From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:43396) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bmOUr-0007Q2-Ch for qemu-devel@nongnu.org; Tue, 20 Sep 2016 13:06:22 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bmOUn-0007Sk-CD for qemu-devel@nongnu.org; Tue, 20 Sep 2016 13:06:16 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:49979) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bmOUn-0007Rz-1z for qemu-devel@nongnu.org; Tue, 20 Sep 2016 13:06:13 -0400 Received: from pps.filterd (m0098404.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.17/8.16.0.17) with SMTP id u8KH3LoC050217 for ; Tue, 20 Sep 2016 13:06:12 -0400 Received: from e37.co.us.ibm.com (e37.co.us.ibm.com [32.97.110.158]) by mx0a-001b2d01.pphosted.com with ESMTP id 25k6cjgwnt-1 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=NOT) for ; Tue, 20 Sep 2016 13:06:12 -0400 Received: from localhost by e37.co.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Tue, 20 Sep 2016 11:06:11 -0600 From: Michael Roth Date: Tue, 20 Sep 2016 12:05:36 -0500 In-Reply-To: <1474391141-16623-1-git-send-email-mdroth@linux.vnet.ibm.com> References: <1474391141-16623-1-git-send-email-mdroth@linux.vnet.ibm.com> Message-Id: <1474391141-16623-21-git-send-email-mdroth@linux.vnet.ibm.com> Subject: [Qemu-devel] [PATCH 20/25] scsi: mptconfig: fix an assert expression List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Prasad J Pandit , Paolo Bonzini From: Prasad J Pandit When LSI SAS1068 Host Bus emulator builds configuration page headers, mptsas_config_pack() should assert that the size fits in a byte. However, the size is expressed in 32-bit units, so up to 1020 bytes fit. The assertion was only allowing replies up to 252 bytes, so fix it. Suggested-by: Paolo Bonzini Signed-off-by: Prasad J Pandit Message-Id: <1472645167-30765-2-git-send-email-ppandit@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini (cherry picked from commit cf2bce203a45d7437029d108357fb23fea0967b6) Signed-off-by: Michael Roth --- hw/scsi/mptconfig.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/scsi/mptconfig.c b/hw/scsi/mptconfig.c index 7071854..3e4f400 100644 --- a/hw/scsi/mptconfig.c +++ b/hw/scsi/mptconfig.c @@ -158,7 +158,7 @@ static size_t mptsas_config_pack(uint8_t **data, const char *fmt, ...) va_end(ap); if (data) { - assert(ret < 256 && (ret % 4) == 0); + assert(ret / 4 < 256 && (ret % 4) == 0); stb_p(*data + 1, ret / 4); } return ret; -- 1.9.1