diff options
| author | Yuval Shaia <yuval.shaia@oracle.com> | 2018-04-30 23:02:21 +0300 |
|---|---|---|
| committer | Marcel Apfelbaum <marcel.apfelbaum@gmail.com> | 2018-05-03 20:52:29 +0300 |
| commit | 350929172b0205dccf19c29b93ac41a406ef740d (patch) | |
| tree | e3217a41ff7a9cd6695aed32177d9c999b2d6a61 /hw/rdma/vmw/pvrdma_main.c | |
| parent | c387e8a4ecee76479f4b83b58e2e8ab854ef74ee (diff) | |
hw/rdma: Fix possible out of bounds access to regs array
Coverity (CID1390589, CID1390608).
Array size is RDMA_BAR1_REGS_SIZE, let's make sure the given address is
in range.
While there also:
1. Adjust the size of this bar to reasonable size
2. Report the size of the array with sizeof(array)
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Yuval Shaia <yuval.shaia@oracle.com>
Reviewed-by: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
Message-Id: <20180430200223.4119-6-marcel.apfelbaum@gmail.com>
Diffstat (limited to 'hw/rdma/vmw/pvrdma_main.c')
| -rw-r--r-- | hw/rdma/vmw/pvrdma_main.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/hw/rdma/vmw/pvrdma_main.c b/hw/rdma/vmw/pvrdma_main.c index 994220b58e..3ed7409763 100644 --- a/hw/rdma/vmw/pvrdma_main.c +++ b/hw/rdma/vmw/pvrdma_main.c @@ -449,14 +449,14 @@ static void init_bars(PCIDevice *pdev) /* BAR 1 - Registers */ memset(&dev->regs_data, 0, sizeof(dev->regs_data)); memory_region_init_io(&dev->regs, OBJECT(dev), ®s_ops, dev, - "pvrdma-regs", RDMA_BAR1_REGS_SIZE); + "pvrdma-regs", sizeof(dev->regs_data)); pci_register_bar(pdev, RDMA_REG_BAR_IDX, PCI_BASE_ADDRESS_SPACE_MEMORY, &dev->regs); /* BAR 2 - UAR */ memset(&dev->uar_data, 0, sizeof(dev->uar_data)); memory_region_init_io(&dev->uar, OBJECT(dev), &uar_ops, dev, "rdma-uar", - RDMA_BAR2_UAR_SIZE); + sizeof(dev->uar_data)); pci_register_bar(pdev, RDMA_UAR_BAR_IDX, PCI_BASE_ADDRESS_SPACE_MEMORY, &dev->uar); } |