From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:50636) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XkDxt-0005Z3-6w for qemu-devel@nongnu.org; Fri, 31 Oct 2014 11:19:03 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Xk2Vi-0007cr-2C for qemu-devel@nongnu.org; Thu, 30 Oct 2014 23:04:28 -0400 Received: from mx1.redhat.com ([209.132.183.28]:36046) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Xk2Vh-0007bG-Qy for qemu-devel@nongnu.org; Thu, 30 Oct 2014 23:04:21 -0400 Received: from int-mx13.intmail.prod.int.phx2.redhat.com (int-mx13.intmail.prod.int.phx2.redhat.com [10.5.11.26]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id s9V34K68027296 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=FAIL) for ; Thu, 30 Oct 2014 23:04:20 -0400 From: Fam Zheng Date: Fri, 31 Oct 2014 11:04:31 +0800 Message-Id: <1414724671-31052-1-git-send-email-famz@redhat.com> Subject: [Qemu-devel] [PATCH v2] virtio-scsi: Fix num_queue input validation List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Paolo Bonzini , Max Reitz , stefanha@redhat.com, "Michael S. Tsirkin" We need to count the ctrlq and eventq, and also cleanup before returning. Besides, the format string should be unsigned. The number could never be less than zero. Signed-off-by: Fam Zheng --- hw/scsi/virtio-scsi.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c index 7d40ecc..fdcacfd 100644 --- a/hw/scsi/virtio-scsi.c +++ b/hw/scsi/virtio-scsi.c @@ -804,10 +804,12 @@ void virtio_scsi_common_realize(DeviceState *dev, Error **errp, virtio_init(vdev, "virtio-scsi", VIRTIO_ID_SCSI, sizeof(VirtIOSCSIConfig)); - if (s->conf.num_queues <= 0 || s->conf.num_queues > VIRTIO_PCI_QUEUE_MAX) { - error_setg(errp, "Invalid number of queues (= %" PRId32 "), " + if (s->conf.num_queues == 0 || + s->conf.num_queues > VIRTIO_PCI_QUEUE_MAX - 2) { + error_setg(errp, "Invalid number of queues (= %" PRIu32 "), " "must be a positive integer less than %d.", - s->conf.num_queues, VIRTIO_PCI_QUEUE_MAX); + s->conf.num_queues, VIRTIO_PCI_QUEUE_MAX - 2); + virtio_cleanup(vdev); return; } s->cmd_vqs = g_malloc0(s->conf.num_queues * sizeof(VirtQueue *)); -- 1.9.3