The introduction of the capability chain rightly clamped the region indexes to the range of the capabilities itself, but neglected to do so for the existing read/write regions which should also be enforced. Fixes: db8e5d17ac03 ("vfio-ccw: add capabilities chain") Cc: stable@vger.kernel.org Cc: Cornelia Huck Signed-off-by: Eric Farman --- drivers/s390/cio/vfio_ccw_ops.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/s390/cio/vfio_ccw_ops.c b/drivers/s390/cio/vfio_ccw_ops.c index afe9448c165e..63cf5850bd50 100644 --- a/drivers/s390/cio/vfio_ccw_ops.c +++ b/drivers/s390/cio/vfio_ccw_ops.c @@ -245,6 +245,8 @@ static ssize_t vfio_ccw_mdev_read(struct vfio_device *vdev, if (index >= VFIO_CCW_NUM_REGIONS + private->num_regions) return -EINVAL; + index = array_index_nospec(index, VFIO_CCW_NUM_REGIONS + private->num_regions); + switch (index) { case VFIO_CCW_CONFIG_REGION_INDEX: return vfio_ccw_mdev_read_io_region(private, buf, count, ppos); @@ -297,6 +299,8 @@ static ssize_t vfio_ccw_mdev_write(struct vfio_device *vdev, if (index >= VFIO_CCW_NUM_REGIONS + private->num_regions) return -EINVAL; + index = array_index_nospec(index, VFIO_CCW_NUM_REGIONS + private->num_regions); + switch (index) { case VFIO_CCW_CONFIG_REGION_INDEX: return vfio_ccw_mdev_write_io_region(private, buf, count, ppos); -- 2.53.0