GCC 12 raises the following warning:
../drivers/vdpa/ifc/ifcvf_vdpa.c: In function ‘vdpa_enable_vfio_intr’:
../drivers/vdpa/ifc/ifcvf_vdpa.c:383:62: error: writing 4 bytes into a
region of size 0 [-Werror=stringop-overflow=]
383 | fd_ptr[RTE_INTR_VEC_RXTX_OFFSET + i] = fd;
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~
../drivers/vdpa/ifc/ifcvf_vdpa.c:348:14: note: at offset 32 into
destination object ‘irq_set_buf’ of size 32
348 | char irq_set_buf[MSIX_IRQ_SET_BUF_LEN];
| ^~~~~~~~~~~
Validate number of vrings to avoid out of bound access.
Cc: sta...@dpdk.org
Signed-off-by: David Marchand <david.march...@redhat.com>
---
drivers/vdpa/ifc/ifcvf_vdpa.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/vdpa/ifc/ifcvf_vdpa.c b/drivers/vdpa/ifc/ifcvf_vdpa.c
index 9f05595b6b..6708849bd3 100644
--- a/drivers/vdpa/ifc/ifcvf_vdpa.c
+++ b/drivers/vdpa/ifc/ifcvf_vdpa.c
@@ -354,6 +354,8 @@ vdpa_enable_vfio_intr(struct ifcvf_internal *internal, bool
m_rx)
vring.callfd = -1;
nr_vring = rte_vhost_get_vring_num(internal->vid);
+ if (nr_vring > IFCVF_MAX_QUEUES * 2)
+ return -1;
irq_set = (struct vfio_irq_set *)irq_set_buf;
irq_set->argsz = sizeof(irq_set_buf);
--
2.36.1
