From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:51113)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <alistair23@gmail.com>) id 1boZwa-0008Uj-8f
	for qemu-devel@nongnu.org; Mon, 26 Sep 2016 13:43:57 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <alistair23@gmail.com>) id 1boZwU-0000xz-HS
	for qemu-devel@nongnu.org; Mon, 26 Sep 2016 13:43:55 -0400
Received: from mail-oi0-x230.google.com ([2607:f8b0:4003:c06::230]:33454)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <alistair23@gmail.com>) id 1boZwU-0000xk-Bn
	for qemu-devel@nongnu.org; Mon, 26 Sep 2016 13:43:50 -0400
Received: by mail-oi0-x230.google.com with SMTP id r126so215665006oib.0
	for <qemu-devel@nongnu.org>; Mon, 26 Sep 2016 10:43:50 -0700 (PDT)
MIME-Version: 1.0
In-Reply-To: <466f3766-e422-e316-1607-2f86da4f954a@redhat.com>
References: <1474564935-23831-1-git-send-email-peter.maydell@linaro.org>
	<1474564935-23831-24-git-send-email-peter.maydell@linaro.org>
	<466f3766-e422-e316-1607-2f86da4f954a@redhat.com>
From: Alistair Francis <alistair23@gmail.com>
Date: Mon, 26 Sep 2016 10:43:19 -0700
Message-ID: <CAKmqyKN0q9XOdPrWb4TW8TqXq_ciamqCu+rtGPjexadgdFcfzw@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [Qemu-devel] [PULL 23/36] cadence_gem: Add queue support
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel/>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Paolo Bonzini <pbonzini@redhat.com>
Cc: Peter Maydell <peter.maydell@linaro.org>, "qemu-devel@nongnu.org Developers" <qemu-devel@nongnu.org>

On Mon, Sep 26, 2016 at 4:01 AM, Paolo Bonzini <pbonzini@redhat.com> wrote:
>
>
> On 22/09/2016 19:22, Peter Maydell wrote:
>> +    case GEM_RECEIVE_Q1_PTR ... GEM_RECEIVE_Q15_PTR:
>> +        s->rx_desc_addr[offset - GEM_RECEIVE_Q1_PTR + 1] = val;
>> +        break;
>
> MAX_PRIORITY_QUEUES is still 8, so this can cause an out-of-bounds write
> in s->rx_desc_addr (and likewise for s->tx_addr).

The MAX_PRIORITY_QUEUES is actually right, there are only 8 supported.

I guess when this was modeled it was just assumed there would be 16. I
checked the spec and confirmed there are only 8, so I have fixed up
the logic around that.

Thanks,

Alistair

>
> Paolo
>