From: Thanos Makatos <[email protected]>
The existing check for PCI capabilities misses the case where
info->cap_offset == info->argsz, which results in accessing unallocated
memory. Fix the comparison.
Fixes: 667866d66620 ("vfio-user: implement VFIO_USER_DEVICE_GET_REGION_INFO")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3865
Signed-off-by: Thanos Makatos <[email protected]>
Reviewed-by: Cédric Le Goater <[email protected]>
Link:
https://lore.kernel.org/qemu-devel/[email protected]
Signed-off-by: Cédric Le Goater <[email protected]>
(cherry picked from commit 20b3a363fa8c9a83715d7241ec21e2d516359a1b)
Signed-off-by: Michael Tokarev <[email protected]>
diff --git a/hw/vfio-user/device.c b/hw/vfio-user/device.c
index 580559d9b95..34af50aa83a 100644
--- a/hw/vfio-user/device.c
+++ b/hw/vfio-user/device.c
@@ -173,7 +173,8 @@ static int vfio_user_device_io_get_region_info(VFIODevice
*vbasedev,
/* cap_offset in valid area */
if ((info->flags & VFIO_REGION_INFO_FLAG_CAPS) &&
- (info->cap_offset < sizeof(*info) || info->cap_offset > info->argsz)) {
+ (info->cap_offset < sizeof(*info)
+ || info->cap_offset + sizeof(struct vfio_info_cap_header) >
info->argsz)) {
return -EINVAL;
}
--
2.47.3
