| Message ID | 20231025101245.751559-3-clg@redhat.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | vfio/pci: Fix buffer overrun when writing the VF token | expand |
Cédric Le Goater <clg@redhat.com> wrote: > qemu_uuid_unparse() includes a trailing NUL when writing the uuid > string and the buffer size should be UUID_FMT_LEN + 1 bytes. Use the > recently added UUID_STR_LEN which defines the correct size. > > Fixes: CID 1522913 > Fixes: 2dca1b37a760 ("vfio/pci: add support for VF token") > Cc: Alex Williamson <alex.williamson@redhat.com> > Signed-off-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> For what is worth O:-)
On Wed, 25 Oct 2023 12:12:45 +0200 Cédric Le Goater <clg@redhat.com> wrote: > qemu_uuid_unparse() includes a trailing NUL when writing the uuid > string and the buffer size should be UUID_FMT_LEN + 1 bytes. Use the > recently added UUID_STR_LEN which defines the correct size. > > Fixes: CID 1522913 > Fixes: 2dca1b37a760 ("vfio/pci: add support for VF token") > Cc: Alex Williamson <alex.williamson@redhat.com> > Signed-off-by: Cédric Le Goater <clg@redhat.com> > --- > hw/vfio/pci.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c > index 9bfa83aca1a87952e18743c9ca951b1bfc873507..c02a5d70f5e1b8e4d22051285748f514f1b9f008 100644 > --- a/hw/vfio/pci.c > +++ b/hw/vfio/pci.c > @@ -3274,7 +3274,7 @@ static void vfio_realize(PCIDevice *pdev, Error **errp) > Error *err = NULL; > int i, ret; > bool is_mdev; > - char uuid[UUID_FMT_LEN]; > + char uuid[UUID_STR_LEN]; > char *name; > > if (vbasedev->fd < 0 && !vbasedev->sysfsdev) { Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c index 9bfa83aca1a87952e18743c9ca951b1bfc873507..c02a5d70f5e1b8e4d22051285748f514f1b9f008 100644 --- a/hw/vfio/pci.c +++ b/hw/vfio/pci.c @@ -3274,7 +3274,7 @@ static void vfio_realize(PCIDevice *pdev, Error **errp) Error *err = NULL; int i, ret; bool is_mdev; - char uuid[UUID_FMT_LEN]; + char uuid[UUID_STR_LEN]; char *name; if (vbasedev->fd < 0 && !vbasedev->sysfsdev) {
qemu_uuid_unparse() includes a trailing NUL when writing the uuid string and the buffer size should be UUID_FMT_LEN + 1 bytes. Use the recently added UUID_STR_LEN which defines the correct size. Fixes: CID 1522913 Fixes: 2dca1b37a760 ("vfio/pci: add support for VF token") Cc: Alex Williamson <alex.williamson@redhat.com> Signed-off-by: Cédric Le Goater <clg@redhat.com> --- hw/vfio/pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)