From patchwork Thu Jan 12 17:35:26 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alexander Graf X-Patchwork-Id: 135668 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [140.186.70.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id 971ABB6EFF for ; Fri, 13 Jan 2012 05:13:05 +1100 (EST) Received: from localhost ([::1]:46604 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RlOZd-00059C-1E for incoming@patchwork.ozlabs.org; Thu, 12 Jan 2012 12:36:25 -0500 Received: from eggs.gnu.org ([140.186.70.92]:54036) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RlOZ1-0003Vp-Tu for qemu-devel@nongnu.org; Thu, 12 Jan 2012 12:35:53 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1RlOYt-0003hW-AC for qemu-devel@nongnu.org; Thu, 12 Jan 2012 12:35:47 -0500 Received: from cantor2.suse.de ([195.135.220.15]:43293 helo=mx2.suse.de) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RlOYt-0003fh-3D; Thu, 12 Jan 2012 12:35:39 -0500 Received: from relay2.suse.de (unknown [195.135.220.254]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mx2.suse.de (Postfix) with ESMTP id 72DAA8C061; Thu, 12 Jan 2012 18:35:33 +0100 (CET) From: Alexander Graf To: qemu-devel Developers Date: Thu, 12 Jan 2012 18:35:26 +0100 Message-Id: <1326389731-1694-3-git-send-email-agraf@suse.de> X-Mailer: git-send-email 1.7.3.4 In-Reply-To: <1326389731-1694-1-git-send-email-agraf@suse.de> References: <1326389731-1694-1-git-send-email-agraf@suse.de> X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.4-2.6 X-Received-From: 195.135.220.15 Cc: jmforbes@linuxtx.org, qemu-stable@nongnu.org, David Gibson Subject: [Qemu-devel] [PATCH 2/7] pseries: Fix array overrun bug in PCI code X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org From: David Gibson spapr_populate_pci_devices() containd a loop with PCI_NUM_REGIONS (7) iterations. However this overruns the 'bars' global array, which only has 6 elements. In fact we only want to run this loop for things listed in the bars array, so this patch corrects the loop bounds to reflect that. Signed-off-by: David Gibson Signed-off-by: Alexander Graf (cherry picked from commit 135712de61dfa22368e98914d65b8b0860ec8505) --- hw/spapr_pci.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/hw/spapr_pci.c b/hw/spapr_pci.c index 7162588..9b6a032 100644 --- a/hw/spapr_pci.c +++ b/hw/spapr_pci.c @@ -454,7 +454,7 @@ int spapr_populate_pci_devices(sPAPRPHBState *phb, reg[0].size = 0; n = 0; - for (i = 0; i < PCI_NUM_REGIONS; ++i) { + for (i = 0; i < ARRAY_SIZE(bars); ++i) { if (0 == dev->io_regions[i].size) { continue; }