From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:39509)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <paolo.bonzini@gmail.com>) id 1XkDn9-0007qL-TO
	for qemu-devel@nongnu.org; Fri, 31 Oct 2014 11:07:39 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <paolo.bonzini@gmail.com>) id 1Xk9Q7-0000bU-3r
	for qemu-devel@nongnu.org; Fri, 31 Oct 2014 06:27:12 -0400
Received: from mail-wg0-x22e.google.com ([2a00:1450:400c:c00::22e]:38131)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <paolo.bonzini@gmail.com>) id 1Xk9Q6-0000X8-TZ
	for qemu-devel@nongnu.org; Fri, 31 Oct 2014 06:27:03 -0400
Received: by mail-wg0-f46.google.com with SMTP id x13so6202020wgg.33
	for <qemu-devel@nongnu.org>; Fri, 31 Oct 2014 03:27:01 -0700 (PDT)
Sender: Paolo Bonzini <paolo.bonzini@gmail.com>
Message-ID: <545363F2.3050507@redhat.com>
Date: Fri, 31 Oct 2014 11:26:58 +0100
From: Paolo Bonzini <pbonzini@redhat.com>
MIME-Version: 1.0
References: <1414724671-31052-1-git-send-email-famz@redhat.com>
In-Reply-To: <1414724671-31052-1-git-send-email-famz@redhat.com>
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: 7bit
Subject: Re: [Qemu-devel] [PATCH v2] virtio-scsi: Fix num_queue input
	validation
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Fam Zheng <famz@redhat.com>, qemu-devel@nongnu.org
Cc: Max Reitz <mreitz@redhat.com>, stefanha@redhat.com, "Michael S. Tsirkin" <mst@redhat.com>

On 31/10/2014 04:04, Fam Zheng wrote:
> We need to count the ctrlq and eventq, and also cleanup before
> returning. Besides, the format string should be unsigned.
> 
> The number could never be less than zero.
> 
> Signed-off-by: Fam Zheng <famz@redhat.com>
> ---
>  hw/scsi/virtio-scsi.c | 8 +++++---
>  1 file changed, 5 insertions(+), 3 deletions(-)
> 
> diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
> index 7d40ecc..fdcacfd 100644
> --- a/hw/scsi/virtio-scsi.c
> +++ b/hw/scsi/virtio-scsi.c
> @@ -804,10 +804,12 @@ void virtio_scsi_common_realize(DeviceState *dev, Error **errp,
>      virtio_init(vdev, "virtio-scsi", VIRTIO_ID_SCSI,
>                  sizeof(VirtIOSCSIConfig));
>  
> -    if (s->conf.num_queues <= 0 || s->conf.num_queues > VIRTIO_PCI_QUEUE_MAX) {
> -        error_setg(errp, "Invalid number of queues (= %" PRId32 "), "
> +    if (s->conf.num_queues == 0 ||
> +            s->conf.num_queues > VIRTIO_PCI_QUEUE_MAX - 2) {
> +        error_setg(errp, "Invalid number of queues (= %" PRIu32 "), "
>                           "must be a positive integer less than %d.",
> -                   s->conf.num_queues, VIRTIO_PCI_QUEUE_MAX);
> +                   s->conf.num_queues, VIRTIO_PCI_QUEUE_MAX - 2);
> +        virtio_cleanup(vdev);
>          return;
>      }
>      s->cmd_vqs = g_malloc0(s->conf.num_queues * sizeof(VirtQueue *));
> 

Thanks, applied.

Paolo