---Steps to Reproduce---

When passed a negative number to 'maxcpus' parameter, Qemu aborts
with a core dump.

Run the following command with maxcpus argument as negative number

ppc64-softmmu/qemu-system-ppc64 --nographic -vga none -machine
pseries,accel=kvm,kvm-type=HV -m size=200g -device virtio-blk-pci,
drive=rootdisk -drive file=/home/images/pegas-1.0-ppc64le.qcow2,
if=none,cache=none,id=rootdisk,format=qcow2 -monitor telnet
:127.0.0.1:1234,server,nowait -net nic,model=virtio -net
user -redir tcp:2000::22 -device nec-usb-xhci -smp 8,cores=1,
threads=1,maxcpus=-12

(process:12149): GLib-ERROR **: gmem.c:130: failed to allocate
 18446744073709550568 bytes

Trace/breakpoint trap

Reported-by: R.Nageswara Sastry <rnsastry@linux.vnet.ibm.com>
Signed-off-by: Seeteena Thoufeek <s1seetee@linux.vnet.ibm.com>
Reviewed-by: Bharata B Rao <bharata@linux.vnet.ibm.com>
---
 vl.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/vl.c b/vl.c
index 8e247cc..042714f 100644
--- a/vl.c
+++ b/vl.c
@@ -1244,6 +1244,11 @@ static void smp_parse(QemuOpts *opts)
         }
 
         max_cpus = qemu_opt_get_number(opts, "maxcpus", cpus);
+
+	if (max_cpus < 0) {
+		error_report("Invalid max_cpus : %d", max_cpus);
+		exit(1);
+	}
 
         if (max_cpus < cpus) {
             error_report("maxcpus must be equal to or greater than smp");
-- 
1.8.3.1

Hi,

This series seems to have some coding style problems. See output below for
more information:

Type: series
Subject: [Qemu-devel] [PATCH v2] qemu crashes when a negative number used for 'maxcpus'
Message-id: 1503924917-12687-1-git-send-email-s1seetee@linux.vnet.ibm.com

=== TEST SCRIPT BEGIN ===
#!/bin/bash

BASE=base
n=1
total=$(git log --oneline $BASE.. | wc -l)
failed=0

git config --local diff.renamelimit 0
git config --local diff.renames True

commits="$(git log --format=%H --reverse $BASE..)"
for c in $commits; do
    echo "Checking PATCH $n/$total: $(git log -n 1 --format=%s $c)..."
    if ! git show $c --format=email | ./scripts/checkpatch.pl --mailback -; then
        failed=1
        echo
    fi
    n=$((n+1))
done

exit $failed
=== TEST SCRIPT END ===

Updating 3c8cf5a9c21ff8782164d1def7f44bd888713384
From https://github.com/patchew-project/qemu
 * [new tag]               patchew/1503924917-12687-1-git-send-email-s1seetee@linux.vnet.ibm.com -> patchew/1503924917-12687-1-git-send-email-s1seetee@linux.vnet.ibm.com
Switched to a new branch 'test'
bdc7670bb2 qemu crashes when a negative number used for 'maxcpus'

=== OUTPUT BEGIN ===
Checking PATCH 1/1: qemu crashes when a negative number used for 'maxcpus'...
ERROR: code indent should never use tabs
#39: FILE: vl.c:1248:
+^Iif (max_cpus < 0) {$

ERROR: code indent should never use tabs
#40: FILE: vl.c:1249:
+^I^Ierror_report("Invalid max_cpus : %d", max_cpus);$

ERROR: code indent should never use tabs
#41: FILE: vl.c:1250:
+^I^Iexit(1);$

ERROR: code indent should never use tabs
#42: FILE: vl.c:1251:
+^I}$

total: 4 errors, 0 warnings, 11 lines checked

Your patch has style problems, please review.  If any of these errors
are false positives report them to the maintainer, see
CHECKPATCH in MAINTAINERS.

=== OUTPUT END ===

Test command exited with code: 1


---
Email generated automatically by Patchew [http://patchew.org/].
Please send your feedback to patchew-devel@freelists.org