From: Jan Kiszka <jan.kis...@siemens.com>
vtd_irte_get failed to check the index against the configured table
size, causing an out-of-bounds access on guest memory and potentially
misinterpreting the result.
Signed-off-by: Jan Kiszka <jan.kis...@siemens.com>
Message-Id: <4b15b728-bdfe-3bbe-3a5c-ca3baeef3...@siemens.com>
Signed-off-by: Paolo Bonzini <pbonz...@redhat.com>
---
hw/i386/intel_iommu.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
index 204b684..df7ad25 100644
--- a/hw/i386/intel_iommu.c
+++ b/hw/i386/intel_iommu.c
@@ -3094,6 +3094,12 @@ static int vtd_irte_get(IntelIOMMUState *iommu, uint16_t
index,
uint16_t mask, source_id;
uint8_t bus, bus_max, bus_min;
+ if (index >= iommu->intr_size) {
+ error_report_once("%s: index too large: ind=0x%x",
+ __func__, index);
+ return -VTD_FR_IR_INDEX_OVER;
+ }
+
addr = iommu->intr_root + index * sizeof(*entry);
if (dma_memory_read(&address_space_memory, addr, entry,
sizeof(*entry))) {
--
1.8.3.1
