Patchwork lsi: Fix value overflow in request tag processing

login
register
mail settings
Submitter Jan Kiszka
Date May 21, 2010, 4:44 p.m.
Message ID <4BF6B88B.4060008@siemens.com>
Download mbox | patch
Permalink /patch/53193/
State New
Headers show

Comments

Jan Kiszka - May 21, 2010, 4:44 p.m.
This fixes a mismerge of 64d564094cac5f72eeaeb950c442b773a00d3586 (wrong
patch version): We need to mask the tag value properly to obtain its
device ID.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
---
 hw/lsi53c895a.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)
Aurelien Jarno - May 22, 2010, 2:05 p.m.
On Fri, May 21, 2010 at 06:44:59PM +0200, Jan Kiszka wrote:
> This fixes a mismerge of 64d564094cac5f72eeaeb950c442b773a00d3586 (wrong
> patch version): We need to mask the tag value properly to obtain its
> device ID.
> 
> Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>

Thanks for the quick patch, I have applied it.

> ---
>  hw/lsi53c895a.c |    4 ++--
>  1 files changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/hw/lsi53c895a.c b/hw/lsi53c895a.c
> index 9d3c44d..f5a91ba 100644
> --- a/hw/lsi53c895a.c
> +++ b/hw/lsi53c895a.c
> @@ -543,7 +543,7 @@ static void lsi_do_dma(LSIState *s, int out)
>          return;
>      }
>  
> -    id = s->current->tag >> 8;
> +    id = (s->current->tag >> 8) & 0xf;
>      dev = s->bus.devs[id];
>      if (!dev) {
>          lsi_bad_selection(s, id);
> @@ -745,7 +745,7 @@ static void lsi_do_command(LSIState *s)
>      s->sfbr = buf[0];
>      s->command_complete = 0;
>  
> -    id = s->select_tag >> 8;
> +    id = (s->select_tag >> 8) & 0xf;
>      dev = s->bus.devs[id];
>      if (!dev) {
>          lsi_bad_selection(s, id);
> -- 
> 1.6.0.2
> 
>

Patch

diff --git a/hw/lsi53c895a.c b/hw/lsi53c895a.c
index 9d3c44d..f5a91ba 100644
--- a/hw/lsi53c895a.c
+++ b/hw/lsi53c895a.c
@@ -543,7 +543,7 @@  static void lsi_do_dma(LSIState *s, int out)
         return;
     }
 
-    id = s->current->tag >> 8;
+    id = (s->current->tag >> 8) & 0xf;
     dev = s->bus.devs[id];
     if (!dev) {
         lsi_bad_selection(s, id);
@@ -745,7 +745,7 @@  static void lsi_do_command(LSIState *s)
     s->sfbr = buf[0];
     s->command_complete = 0;
 
-    id = s->select_tag >> 8;
+    id = (s->select_tag >> 8) & 0xf;
     dev = s->bus.devs[id];
     if (!dev) {
         lsi_bad_selection(s, id);