50 lines
1.7 KiB
Diff
50 lines
1.7 KiB
Diff
|
From f85d0fc3975bb20a6cdbbef21408f3d8d00e2a3f Mon Sep 17 00:00:00 2001
|
|||
|
|
From: David Marchand <david.marchand@redhat.com>
|
|||
|
|
Date: Wed, 18 May 2022 12:16:54 +0200
|
|||
|
|
Subject: [PATCH] vdpa/ifc: fix build with GCC 12
|
|||
|
|
MIME-Version: 1.0
|
|||
|
|
Content-Type: text/plain; charset=UTF-8
|
|||
|
|
Content-Transfer-Encoding: 8bit
|
|||
|
|
|
|||
|
|
[ upstream commit 2a213b794fdd255fde7581a7c9bd034ab39e9b6a ]
|
|||
|
|
|
|||
|
|
GCC 12 raises the following warning:
|
|||
|
|
|
|||
|
|
../drivers/vdpa/ifc/ifcvf_vdpa.c: In function ‘vdpa_enable_vfio_intr’:
|
|||
|
|
../drivers/vdpa/ifc/ifcvf_vdpa.c:383:62: error: writing 4 bytes into a
|
|||
|
|
region of size 0 [-Werror=stringop-overflow=]
|
|||
|
|
383 | fd_ptr[RTE_INTR_VEC_RXTX_OFFSET + i] = fd;
|
|||
|
|
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~
|
|||
|
|
../drivers/vdpa/ifc/ifcvf_vdpa.c:348:14: note: at offset 32 into
|
|||
|
|
destination object ‘irq_set_buf’ of size 32
|
|||
|
|
348 | char irq_set_buf[MSIX_IRQ_SET_BUF_LEN];
|
|||
|
|
| ^~~~~~~~~~~
|
|||
|
|
|
|||
|
|
Validate number of vrings to avoid out of bound access.
|
|||
|
|
|
|||
|
|
Bugzilla ID: 855
|
|||
|
|
|
|||
|
|
Signed-off-by: David Marchand <david.marchand@redhat.com>
|
|||
|
|
Acked-by: Xiao Wang <xiao.w.wang@intel.com>
|
|||
|
|
Acked-by: Stephen Hemminger <stephen@networkplumber.org>
|
|||
|
|
---
|
|||
|
|
drivers/vdpa/ifc/ifcvf_vdpa.c | 2 ++
|
|||
|
|
1 file changed, 2 insertions(+)
|
|||
|
|
|
|||
|
|
diff --git a/drivers/vdpa/ifc/ifcvf_vdpa.c b/drivers/vdpa/ifc/ifcvf_vdpa.c
|
|||
|
|
index 3853c4cf7e..6a915b0d5e 100644
|
|||
|
|
--- a/drivers/vdpa/ifc/ifcvf_vdpa.c
|
|||
|
|
+++ b/drivers/vdpa/ifc/ifcvf_vdpa.c
|
|||
|
|
@@ -356,6 +356,8 @@ vdpa_enable_vfio_intr(struct ifcvf_internal *internal, bool m_rx)
|
|||
|
|
vring.callfd = -1;
|
|||
|
|
|
|||
|
|
nr_vring = rte_vhost_get_vring_num(internal->vid);
|
|||
|
|
+ if (nr_vring > IFCVF_MAX_QUEUES * 2)
|
|||
|
|
+ return -1;
|
|||
|
|
|
|||
|
|
irq_set = (struct vfio_irq_set *)irq_set_buf;
|
|||
|
|
irq_set->argsz = sizeof(irq_set_buf);
|
|||
|
|
--
|
|||
|
|
2.23.0
|
|||
|
|
|