From ba31a6fca7b03fce47228423b4dc951e04efd96c Mon Sep 17 00:00:00 2001 From: Jonathan Cameron Date: Fri, 2 Jan 2026 15:47:31 +0000 Subject: [PATCH] hw/cxl: Take into account how many media operations are requested for param check Whilst the spec doesn't speak to it directly my assumption is that a request for more operations than exist should result in an invalid input error return. Fixes: 77a8e9fe0ecb ("hw/cxl/cxl-mailbox-utils: Add support for Media operations discovery commands cxl r3.2 (8.2.10.9.5.3)") Closes: https://lore.kernel.org/qemu-devel/CAFEAcA-p5wZkNxK7wNVq_3PAzEE-muOd1Def-0O-FSpck4DrBQ@mail.gmail.com/ Reported-by: Peter Maydell Signed-off-by: Jonathan Cameron Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin Message-Id: <20260102154731.474859-3-Jonathan.Cameron@huawei.com> (cherry picked from commit 25465c0e1fd74d2118dfec03912f2595eeb497d7) Signed-off-by: Michael Tokarev --- hw/cxl/cxl-mailbox-utils.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c index cf1d048d99..9b99d44a80 100644 --- a/hw/cxl/cxl-mailbox-utils.c +++ b/hw/cxl/cxl-mailbox-utils.c @@ -2011,7 +2011,7 @@ static CXLRetCode media_operations_discovery(uint8_t *payload_in, * sub class command. */ if (media_op_in_disc_pl->dpa_range_count || - start_index > ARRAY_SIZE(media_op_matrix)) { + start_index + num_ops > ARRAY_SIZE(media_op_matrix)) { return CXL_MBOX_INVALID_INPUT; }