friedkiwi/qemu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
ea985d235b868047cb4d8cb5657bcd8ad98c6ba2
qemu/include/hw
T
History
Dmitry FrolovandMichael Tokarev de5bbfc602 hw/cxl: Fix out of bound array access 
According to cxl_interleave_ways_enc(), fw->num_targets is allowed to be up
to 16. This also corresponds to CXL r3.0 spec. So, the fw->target_hbs[]
array is iterated from 0 to 15. But it is statically declared of length 8.
Thus, out of bound array access may occur.

Fixes: c28db9e000 ("hw/pci-bridge: Make PCIe and CXL PXB Devices inherit from TYPE_PXB_DEV")
Signed-off-by: Dmitry Frolov <frolov@swemel.ru>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Link: https://lore.kernel.org/r/20230913101055.754709-1-frolov@swemel.ru
Cc: qemu-stable@nongnu.org
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2023-09-21 11:31:18 +03:00
..
acpi
include/: spelling fixes
2023-09-08 13:08:52 +03:00
adc
…
arm
hw/arm/versal: Connect the CFRAME_REG and CFRAME_BCAST_REG
2023-09-08 16:41:35 +01:00
audio
…
block
m25p80: Introduce an helper to retrieve the BlockBackend of a device
2023-09-01 11:40:04 +02:00
char
include/: spelling fixes
2023-09-08 13:08:52 +03:00
core
accel/tcg: Simplify tlb_plugin_lookup
2023-09-16 14:57:15 +00:00
cpu
…
cris
…
cxl
hw/cxl: Fix out of bound array access
2023-09-21 11:31:18 +03:00
display
…
dma
…
firmware
…
gpio
hw/gpio/nrf51: implement DETECT signal
2023-08-22 17:30:59 +01:00
hyperv
include/: spelling fixes
2023-09-08 13:08:52 +03:00
i2c
Merge tag 'pull-aspeed-20230901' of https://github.com/legoater/qemu into staging
2023-09-06 11:14:55 -04:00
i386
i386: spelling fixes
2023-09-20 07:54:34 +03:00
ide
hw/ide: Extract bmdma_status_writeb()
2023-07-11 00:11:25 +02:00
input
…
intc
arm: spelling fixes
2023-07-25 17:13:53 +03:00
ipack
…
ipmi
…
isa
hw/isa/vt82c686: Remove via_isa_set_irq()
2023-07-11 00:11:25 +02:00
loongarch
…
m68k
q800: move macfb device to Q800MachineState
2023-06-22 09:30:11 +02:00
mem
nvdimm: Reject writing label data to ROM instead of crashing QEMU
2023-09-19 10:23:21 +02:00
mips
…
misc
Merge tag 'pull-target-arm-20230908' of https://git.linaro.org/people/pmaydell/qemu-arm into staging
2023-09-11 09:10:37 -04:00
net
include/: spelling fixes
2023-09-08 13:08:52 +03:00
nubus
…
nvram
bulk: Do not declare function prototypes using 'extern' keyword
2023-08-31 19:47:43 +02:00
openrisc
…
pci
Merge tag 'pull-trivial-patches' of https://gitlab.com/mjt0k/qemu into staging
2023-09-08 10:06:25 -04:00
pci-bridge
…
pci-host
spapr: Remove support for NVIDIA V100 GPU with NVLink2
2023-09-18 07:25:28 -03:00
ppc
ppc: spelling fixes
2023-09-20 07:54:34 +03:00
rdma
…
remote
…
riscv
riscv: spelling fixes
2023-09-08 13:08:52 +03:00
rtc
hw/rtc/aspeed_rtc: Use 64-bit offset for holding time_t difference
2023-08-31 09:45:18 +01:00
rx
…
s390x
s390x: spelling fixes
2023-07-25 17:13:45 +03:00
scsi
scsi: fetch unit attention when creating the request
2023-07-14 11:10:58 +02:00
sd
hw/sd: Introduce a "sd-card" SPI variant model
2023-09-01 11:40:04 +02:00
sensor
…
sh4
…
southbridge
…
sparc
…
ssi
include/: spelling fixes
2023-09-08 13:08:52 +03:00
timer
…
tricore
…
usb
…
vfio
vfio/migration: Refactor PRE_COPY and RUNNING state checks
2023-09-11 08:34:05 +02:00
virtio
include/: spelling fixes
2023-09-08 13:08:52 +03:00
watchdog
…
xen
xen_arm: Initialize RAM and add hi/low memory regions
2023-08-30 18:23:08 -07:00
xtensa
…
boards.h
include/: spelling fixes
2023-09-08 13:08:52 +03:00
clock.h
include/: spelling fixes
2023-09-08 13:08:52 +03:00
elf_ops.h
…
fw-path-provider.h
…
hotplug.h
…
hw.h
…
ide.h
…
irq.h
…
loader-fit.h
…
loader.h
…
nmi.h
…
or-irq.h
…
pcmcia.h
…
platform-bus.h
…
ptimer.h
…
qdev-clock.h
…
qdev-core.h
bulk: Do not declare function prototypes using 'extern' keyword
2023-08-31 19:47:43 +02:00
qdev-dma.h
…
qdev-properties-system.h
…
qdev-properties.h
…
register.h
…
registerfields.h
…
resettable.h
…
stream.h
…
sysbus.h
…
usb.h
…
vmstate-if.h
…