From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ken CC Subject: [PATCH 3/4] Check pci slot number against PCIBUS_MAX_DEVICES in parse_pci_devfn Date: Tue, 24 Aug 2010 21:27:41 +0800 Message-ID: <20100824132741.GC19469@kt> References: <20100824132525.GA19469@kt> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: qemu-devel@nongnu.org, mst@redhat.com To: yamahata@valinux.co.jp, avi@redhat.com, kvm@vger.kernel.org Return-path: Received: from mail-qw0-f46.google.com ([209.85.216.46]:52763 "EHLO mail-qw0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755053Ab0HXN1q (ORCPT ); Tue, 24 Aug 2010 09:27:46 -0400 Received: by qwh6 with SMTP id 6so6077659qwh.19 for ; Tue, 24 Aug 2010 06:27:46 -0700 (PDT) Content-Disposition: inline In-Reply-To: <20100824132525.GA19469@kt> Sender: kvm-owner@vger.kernel.org List-ID: If pci addr provided from command line is bigger than 32, PCIBUS_MAX_DEVICES, return error -EINVAL. 32 << 3 | 7 == 256 (PCIBUS_MAX_FUNCTIONS) PCIBUS_MAX_FUNCTIONS = PCIBUS_MAX_DEVICES * PCI_FUNCTIONS_PER_DEVICE Signed-off-by: Ken CC --- hw/qdev-properties.c | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) diff --git a/hw/qdev-properties.c b/hw/qdev-properties.c index 9219cd7..565fd08 100644 --- a/hw/qdev-properties.c +++ b/hw/qdev-properties.c @@ -1,5 +1,5 @@ #include "net.h" -#include "qdev.h" +#include "pci.h" #include "qerror.h" void *qdev_get_prop_ptr(DeviceState *dev, Property *prop) @@ -514,6 +514,8 @@ static int parse_pci_devfn(DeviceState *dev, Property *prop, const char *str) return -EINVAL; } } + if (slot >= PCIBUS_MAX_DEVICES) + return -EINVAL; if (str[n] != '\0') return -EINVAL; if (fn > 7)