From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([140.186.70.92]:59061) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1R6SPz-0003IW-Qf for qemu-devel@nongnu.org; Wed, 21 Sep 2011 15:25:16 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1R6SPy-0004z5-LQ for qemu-devel@nongnu.org; Wed, 21 Sep 2011 15:25:15 -0400 Received: from mx1.redhat.com ([209.132.183.28]:62416) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1R6SPy-0004yt-B5 for qemu-devel@nongnu.org; Wed, 21 Sep 2011 15:25:14 -0400 Received: from int-mx12.intmail.prod.int.phx2.redhat.com (int-mx12.intmail.prod.int.phx2.redhat.com [10.5.11.25]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id p8LJPC4P005991 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Wed, 21 Sep 2011 15:25:12 -0400 Received: from dddsys0.bos.redhat.com (dddsys0.bos.redhat.com [10.16.16.40]) by int-mx12.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id p8LJPBsw017894 for ; Wed, 21 Sep 2011 15:25:12 -0400 From: Donald Dutile Date: Wed, 21 Sep 2011 15:25:11 -0400 Message-Id: <1316633111-32404-1-git-send-email-ddutile@redhat.com> Subject: [Qemu-devel] [PATCH] pci-devfn: check that device/slot number is within range List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Need to check that guest slot/device number is not > 31 or walk off the devfn table when checking if a devfn is available or not in a guest. before this fix, passing in an addr=abc or addr=34, can crash qemu, sometimes fail gracefully if data past end of devfn table fails the availability test. with this fix, get clean error: Property 'pci-assign.addr' doesn't take value '34' also tested when no addr= param passed for guest (pcicfg) address, and that worked as well. Signed-off-by: Don Dutile --- hw/qdev-properties.c | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) diff --git a/hw/qdev-properties.c b/hw/qdev-properties.c index 7ce95b6..e0e54aa 100644 --- a/hw/qdev-properties.c +++ b/hw/qdev-properties.c @@ -524,6 +524,8 @@ static int parse_pci_devfn(DeviceState *dev, Property *prop, const char *str) return -EINVAL; if (fn > 7) return -EINVAL; + if (slot > 31) + return -EINVAL; *ptr = slot << 3 | fn; return 0; } -- 1.7.1