From: "Michael S. Tsirkin" <[email protected]>
scrub_shadow_regions() and vhost_user_add_remove_regions() use
fixed-size stack arrays sized to VHOST_USER_MAX_RAM_SLOTS and index them
with dev->mem->nregions.
nregions is calculated to never overrun these, but let's add an assert
to make sure we don't get a stack overflow if there's a bug.
Fixes: f1aeb14b08 ("Transmit vhost-user memory regions individually")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3910
Cc: Stefano Garzarella <[email protected]>
Cc: Raphael Norwitz <[email protected]>
Reported-by: Feifan Qian <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Message-ID:
<48fb8411f67e525872fb19618a886e52b670ab7f.1784896199.git....@redhat.com>
(cherry picked from commit cf89b769cdd1933796099706387d3b2a9a865cae)
Signed-off-by: Michael Tokarev <[email protected]>
diff --git a/hw/virtio/vhost-user.c b/hw/virtio/vhost-user.c
index a8907cca74e..945e40c448b 100644
--- a/hw/virtio/vhost-user.c
+++ b/hw/virtio/vhost-user.c
@@ -831,6 +831,9 @@ static int vhost_user_add_remove_regions(struct vhost_dev
*dev,
msg->hdr.size = sizeof(msg->payload.mem_reg);
+ /* Ensure nregions fits the fixed-size arrays used below. */
+ assert(dev->mem->nregions <= VHOST_USER_MAX_RAM_SLOTS);
+
/* Find the regions which need to be removed or added. */
scrub_shadow_regions(dev, add_reg, &nr_add_reg, rem_reg, &nr_rem_reg,
shadow_pcb, track_ramblocks);
--
2.47.3
