From patchwork Tue Aug 24 13:27:41 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ken CC X-Patchwork-Id: 62573 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [199.232.76.165]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id E758AB70CC for ; Tue, 24 Aug 2010 23:30:40 +1000 (EST) Received: from localhost ([127.0.0.1]:56384 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1OntaI-0000g3-47 for incoming@patchwork.ozlabs.org; Tue, 24 Aug 2010 09:30:38 -0400 Received: from [140.186.70.92] (port=52596 helo=eggs.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1OntXa-0007Si-R6 for qemu-devel@nongnu.org; Tue, 24 Aug 2010 09:27:51 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.69) (envelope-from ) id 1OntXW-0000nV-Kq for qemu-devel@nongnu.org; Tue, 24 Aug 2010 09:27:50 -0400 Received: from mail-qy0-f173.google.com ([209.85.216.173]:55771) by eggs.gnu.org with esmtp (Exim 4.69) (envelope-from ) id 1OntXW-0000nN-Gp for qemu-devel@nongnu.org; Tue, 24 Aug 2010 09:27:46 -0400 Received: by qyk5 with SMTP id 5so3906448qyk.4 for ; Tue, 24 Aug 2010 06:27:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:date:from:to:cc:subject :message-id:mime-version:content-type:content-disposition :in-reply-to:user-agent; bh=vPfmcjzvpv0ZD7sFcbOookrNh7gGsdZOujFElR/HB6o=; b=Tpe6KU+tzLvWPCAlCjplloEnnUJ+tXWg076SaP17oC0Xy8YLm9AFQ/zgQAYBc4gXgY AdtPQArPy10u8MP1lRd4svbzcnKxVVCOh9EqznVUK5QwIuEAqril8U76Rzj880Es/mns aEnhCyE2NFi2hwuvoKIVbf7pDp8/t6YQ1qm2g= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=date:from:to:cc:subject:message-id:mime-version:content-type :content-disposition:in-reply-to:user-agent; b=qIkIJzgEf9HKAWkOE53G8g7tW37dfvs0ZrFp6Ar4W9WXA7CNVOqaM5eyvGZ0vXdnTF OvWcZ3DJUdUYgGG+RgBJQJAkXskDfIo+vRztuosSMy1nC/GGPKRkRzP6jVpCA/HQkFOq vOMUd00OuPbNl7CyJylQHSC9wpl+4tX424Z0U= Received: by 10.229.222.6 with SMTP id ie6mr4814966qcb.28.1282656465785; Tue, 24 Aug 2010 06:27:45 -0700 (PDT) Received: from localhost ([60.247.97.98]) by mx.google.com with ESMTPS id q8sm92742qcs.36.2010.08.24.06.27.43 (version=TLSv1/SSLv3 cipher=RC4-MD5); Tue, 24 Aug 2010 06:27:45 -0700 (PDT) Date: Tue, 24 Aug 2010 21:27:41 +0800 From: Ken CC To: yamahata@valinux.co.jp, avi@redhat.com, kvm@vger.kernel.org Message-ID: <20100824132741.GC19469@kt> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20100824132525.GA19469@kt> User-Agent: StGit/0.15-97-g9680 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6 (newer, 2) Cc: qemu-devel@nongnu.org, mst@redhat.com Subject: [Qemu-devel] [PATCH 3/4] Check pci slot number against PCIBUS_MAX_DEVICES in parse_pci_devfn X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org If pci addr provided from command line is bigger than 32, PCIBUS_MAX_DEVICES, return error -EINVAL. 32 << 3 | 7 == 256 (PCIBUS_MAX_FUNCTIONS) PCIBUS_MAX_FUNCTIONS = PCIBUS_MAX_DEVICES * PCI_FUNCTIONS_PER_DEVICE Signed-off-by: Ken CC --- hw/qdev-properties.c | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) diff --git a/hw/qdev-properties.c b/hw/qdev-properties.c index 9219cd7..565fd08 100644 --- a/hw/qdev-properties.c +++ b/hw/qdev-properties.c @@ -1,5 +1,5 @@ #include "net.h" -#include "qdev.h" +#include "pci.h" #include "qerror.h" void *qdev_get_prop_ptr(DeviceState *dev, Property *prop) @@ -514,6 +514,8 @@ static int parse_pci_devfn(DeviceState *dev, Property *prop, const char *str) return -EINVAL; } } + if (slot >= PCIBUS_MAX_DEVICES) + return -EINVAL; if (str[n] != '\0') return -EINVAL; if (fn > 7)