Re: [XEN PATCH] xen/vpci: Fix UB in mask_write

[Roger Pau Monné <roger.pau@xxxxxxxxxx>]

On Wed, Nov 06, 2024 at 12:26:55PM +0000, Mykyta Poturai wrote:
> On 06.11.2024 10:07, Roger Pau Monné wrote:>
> > Wait - how can msi->vectors ever be 0?  AFAICT there's no way in the
> > MSI logic to configure 0 vectors, there will always be at least 1 vector
> > enabled.
> >
> > Maybe what you want, if this fix is for compliance reasons, is an
> > assert unreachable that msi->vectors > 0?
> 
> I did some investigation and figured out that the value of 0 is being
> set by guest writing to msi_control_reg. As far as I understand, the
> control_write() function only checks that vectors are not greater than
> the maximum allowed value, but does not check for 0.

control_write() will set vectors to (1UL << val), so even if user
provides val == 0, vectors will be 1.

Can you provide an example input value of control_write() that will
lead to msi->vectors == 0?

Is maybe msi_maxvec not set correctly in your use case if you indeed
see vectors == 0?

Thanks, Roger.