diff mbox

lsi: Fix value overflow in request tag processing

Message ID 4BF6B88B.4060008@siemens.com
State New
Headers show

Commit Message

Jan Kiszka May 21, 2010, 4:44 p.m. UTC
This fixes a mismerge of 64d564094cac5f72eeaeb950c442b773a00d3586 (wrong
patch version): We need to mask the tag value properly to obtain its
device ID.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
---
 hw/lsi53c895a.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

Comments

Aurelien Jarno May 22, 2010, 2:05 p.m. UTC | #1
On Fri, May 21, 2010 at 06:44:59PM +0200, Jan Kiszka wrote:
> This fixes a mismerge of 64d564094cac5f72eeaeb950c442b773a00d3586 (wrong
> patch version): We need to mask the tag value properly to obtain its
> device ID.
> 
> Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>

Thanks for the quick patch, I have applied it.

> ---
>  hw/lsi53c895a.c |    4 ++--
>  1 files changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/hw/lsi53c895a.c b/hw/lsi53c895a.c
> index 9d3c44d..f5a91ba 100644
> --- a/hw/lsi53c895a.c
> +++ b/hw/lsi53c895a.c
> @@ -543,7 +543,7 @@ static void lsi_do_dma(LSIState *s, int out)
>          return;
>      }
>  
> -    id = s->current->tag >> 8;
> +    id = (s->current->tag >> 8) & 0xf;
>      dev = s->bus.devs[id];
>      if (!dev) {
>          lsi_bad_selection(s, id);
> @@ -745,7 +745,7 @@ static void lsi_do_command(LSIState *s)
>      s->sfbr = buf[0];
>      s->command_complete = 0;
>  
> -    id = s->select_tag >> 8;
> +    id = (s->select_tag >> 8) & 0xf;
>      dev = s->bus.devs[id];
>      if (!dev) {
>          lsi_bad_selection(s, id);
> -- 
> 1.6.0.2
> 
>
diff mbox

Patch

diff --git a/hw/lsi53c895a.c b/hw/lsi53c895a.c
index 9d3c44d..f5a91ba 100644
--- a/hw/lsi53c895a.c
+++ b/hw/lsi53c895a.c
@@ -543,7 +543,7 @@  static void lsi_do_dma(LSIState *s, int out)
         return;
     }
 
-    id = s->current->tag >> 8;
+    id = (s->current->tag >> 8) & 0xf;
     dev = s->bus.devs[id];
     if (!dev) {
         lsi_bad_selection(s, id);
@@ -745,7 +745,7 @@  static void lsi_do_command(LSIState *s)
     s->sfbr = buf[0];
     s->command_complete = 0;
 
-    id = s->select_tag >> 8;
+    id = (s->select_tag >> 8) & 0xf;
     dev = s->bus.devs[id];
     if (!dev) {
         lsi_bad_selection(s, id);