From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from [140.186.70.92] (port=51212 helo=eggs.gnu.org)
	by lists.gnu.org with esmtp (Exim 4.43) id 1Ot1wO-0002g0-UF
	for qemu-devel@nongnu.org; Tue, 07 Sep 2010 13:26:42 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.69)
	(envelope-from <mst@redhat.com>) id 1Ot1wN-00051q-8T
	for qemu-devel@nongnu.org; Tue, 07 Sep 2010 13:26:40 -0400
Received: from mx1.redhat.com ([209.132.183.28]:36329)
	by eggs.gnu.org with esmtp (Exim 4.69)
	(envelope-from <mst@redhat.com>) id 1Ot1wM-00051k-U6
	for qemu-devel@nongnu.org; Tue, 07 Sep 2010 13:26:39 -0400
Date: Tue, 7 Sep 2010 20:20:38 +0300
From: "Michael S. Tsirkin" <mst@redhat.com>
Message-ID: <20100907172038.GD18374@redhat.com>
References: <20100824132525.GA19469@kt>
 <20100824132741.GC19469@kt>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20100824132741.GC19469@kt>
Subject: [Qemu-devel] Re: [PATCH 3/4] Check pci slot number against
 PCIBUS_MAX_DEVICES in parse_pci_devfn
List-Id: qemu-devel.nongnu.org
List-Unsubscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Ken CC <ken.ccao@gmail.com>
Cc: yamahata@valinux.co.jp, avi@redhat.com, kvm@vger.kernel.org, qemu-devel@nongnu.org

On Tue, Aug 24, 2010 at 09:27:41PM +0800, Ken CC wrote:
> If pci addr provided from command line is bigger than 32,
> PCIBUS_MAX_DEVICES, return error -EINVAL.
> 
> 32 << 3 | 7 == 256 (PCIBUS_MAX_FUNCTIONS)
> PCIBUS_MAX_FUNCTIONS = PCIBUS_MAX_DEVICES * PCI_FUNCTIONS_PER_DEVICE

Not really sure what these equations mean, the patch makes sense though,
we should validate input.

> Signed-off-by: Ken CC <ken.ccao@gmail.com>
> ---
>  hw/qdev-properties.c |    4 +++-
>  1 files changed, 3 insertions(+), 1 deletions(-)
> 
> diff --git a/hw/qdev-properties.c b/hw/qdev-properties.c
> index 9219cd7..565fd08 100644
> --- a/hw/qdev-properties.c
> +++ b/hw/qdev-properties.c
> @@ -1,5 +1,5 @@
>  #include "net.h"
> -#include "qdev.h"
> +#include "pci.h"
>  #include "qerror.h"
>  
>  void *qdev_get_prop_ptr(DeviceState *dev, Property *prop)
> @@ -514,6 +514,8 @@ static int parse_pci_devfn(DeviceState *dev, Property *prop, const char *str)
>              return -EINVAL;
>          }
>      }
> +    if (slot >= PCIBUS_MAX_DEVICES)
> +        return -EINVAL;
>      if (str[n] != '\0')
>          return -EINVAL;
>      if (fn > 7)