From: Li Hangjing <lihangj...@baidu.com> When the number of a virtio-blk device's virtqueues is larger than BITS_PER_LONG, the out-of-bounds access to bitmap[ ] will occur.
Fixes: e21737ab15 ("virtio-blk: multiqueue batch notify") Cc: qemu-sta...@nongnu.org Cc: Stefan Hajnoczi <stefa...@redhat.com> Signed-off-by: Li Hangjing <lihangj...@baidu.com> Reviewed-by: Xie Yongji <xieyon...@baidu.com> Reviewed-by: Chai Wen <chai...@baidu.com> Message-id: 20191216023050.48620-1-lihangj...@baidu.com Message-Id: <20191216023050.48620-1-lihangj...@baidu.com> Signed-off-by: Stefan Hajnoczi <stefa...@redhat.com> --- hw/block/dataplane/virtio-blk.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/block/dataplane/virtio-blk.c b/hw/block/dataplane/virtio-blk.c index 119906a5fe..1b52e8159c 100644 --- a/hw/block/dataplane/virtio-blk.c +++ b/hw/block/dataplane/virtio-blk.c @@ -67,7 +67,7 @@ static void notify_guest_bh(void *opaque) memset(s->batch_notify_vqs, 0, sizeof(bitmap)); for (j = 0; j < nvqs; j += BITS_PER_LONG) { - unsigned long bits = bitmap[j]; + unsigned long bits = bitmap[j / BITS_PER_LONG]; while (bits != 0) { unsigned i = j + ctzl(bits); -- 2.23.0