From: Thanos Makatos <[email protected]>
The existing check for PCI capabilities misses the case where
info->cap_offset == info->argsz, which results in accessing unallocated
memory. Fix the comparison.
Fixes: 667866d66620 ("vfio-user: implement VFIO_USER_DEVICE_GET_REGION_INFO")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3865
Signed-off-by: Thanos Makatos <[email protected]>
Reviewed-by: Cédric Le Goater <[email protected]>
Link:
https://lore.kernel.org/qemu-devel/[email protected]
Signed-off-by: Cédric Le Goater <[email protected]>
---
hw/vfio-user/device.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/hw/vfio-user/device.c b/hw/vfio-user/device.c
index
008e5cf6877c84c3d0cf33f25a6ac9a4cf231e06..3d0dbe840649b7b678b79afd3dbc7f9caaeb947b
100644
--- a/hw/vfio-user/device.c
+++ b/hw/vfio-user/device.c
@@ -214,7 +214,8 @@ static int vfio_user_device_io_get_region_info(VFIODevice
*vbasedev,
/* cap_offset in valid area */
if ((info->flags & VFIO_REGION_INFO_FLAG_CAPS) &&
- (info->cap_offset < sizeof(*info) || info->cap_offset > info->argsz)) {
+ (info->cap_offset < sizeof(*info)
+ || info->cap_offset + sizeof(struct vfio_info_cap_header) >
info->argsz)) {
return -EINVAL;
}
--
2.55.0
