id) 
		goto mdev_err;

	}



	mdev_id = kzalloc(sizeof(struct virtio_device_id), GFP_KERNEL);

	/*

	 * id_table should be a null terminated array, so allocate one additional

	 * entry here, see vdpa_mgmtdev_get_classes().

	 */

	mdev_id = kcalloc(2, sizeof(struct virtio_device_id), GFP_KERNEL);

	if (!mdev_id) {

		err = -ENOMEM;

		goto mdev_id_err;
@@ -632,8 +636,8 @@ static int vp_vdpa_probe(struct pci_dev *pdev, const struct pci_device_id *id) 
		goto probe_err;

	}



	mdev_id->device = mdev->id.device;

	mdev_id->vendor = mdev->id.vendor;

	mdev_id[0].device = mdev->id.device;

	mdev_id[0].vendor = mdev->id.vendor;

	mgtdev->id_table = mdev_id;

	mgtdev->max_supported_vqs = vp_modern_get_num_queues(mdev);

	mgtdev->supported_features = vp_modern_get_features(mdev);