From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Michael S. Tsirkin" Subject: Re: [PATCH 3/4] Check pci slot number against PCIBUS_MAX_DEVICES in parse_pci_devfn Date: Tue, 7 Sep 2010 20:20:38 +0300 Message-ID: <20100907172038.GD18374@redhat.com> References: <20100824132525.GA19469@kt> <20100824132741.GC19469@kt> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: yamahata@valinux.co.jp, avi@redhat.com, kvm@vger.kernel.org, qemu-devel@nongnu.org To: Ken CC Return-path: Received: from mx1.redhat.com ([209.132.183.28]:11944 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756678Ab0IGR0k (ORCPT ); Tue, 7 Sep 2010 13:26:40 -0400 Content-Disposition: inline In-Reply-To: <20100824132741.GC19469@kt> Sender: kvm-owner@vger.kernel.org List-ID: On Tue, Aug 24, 2010 at 09:27:41PM +0800, Ken CC wrote: > If pci addr provided from command line is bigger than 32, > PCIBUS_MAX_DEVICES, return error -EINVAL. > > 32 << 3 | 7 == 256 (PCIBUS_MAX_FUNCTIONS) > PCIBUS_MAX_FUNCTIONS = PCIBUS_MAX_DEVICES * PCI_FUNCTIONS_PER_DEVICE Not really sure what these equations mean, the patch makes sense though, we should validate input. > Signed-off-by: Ken CC > --- > hw/qdev-properties.c | 4 +++- > 1 files changed, 3 insertions(+), 1 deletions(-) > > diff --git a/hw/qdev-properties.c b/hw/qdev-properties.c > index 9219cd7..565fd08 100644 > --- a/hw/qdev-properties.c > +++ b/hw/qdev-properties.c > @@ -1,5 +1,5 @@ > #include "net.h" > -#include "qdev.h" > +#include "pci.h" > #include "qerror.h" > > void *qdev_get_prop_ptr(DeviceState *dev, Property *prop) > @@ -514,6 +514,8 @@ static int parse_pci_devfn(DeviceState *dev, Property *prop, const char *str) > return -EINVAL; > } > } > + if (slot >= PCIBUS_MAX_DEVICES) > + return -EINVAL; > if (str[n] != '\0') > return -EINVAL; > if (fn > 7)