diff mbox

[PATCHv3,1/3] qemu/msi: fix segfault in msix_save

Message ID 20090705102423.GA3833@redhat.com (mailing list archive)
State New, archived
Headers show

Commit Message

Michael S. Tsirkin July 5, 2009, 10:24 a.m. UTC
This fixes segfault reported by Kevin Wolf,
and simplifies the code in msix_save.

Reported-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/msix.c |   12 +++++++-----
 1 files changed, 7 insertions(+), 5 deletions(-)

Comments

Blue Swirl July 5, 2009, 10:46 a.m. UTC | #1
On 7/5/09, Michael S. Tsirkin <mst@redhat.com> wrote:
> This fixes segfault reported by Kevin Wolf,
>  and simplifies the code in msix_save.

>  +    if (!dev->cap_present & QEMU_PCI_CAP_MSIX)
>  +        return;

Dubious: !x & y. You also forgot the braces.
--
To unsubscribe from this list: send the line "unsubscribe kvm" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Michael S. Tsirkin July 5, 2009, 11:10 a.m. UTC | #2
On Sun, Jul 05, 2009 at 01:46:53PM +0300, Blue Swirl wrote:
> On 7/5/09, Michael S. Tsirkin <mst@redhat.com> wrote:
> > This fixes segfault reported by Kevin Wolf,
> >  and simplifies the code in msix_save.
> 
> >  +    if (!dev->cap_present & QEMU_PCI_CAP_MSIX)
> >  +        return;
> 
> Dubious: !x & y. You also forgot the braces.

Yes. Happens to work because QEMU_PCI_CAP_MSIX is 0x1.
I'll fix that, thanks!

--
To unsubscribe from this list: send the line "unsubscribe kvm" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/hw/msix.c b/hw/msix.c
index 4ab6da6..98c62a5 100644
--- a/hw/msix.c
+++ b/hw/msix.c
@@ -284,11 +284,13 @@  int msix_uninit(PCIDevice *dev)
 
 void msix_save(PCIDevice *dev, QEMUFile *f)
 {
-    unsigned nentries = (pci_get_word(dev->config + PCI_MSIX_FLAGS) &
-                         PCI_MSIX_FLAGS_QSIZE) + 1;
-    qemu_put_buffer(f, dev->msix_table_page, nentries * MSIX_ENTRY_SIZE);
-    qemu_put_buffer(f, dev->msix_table_page + MSIX_PAGE_PENDING,
-                    (nentries + 7) / 8);
+    unsigned n = dev->msix_entries_nr;
+
+    if (!dev->cap_present & QEMU_PCI_CAP_MSIX)
+        return;
+
+    qemu_put_buffer(f, dev->msix_table_page, n * MSIX_ENTRY_SIZE);
+    qemu_put_buffer(f, dev->msix_table_page + MSIX_PAGE_PENDING, (n + 7) / 8);
 }
 
 /* Should be called after restoring the config space. */