Re: [Qemu-devel] pci_change_irq_level is broken...

[Richard Henderson <rth@twiddle.net>]

On 09/20/2011 10:24 AM, Alan Amaral wrote:
> I'm not on this mailing list, so please CC me on any replies.  Thanks.
>  
> I ran qemu with valgrind last night and found an error in the pci emulation code, which may,
> or may not, be biting us.  So far the effects seem benign, although there exists the possibility
> of trashing random memory.
>  
> In the function pci_change_irq_level() the argument irq_num is passed in as 0-3, and used
> as an index to change bus->irq_count[4].

I don't know what version of qemu you're using, but this is

      int *irq_count;

in current sources.  There's certainly no hard-coded "4".

>     assert(irq_num >= 0);
>     assert(irq_num < bus->nirq);
>     bus->irq_count[irq_num] += change;
>     bus->set_irq(bus->irq_opaque, bus_irq_num, bus->irq_count[irq_num] != 0);

This version with the asserts, though, could be done.  The site
that created the bus ought to match up nirq with the map function.


r~