From patchwork Wed Jan 28 14:31:32 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Cornelia Huck X-Patchwork-Id: 433878 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [IPv6:2001:4830:134:3::11]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 8E5591401F6 for ; Thu, 29 Jan 2015 01:39:01 +1100 (AEDT) Received: from localhost ([::1]:53857 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YGTlj-0006QR-HB for incoming@patchwork.ozlabs.org; Wed, 28 Jan 2015 09:38:59 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:50512) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YGTew-0002v1-6a for qemu-devel@nongnu.org; Wed, 28 Jan 2015 09:32:05 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1YGTen-0005Yg-No for qemu-devel@nongnu.org; Wed, 28 Jan 2015 09:31:58 -0500 Received: from e06smtp15.uk.ibm.com ([195.75.94.111]:42604) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YGTen-0005YG-EM for qemu-devel@nongnu.org; Wed, 28 Jan 2015 09:31:49 -0500 Received: from /spool/local by e06smtp15.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Wed, 28 Jan 2015 14:31:47 -0000 Received: from d06dlp01.portsmouth.uk.ibm.com (9.149.20.13) by e06smtp15.uk.ibm.com (192.168.101.145) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; Wed, 28 Jan 2015 14:31:46 -0000 Received: from b06cxnps4074.portsmouth.uk.ibm.com (d06relay11.portsmouth.uk.ibm.com [9.149.109.196]) by d06dlp01.portsmouth.uk.ibm.com (Postfix) with ESMTP id DFC3917D805D for ; Wed, 28 Jan 2015 14:31:50 +0000 (GMT) Received: from d06av06.portsmouth.uk.ibm.com (d06av06.portsmouth.uk.ibm.com [9.149.37.217]) by b06cxnps4074.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id t0SEVjuo4849920 for ; Wed, 28 Jan 2015 14:31:45 GMT Received: from d06av06.portsmouth.uk.ibm.com (localhost [127.0.0.1]) by d06av06.portsmouth.uk.ibm.com (8.14.4/8.14.4/NCO v10.0 AVout) with ESMTP id t0S9Rbo1029117 for ; Wed, 28 Jan 2015 04:27:38 -0500 Received: from gondolin.boeblingen.de.ibm.com (dyn-9-152-224-150.boeblingen.de.ibm.com [9.152.224.150]) by d06av06.portsmouth.uk.ibm.com (8.14.4/8.14.4/NCO v10.0 AVin) with ESMTP id t0S9RZ5k028952; Wed, 28 Jan 2015 04:27:37 -0500 From: Cornelia Huck To: qemu-devel@nongnu.org Date: Wed, 28 Jan 2015 15:31:32 +0100 Message-Id: <1422455498-889-4-git-send-email-cornelia.huck@de.ibm.com> X-Mailer: git-send-email 1.7.9.5 In-Reply-To: <1422455498-889-1-git-send-email-cornelia.huck@de.ibm.com> References: <1422455498-889-1-git-send-email-cornelia.huck@de.ibm.com> X-TM-AS-MML: disable X-Content-Scanned: Fidelis XPS MAILER x-cbid: 15012814-0021-0000-0000-000002B61B2A X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x X-Received-From: 195.75.94.111 Cc: Cornelia Huck , borntraeger@de.ibm.com, jfrei@linux.vnet.ibm.com, Frank Blaschka , agraf@suse.de Subject: [Qemu-devel] [PATCH 3/9] s390x/pci: check for invalid function handle X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org From: Frank Blaschka broken guest may provide 0 (invalid) function handle to zpci instructions. Since we use function handle 0 to indicate an empty slot in the PHB we have to add an additional check to spot this kind of error. Signed-off-by: Frank Blaschka Signed-off-by: Cornelia Huck --- hw/s390x/s390-pci-bus.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/s390x/s390-pci-bus.c b/hw/s390x/s390-pci-bus.c index d25ac74..dc455a2 100644 --- a/hw/s390x/s390-pci-bus.c +++ b/hw/s390x/s390-pci-bus.c @@ -170,7 +170,7 @@ S390PCIBusDevice *s390_pci_find_dev_by_fh(uint32_t fh) S390pciState *s = S390_PCI_HOST_BRIDGE( object_resolve_path(TYPE_S390_PCI_HOST_BRIDGE, NULL)); - if (!s) { + if (!s || !fh) { return NULL; }