diff options
| author | Michael Roth <mdroth@linux.vnet.ibm.com> | 2012-03-04 13:38:27 -0600 |
|---|---|---|
| committer | Andreas Färber <afaerber@suse.de> | 2012-06-08 16:11:14 +0200 |
| commit | 09f1bbcd834c63da35b3fe190fcd9a20d7b04f07 (patch) | |
| tree | 49be20255dd293b1af972a1d7b8cd4cd6e9d87ae /hw/qdev-properties.c | |
| parent | 0d30b0a2d338cd5f463a0fd3942d19f70eb6db56 (diff) | |
| download | qemu-09f1bbcd834c63da35b3fe190fcd9a20d7b04f07.tar.gz qemu-09f1bbcd834c63da35b3fe190fcd9a20d7b04f07.tar.bz2 qemu-09f1bbcd834c63da35b3fe190fcd9a20d7b04f07.zip | |
qdev: Use int32_t container for devfn property
Valid range for devfn is -1 to 255 (-1 for automatic assignment). We do
not currently validate this due to devfn being stored as a uint32_t.
This can lead to segfaults and other strange behavior.
We could technically just cast it to int32_t to implement the checking,
but this will not work for visitor-based setting where we may do additional
bounds-checking based on target container type, which is int32_t for this
case.
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>
Diffstat (limited to 'hw/qdev-properties.c')
| -rw-r--r-- | hw/qdev-properties.c | 11 |
1 files changed, 4 insertions, 7 deletions
diff --git a/hw/qdev-properties.c b/hw/qdev-properties.c index b7b5597c62..d109f89886 100644 --- a/hw/qdev-properties.c +++ b/hw/qdev-properties.c @@ -824,7 +824,7 @@ static void set_pci_devfn(Object *obj, Visitor *v, void *opaque, { DeviceState *dev = DEVICE(obj); Property *prop = opaque; - uint32_t *ptr = qdev_get_prop_ptr(dev, prop); + int32_t *ptr = qdev_get_prop_ptr(dev, prop); unsigned int slot, fn, n; Error *local_err = NULL; char *str; @@ -860,7 +860,7 @@ invalid: static int print_pci_devfn(DeviceState *dev, Property *prop, char *dest, size_t len) { - uint32_t *ptr = qdev_get_prop_ptr(dev, prop); + int32_t *ptr = qdev_get_prop_ptr(dev, prop); if (*ptr == -1) { return snprintf(dest, len, "<unset>"); @@ -875,11 +875,8 @@ PropertyInfo qdev_prop_pci_devfn = { .print = print_pci_devfn, .get = get_int32, .set = set_pci_devfn, - /* FIXME: this should be -1...255, but the address is stored - * into an uint32_t rather than int32_t. - */ - .min = 0, - .max = 0xFFFFFFFFULL, + .min = -1, + .max = 255, }; /* --- blocksize --- */ |