Am 17.09.26 um 01:15 schrieb Matthew Rosato:
On 9/16/26 4:32 PM, Eric Farman wrote:
The interrupt subclass is often defined as a uint8, though in practice
it will be within the range of just 0-7. Ensure that a guest-supplied
subclass does not extend beyond its expected range, especially when
used as an array index.
Signed-off-by: Eric Farman <[email protected]>
---
hw/s390x/css.c | 7 ++++++-
hw/s390x/virtio-ccw.c | 6 ++++++
2 files changed, 12 insertions(+), 1 deletion(-)
diff --git a/hw/s390x/css.c b/hw/s390x/css.c
index 76dbca3bb9..9da9128d88 100644
--- a/hw/s390x/css.c
+++ b/hw/s390x/css.c
@@ -654,8 +654,13 @@ void css_adapter_interrupt(CssIoAdapterType type, uint8_t
isc)
S390FLICState *fs = s390_get_flic();
S390FLICStateClass *fsc = s390_get_flic_class(fs);
uint32_t io_int_word = (isc << 27) | IO_INT_WORD_AI;
- IoAdapter *adapter = channel_subsys.io_adapters[type][isc];
I think this deserve a fixes/cc stable. This would have been an
out-of-range access before this patch.
The initial support didn't have the concept of MAX_ISC, it showed up in
dde522bbc5 ("s390x: register I/O adapters per ISC during init")
Yes.
Acked-by: Christian Borntraeger <[email protected]>
