* [Qemu-devel] [PATCH] pseries: Fix array overrun bug in PCI code
@ 2011-11-29 6:21 David Gibson
2011-11-29 7:41 ` [Qemu-devel] [Qemu-ppc] " David Gibson
2011-12-19 13:59 ` [Qemu-devel] " Alexander Graf
0 siblings, 2 replies; 6+ messages in thread
From: David Gibson @ 2011-11-29 6:21 UTC (permalink / raw)
To: agraf; +Cc: aik, sw, qemu-ppc, qemu-devel
spapr_populate_pci_devices() containd a loop with PCI_NUM_REGIONS (7)
iterations. However this overruns the 'bars' global array, which only has
6 elements. In fact we only want to run this loop for things listed in the
bars array, so this patch corrects the loop bounds to reflect that.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
---
hw/spapr_pci.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/hw/spapr_pci.c b/hw/spapr_pci.c
index 7162588..9b6a032 100644
--- a/hw/spapr_pci.c
+++ b/hw/spapr_pci.c
@@ -454,7 +454,7 @@ int spapr_populate_pci_devices(sPAPRPHBState *phb,
reg[0].size = 0;
n = 0;
- for (i = 0; i < PCI_NUM_REGIONS; ++i) {
+ for (i = 0; i < ARRAY_SIZE(bars); ++i) {
if (0 == dev->io_regions[i].size) {
continue;
}
--
1.7.7.3
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [Qemu-devel] [Qemu-ppc] [PATCH] pseries: Fix array overrun bug in PCI code
2011-11-29 6:21 [Qemu-devel] [PATCH] pseries: Fix array overrun bug in PCI code David Gibson
@ 2011-11-29 7:41 ` David Gibson
2011-12-05 20:24 ` andrzej zaborowski
2011-12-19 13:59 ` [Qemu-devel] " Alexander Graf
1 sibling, 1 reply; 6+ messages in thread
From: David Gibson @ 2011-11-29 7:41 UTC (permalink / raw)
To: agraf; +Cc: aik, sw, qemu-ppc, qemu-devel
On Tue, Nov 29, 2011 at 05:21:39PM +1100, David Gibson wrote:
> spapr_populate_pci_devices() containd a loop with PCI_NUM_REGIONS (7)
> iterations. However this overruns the 'bars' global array, which only has
> 6 elements. In fact we only want to run this loop for things listed in the
> bars array, so this patch corrects the loop bounds to reflect that.
>
> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
As a bugfix for a bad memory access, this is definitely for 1.0
--
David Gibson | I'll have my music baroque, and my code
david AT gibson.dropbear.id.au | minimalist, thank you. NOT _the_ _other_
| _way_ _around_!
http://www.ozlabs.org/~dgibson
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [Qemu-devel] [Qemu-ppc] [PATCH] pseries: Fix array overrun bug in PCI code
2011-11-29 7:41 ` [Qemu-devel] [Qemu-ppc] " David Gibson
@ 2011-12-05 20:24 ` andrzej zaborowski
2011-12-05 20:33 ` Alexander Graf
0 siblings, 1 reply; 6+ messages in thread
From: andrzej zaborowski @ 2011-12-05 20:24 UTC (permalink / raw)
To: agraf, aik, sw, qemu-ppc, qemu-devel
On 29 November 2011 08:41, David Gibson <david@gibson.dropbear.id.au> wrote:
> On Tue, Nov 29, 2011 at 05:21:39PM +1100, David Gibson wrote:
>> spapr_populate_pci_devices() containd a loop with PCI_NUM_REGIONS (7)
>> iterations. However this overruns the 'bars' global array, which only has
>> 6 elements. In fact we only want to run this loop for things listed in the
>> bars array, so this patch corrects the loop bounds to reflect that.
>>
>> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
>
> As a bugfix for a bad memory access, this is definitely for 1.0
Now applied. Indeed it would probably have been better done before the release.
Cheers
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [Qemu-devel] [Qemu-ppc] [PATCH] pseries: Fix array overrun bug in PCI code
2011-12-05 20:24 ` andrzej zaborowski
@ 2011-12-05 20:33 ` Alexander Graf
0 siblings, 0 replies; 6+ messages in thread
From: Alexander Graf @ 2011-12-05 20:33 UTC (permalink / raw)
To: andrzej zaborowski; +Cc: aik, sw, qemu-ppc, qemu-devel
On 05.12.2011, at 21:24, andrzej zaborowski wrote:
> On 29 November 2011 08:41, David Gibson <david@gibson.dropbear.id.au> wrote:
>> On Tue, Nov 29, 2011 at 05:21:39PM +1100, David Gibson wrote:
>>> spapr_populate_pci_devices() containd a loop with PCI_NUM_REGIONS (7)
>>> iterations. However this overruns the 'bars' global array, which only has
>>> 6 elements. In fact we only want to run this loop for things listed in the
>>> bars array, so this patch corrects the loop bounds to reflect that.
>>>
>>> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
>>
>> As a bugfix for a bad memory access, this is definitely for 1.0
>
> Now applied. Indeed it would probably have been better done before the release.
Well, that's why we aligned to have 1.0.1 around christmas - because there will be more issues exposed soon, I'm fairly sure :)
Thanks for applying btw.
Alex
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [Qemu-devel] [PATCH] pseries: Fix array overrun bug in PCI code
2011-11-29 6:21 [Qemu-devel] [PATCH] pseries: Fix array overrun bug in PCI code David Gibson
2011-11-29 7:41 ` [Qemu-devel] [Qemu-ppc] " David Gibson
@ 2011-12-19 13:59 ` Alexander Graf
2011-12-19 14:01 ` [Qemu-devel] [Qemu-ppc] " Alexander Graf
1 sibling, 1 reply; 6+ messages in thread
From: Alexander Graf @ 2011-12-19 13:59 UTC (permalink / raw)
To: David Gibson; +Cc: aik, sw, qemu-ppc, qemu-devel
On 29.11.2011, at 07:21, David Gibson wrote:
> spapr_populate_pci_devices() containd a loop with PCI_NUM_REGIONS (7)
> iterations. However this overruns the 'bars' global array, which only has
> 6 elements. In fact we only want to run this loop for things listed in the
> bars array, so this patch corrects the loop bounds to reflect that.
>
> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Thanks, applied to ppc-next and queued for 1.0.
Alex
> ---
> hw/spapr_pci.c | 2 +-
> 1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/hw/spapr_pci.c b/hw/spapr_pci.c
> index 7162588..9b6a032 100644
> --- a/hw/spapr_pci.c
> +++ b/hw/spapr_pci.c
> @@ -454,7 +454,7 @@ int spapr_populate_pci_devices(sPAPRPHBState *phb,
> reg[0].size = 0;
>
> n = 0;
> - for (i = 0; i < PCI_NUM_REGIONS; ++i) {
> + for (i = 0; i < ARRAY_SIZE(bars); ++i) {
> if (0 == dev->io_regions[i].size) {
> continue;
> }
> --
> 1.7.7.3
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [Qemu-devel] [Qemu-ppc] [PATCH] pseries: Fix array overrun bug in PCI code
2011-12-19 13:59 ` [Qemu-devel] " Alexander Graf
@ 2011-12-19 14:01 ` Alexander Graf
0 siblings, 0 replies; 6+ messages in thread
From: Alexander Graf @ 2011-12-19 14:01 UTC (permalink / raw)
To: Alexander Graf; +Cc: aik, sw, qemu-ppc, qemu-devel, David Gibson
On 19.12.2011, at 14:59, Alexander Graf wrote:
>
> On 29.11.2011, at 07:21, David Gibson wrote:
>
>> spapr_populate_pci_devices() containd a loop with PCI_NUM_REGIONS (7)
>> iterations. However this overruns the 'bars' global array, which only has
>> 6 elements. In fact we only want to run this loop for things listed in the
>> bars array, so this patch corrects the loop bounds to reflect that.
>>
>> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
>
> Thanks, applied to ppc-next and queued for 1.0.
Call me stupid. Only queued for 1.0 of course.
Alex
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2011-12-19 14:01 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2011-11-29 6:21 [Qemu-devel] [PATCH] pseries: Fix array overrun bug in PCI code David Gibson
2011-11-29 7:41 ` [Qemu-devel] [Qemu-ppc] " David Gibson
2011-12-05 20:24 ` andrzej zaborowski
2011-12-05 20:33 ` Alexander Graf
2011-12-19 13:59 ` [Qemu-devel] " Alexander Graf
2011-12-19 14:01 ` [Qemu-devel] [Qemu-ppc] " Alexander Graf
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.