From: Alistair Francis <alistair23@gmail.com>
To: Paolo Bonzini <pbonzini@redhat.com>
Cc: Peter Maydell <peter.maydell@linaro.org>,
"qemu-devel@nongnu.org Developers" <qemu-devel@nongnu.org>
Subject: Re: [Qemu-devel] [PULL 23/36] cadence_gem: Add queue support
Date: Mon, 26 Sep 2016 10:43:19 -0700 [thread overview]
Message-ID: <CAKmqyKN0q9XOdPrWb4TW8TqXq_ciamqCu+rtGPjexadgdFcfzw@mail.gmail.com> (raw)
In-Reply-To: <466f3766-e422-e316-1607-2f86da4f954a@redhat.com>
On Mon, Sep 26, 2016 at 4:01 AM, Paolo Bonzini <pbonzini@redhat.com> wrote:
>
>
> On 22/09/2016 19:22, Peter Maydell wrote:
>> + case GEM_RECEIVE_Q1_PTR ... GEM_RECEIVE_Q15_PTR:
>> + s->rx_desc_addr[offset - GEM_RECEIVE_Q1_PTR + 1] = val;
>> + break;
>
> MAX_PRIORITY_QUEUES is still 8, so this can cause an out-of-bounds write
> in s->rx_desc_addr (and likewise for s->tx_addr).
The MAX_PRIORITY_QUEUES is actually right, there are only 8 supported.
I guess when this was modeled it was just assumed there would be 16. I
checked the spec and confirmed there are only 8, so I have fixed up
the logic around that.
Thanks,
Alistair
>
> Paolo
>
next prev parent reply other threads:[~2016-09-26 17:43 UTC|newest]
Thread overview: 41+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-09-22 17:21 [Qemu-devel] [PULL 00/36] target-arm queue Peter Maydell
2016-09-22 17:21 ` [Qemu-devel] [PULL 01/36] arm: add Cortex A7 CPU parameters Peter Maydell
2016-09-22 17:21 ` [Qemu-devel] [PULL 02/36] ast2400: rename the Aspeed SoC files to aspeed_soc Peter Maydell
2016-09-22 17:21 ` [Qemu-devel] [PULL 03/36] ast2400: replace ast2400 with aspeed_soc Peter Maydell
2016-09-22 17:21 ` [Qemu-devel] [PULL 04/36] aspeed-soc: provide a framework to add new SoCs Peter Maydell
2016-09-22 17:21 ` [Qemu-devel] [PULL 05/36] palmetto-bmc: rename the Aspeed board file to aspeed.c Peter Maydell
2016-09-22 17:21 ` [Qemu-devel] [PULL 06/36] palmetto-bmc: replace palmetto_bmc with aspeed Peter Maydell
2016-09-22 17:21 ` [Qemu-devel] [PULL 07/36] palmetto-bmc: add board specific configuration Peter Maydell
2016-09-22 17:21 ` [Qemu-devel] [PULL 08/36] hw/misc: use macros to define hw-strap1 register on the AST2400 Aspeed SoC Peter Maydell
2016-09-22 17:21 ` [Qemu-devel] [PULL 09/36] aspeed: add a ast2500 SoC and support to the SCU and SDMC controllers Peter Maydell
2016-09-22 17:21 ` [Qemu-devel] [PULL 10/36] arm: add support for an ast2500 evaluation board Peter Maydell
2016-09-22 17:21 ` [Qemu-devel] [PULL 11/36] palmetto-bmc: remove extra no_sdcard assignement Peter Maydell
2016-09-22 17:21 ` [Qemu-devel] [PULL 12/36] aspeed: calculate the RAM size bits at realize time Peter Maydell
2016-09-22 17:21 ` [Qemu-devel] [PULL 13/36] aspeed: use error_report instead of LOG_GUEST_ERROR Peter Maydell
2016-09-22 17:21 ` [Qemu-devel] [PULL 14/36] aspeed: add a ram_size property to the memory controller Peter Maydell
2016-09-22 17:21 ` [Qemu-devel] [PULL 15/36] aspeed: allocate RAM after the memory controller has checked the size Peter Maydell
2016-09-22 17:21 ` [Qemu-devel] [PULL 16/36] hw/ptimer: Actually stop the timer in case of error Peter Maydell
2016-09-22 17:21 ` [Qemu-devel] [PULL 17/36] hw/ptimer: Introduce timer policy feature Peter Maydell
2016-09-22 17:21 ` [Qemu-devel] [PULL 18/36] hw/ptimer: Suppress error messages under qtest Peter Maydell
2016-09-22 17:21 ` [Qemu-devel] [PULL 19/36] tests: Add ptimer tests Peter Maydell
2016-09-22 17:21 ` [Qemu-devel] [PULL 20/36] cadence_gem: QOMify Cadence GEM Peter Maydell
2016-09-22 17:22 ` [Qemu-devel] [PULL 21/36] cadence_gem: Add the num-priority-queues property Peter Maydell
2016-09-22 17:22 ` [Qemu-devel] [PULL 22/36] cadence_gem: Add support for screening Peter Maydell
2016-09-22 17:22 ` [Qemu-devel] [PULL 23/36] cadence_gem: Add queue support Peter Maydell
2016-09-26 11:01 ` Paolo Bonzini
2016-09-26 17:43 ` Alistair Francis [this message]
2016-09-22 17:22 ` [Qemu-devel] [PULL 24/36] cadence_gem: Correct indentation Peter Maydell
2016-09-22 17:22 ` [Qemu-devel] [PULL 25/36] xlnx-zynqmp: Set the number of priority queues Peter Maydell
2016-09-22 17:22 ` [Qemu-devel] [PULL 26/36] loader: Allow ELF loader to auto-detect the ELF arch Peter Maydell
2016-09-22 17:22 ` [Qemu-devel] [PULL 27/36] loader: Use the specified MemoryRegion Peter Maydell
2016-09-22 17:22 ` [Qemu-devel] [PULL 28/36] loader: Allow a custom AddressSpace when loading ROMs Peter Maydell
2016-09-22 17:22 ` [Qemu-devel] [PULL 29/36] loader: Add AddressSpace loading support to ELFs Peter Maydell
2016-09-22 17:22 ` [Qemu-devel] [PULL 30/36] loader: Add AddressSpace loading support to uImages Peter Maydell
2016-09-22 17:22 ` [Qemu-devel] [PULL 31/36] loader: Add AddressSpace loading support to targphys Peter Maydell
2016-09-22 17:22 ` [Qemu-devel] [PULL 32/36] dma: xlnx-zynq-devcfg: Fix up XLNX_ZYNQ_DEVCFG_R_MAX Peter Maydell
2016-09-22 17:22 ` [Qemu-devel] [PULL 33/36] vmstateify ssd0323 display Peter Maydell
2016-09-22 17:22 ` [Qemu-devel] [PULL 34/36] vmstateify ssi-sd Peter Maydell
2016-09-22 17:22 ` [Qemu-devel] [PULL 35/36] disas/arm.c: Remove unused macro definitions Peter Maydell
2016-09-22 17:22 ` [Qemu-devel] [PULL 36/36] imx: Use 'const char', not 'char const' Peter Maydell
2016-09-22 19:58 ` [Qemu-devel] [PULL 00/36] target-arm queue no-reply
2016-09-23 9:57 ` Peter Maydell
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAKmqyKN0q9XOdPrWb4TW8TqXq_ciamqCu+rtGPjexadgdFcfzw@mail.gmail.com \
--to=alistair23@gmail.com \
--cc=pbonzini@redhat.com \
--cc=peter.maydell@linaro.org \
--cc=qemu-devel@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).