diff options
| author | Jonathan Cameron <Jonathan.Cameron@huawei.com> | 2024-11-01 13:39:16 +0000 |
|---|---|---|
| committer | Michael S. Tsirkin <mst@redhat.com> | 2024-11-04 16:03:25 -0500 |
| commit | 5300bdf5898dda5989215e183bccd555cc782b9a (patch) | |
| tree | 20f7122c57c8048a71243019e8527e9c651a124c /hw | |
| parent | c1c4d6b38b13952b0a9e2d7393e1ccc70b2615a4 (diff) | |
| download | qemu-5300bdf5898dda5989215e183bccd555cc782b9a.zip qemu-5300bdf5898dda5989215e183bccd555cc782b9a.tar.gz qemu-5300bdf5898dda5989215e183bccd555cc782b9a.tar.bz2 | |
hw/cxl: Ensure there is enough data for the header in cmd_ccls_set_lsa()
The properties of the requested set command cannot be established if
len_in is less than the size of the header.
Reported-by: Esifiel <esifiel@gmail.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Message-Id: <20241101133917.27634-10-Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Diffstat (limited to 'hw')
| -rw-r--r-- | hw/cxl/cxl-mailbox-utils.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c index 078782e..f4a436e 100644 --- a/hw/cxl/cxl-mailbox-utils.c +++ b/hw/cxl/cxl-mailbox-utils.c @@ -1503,8 +1503,8 @@ static CXLRetCode cmd_ccls_set_lsa(const struct cxl_cmd *cmd, const size_t hdr_len = offsetof(struct set_lsa_pl, data); *len_out = 0; - if (!len_in) { - return CXL_MBOX_SUCCESS; + if (len_in < hdr_len) { + return CXL_MBOX_INVALID_PAYLOAD_LENGTH; } if (set_lsa_payload->offset + len_in > cvc->get_lsa_size(ct3d) + hdr_len) { |