The interrupt subclass is often defined as a uint8, though in practice it will be within the range of just 0-7. Ensure that a guest-supplied subclass does not extend beyond its expected range, especially when used as an array index.
Signed-off-by: Eric Farman <[email protected]> --- hw/s390x/css.c | 7 ++++++- hw/s390x/virtio-ccw.c | 6 ++++++ 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/hw/s390x/css.c b/hw/s390x/css.c index 76dbca3bb9..9da9128d88 100644 --- a/hw/s390x/css.c +++ b/hw/s390x/css.c @@ -654,8 +654,13 @@ void css_adapter_interrupt(CssIoAdapterType type, uint8_t isc) S390FLICState *fs = s390_get_flic(); S390FLICStateClass *fsc = s390_get_flic_class(fs); uint32_t io_int_word = (isc << 27) | IO_INT_WORD_AI; - IoAdapter *adapter = channel_subsys.io_adapters[type][isc]; + IoAdapter *adapter; + + if (type >= CSS_IO_ADAPTER_TYPE_NUMS || isc > MAX_ISC) { + return; + } + adapter = channel_subsys.io_adapters[type][isc]; if (!adapter) { return; } diff --git a/hw/s390x/virtio-ccw.c b/hw/s390x/virtio-ccw.c index 30fb2c0681..eb6378ea4c 100644 --- a/hw/s390x/virtio-ccw.c +++ b/hw/s390x/virtio-ccw.c @@ -46,6 +46,10 @@ static int virtio_ccw_dev_post_load(void *opaque, int version_id) CcwDevice *ccw_dev = CCW_DEVICE(dev); CCWDeviceClass *ck = CCW_DEVICE_GET_CLASS(ccw_dev); + if (dev->thinint_isc > MAX_ISC) { + return -EINVAL; + } + ccw_dev->sch->driver_data = dev; if (ccw_dev->sch->thinint_active) { dev->routes.adapter.adapter_id = css_get_adapter_id( @@ -659,6 +663,8 @@ static int virtio_ccw_cb(SubchDev *sch, CCW1 ccw) } else { if (ccw_dstream_read(&sch->cds, thinint)) { ret = -EFAULT; + } else if (thinint.isc > MAX_ISC) { + ret = -ENOSYS; } else { thinint.ind_bit = be64_to_cpu(thinint.ind_bit); thinint.summary_indicator = -- 2.53.0
