From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jan Kiszka Subject: [PATCH] KVM: Fix off-by-one in overflow check of KVM_ASSIGN_SET_MSIX_NR Date: Sat, 11 Jun 2011 12:23:55 +0200 Message-ID: <4DF3423B.1070600@web.de> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-15 Content-Transfer-Encoding: 7bit Cc: kvm To: Avi Kivity , Marcelo Tosatti Return-path: Received: from fmmailgate01.web.de ([217.72.192.221]:57660 "EHLO fmmailgate01.web.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753495Ab1FKKX5 (ORCPT ); Sat, 11 Jun 2011 06:23:57 -0400 Sender: kvm-owner@vger.kernel.org List-ID: From: Jan Kiszka KVM_MAX_MSIX_PER_DEV implies that up to that many MSI-X entries can be requested. But the kernel so far rejected already the upper limit. Signed-off-by: Jan Kiszka --- virt/kvm/assigned-dev.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/virt/kvm/assigned-dev.c b/virt/kvm/assigned-dev.c index 6cc4b97..4e9eaeb 100644 --- a/virt/kvm/assigned-dev.c +++ b/virt/kvm/assigned-dev.c @@ -617,7 +617,7 @@ static int kvm_vm_ioctl_set_msix_nr(struct kvm *kvm, if (adev->entries_nr == 0) { adev->entries_nr = entry_nr->entry_nr; if (adev->entries_nr == 0 || - adev->entries_nr >= KVM_MAX_MSIX_PER_DEV) { + adev->entries_nr > KVM_MAX_MSIX_PER_DEV) { r = -EINVAL; goto msix_nr_out; } -- 1.7.1