Re: [PATCH] accel/kvm: coalesced mmio: check lenght of the MMIO write entry

[Philippe Mathieu-Daudé]

On 23/9/26 18:46, Paolo Bonzini wrote:

Queued, thanks.  I changed the code to what Philippe suggested:

             ent = &ring->coalesced_mmio[ring->first];
             if (ent->len > sizeof(ent->data)) {
                 warn_report("coalesced MMIO entry has invalid len %u",
                             ent->len);
             } else {
                 as = ent->pio == 1 ? &address_space_io : &address_space_memory;
                 address_space_write(as, ent->phys_addr, MEMTXATTRS_UNSPECIFIED,
                                     ent->data, ent->len);
             }

Thank you!