From de5bbfc602ef1b9b79c494a914c6083a1a23cca2 Mon Sep 17 00:00:00 2001 From: Dmitry Frolov Date: Tue, 19 Sep 2023 11:19:25 +0100 Subject: hw/cxl: Fix out of bound array access According to cxl_interleave_ways_enc(), fw->num_targets is allowed to be up to 16. This also corresponds to CXL r3.0 spec. So, the fw->target_hbs[] array is iterated from 0 to 15. But it is statically declared of length 8. Thus, out of bound array access may occur. Fixes: c28db9e000 ("hw/pci-bridge: Make PCIe and CXL PXB Devices inherit from TYPE_PXB_DEV") Signed-off-by: Dmitry Frolov Reviewed-by: Michael Tokarev Link: https://lore.kernel.org/r/20230913101055.754709-1-frolov@swemel.ru Cc: qemu-stable@nongnu.org Signed-off-by: Jonathan Cameron Signed-off-by: Michael Tokarev --- include/hw/cxl/cxl.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include/hw') diff --git a/include/hw/cxl/cxl.h b/include/hw/cxl/cxl.h index 56c9e76..4944725 100644 --- a/include/hw/cxl/cxl.h +++ b/include/hw/cxl/cxl.h @@ -29,7 +29,7 @@ typedef struct PXBCXLDev PXBCXLDev; typedef struct CXLFixedWindow { uint64_t size; char **targets; - PXBCXLDev *target_hbs[8]; + PXBCXLDev *target_hbs[16]; uint8_t num_targets; uint8_t enc_int_ways; uint8_t enc_int_gran; -- cgit v1.1