Commit 405d566f authored by Farhan Ali's avatar Farhan Ali Committed by Cornelia Huck

vfio-ccw: Don't assume there are more ccws after a TIC

When trying to calculate the length of a ccw chain, we assume
there are ccws after a TIC. This can lead to overcounting and
copying garbage data from guest memory.
Signed-off-by: default avatarFarhan Ali <alifm@linux.ibm.com>
Message-Id: <d63748c1f1b03147bcbf401596638627a5e35ef7.1548082107.git.alifm@linux.ibm.com>
Reviewed-by: default avatarHalil Pasic <pasic@linux.ibm.com>
Signed-off-by: default avatarCornelia Huck <cohuck@redhat.com>
parent 7dd541a3
......@@ -392,7 +392,7 @@ static int ccwchain_calc_length(u64 iova, struct channel_program *cp)
return -EOPNOTSUPP;
}
if ((!ccw_is_chain(ccw)) && (!ccw_is_tic(ccw)))
if (!ccw_is_chain(ccw))
break;
ccw++;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment