Re: [PATCH 1/9] virtio-ccw: Limit ISC to MAX_ISC

[Christian Borntraeger <borntraeger@linux.ibm.com>]

Am 17.09.26 um 01:15 schrieb Matthew Rosato:
> On 9/16/26 4:32 PM, Eric Farman wrote:
>> The interrupt subclass is often defined as a uint8, though in practice
>> it will be within the range of just 0-7. Ensure that a guest-supplied
>> subclass does not extend beyond its expected range, especially when
>> used as an array index.
>>
>> Signed-off-by: Eric Farman <farman@linux.ibm.com>
>> ---
>>   hw/s390x/css.c        | 7 ++++++-
>>   hw/s390x/virtio-ccw.c | 6 ++++++
>>   2 files changed, 12 insertions(+), 1 deletion(-)
>>
>> diff --git a/hw/s390x/css.c b/hw/s390x/css.c
>> index 76dbca3bb9..9da9128d88 100644
>> --- a/hw/s390x/css.c
>> +++ b/hw/s390x/css.c
>> @@ -654,8 +654,13 @@ void css_adapter_interrupt(CssIoAdapterType type, uint8_t isc)
>>       S390FLICState *fs = s390_get_flic();
>>       S390FLICStateClass *fsc = s390_get_flic_class(fs);
>>       uint32_t io_int_word = (isc << 27) | IO_INT_WORD_AI;
>> -    IoAdapter *adapter = channel_subsys.io_adapters[type][isc];
> 
> I think this deserve a fixes/cc stable.  This would have been an
> out-of-range access before this patch.
> 
> The initial support didn't have the concept of MAX_ISC, it showed up in
> 
> dde522bbc5 ("s390x: register I/O adapters per ISC during init")

Yes.

Acked-by: Christian Borntraeger <borntraeger@linux.ibm.com>