Re: [PATCH] cryptodev: reject queue counts above the array limit
Philippe Mathieu-Daudé <[email protected]>
| Newsgroups | gmane.comp.emulators.qemu |
|---|---|
| Message-ID | <[email protected]> |
On 28/7/26 13:11, GuoHan Zhao wrote:
> The queues property accepts any non-zero uint32_t, but
> CryptoDevBackendPeers::ccs only has MAX_CRYPTO_QUEUE_NUM entries.
>
> This can make even an error path crash. For example, a builtin backend
> with queues=65 first reports that it only supports one queue. When the
> half-created object is finalized, cleanup walks all 65 entries and reads
> ccs[64].
>
> Reject queue counts that do not fit in ccs[].
>
> Fixes: 46fd17054548 ("cryptodev: introduce a new is_used property")
> Signed-off-by: GuoHan Zhao <[email protected]>
> ---
> backends/cryptodev.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>