[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 13/15] openpic: add some bounds checking for IRQ num
From: |
Scott Wood |
Subject: |
[Qemu-devel] [PATCH 13/15] openpic: add some bounds checking for IRQ numbers |
Date: |
Fri, 21 Dec 2012 20:15:50 -0600 |
The two checks with abort() guard against potential QEMU-internal
problems, but the EOI check stops the guest from causing updates to queue
position -1 and other havoc if it writes EOI with no interrupt in
service.
Signed-off-by: Scott Wood <address@hidden>
---
hw/openpic.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/hw/openpic.c b/hw/openpic.c
index 5accff5..a3fcefd 100644
--- a/hw/openpic.c
+++ b/hw/openpic.c
@@ -289,6 +289,10 @@ static void IRQ_check(OpenPICState *opp, IRQ_queue_t *q)
irq = base + offset;
map &= ~(1UL << offset);
+ if (irq >= MAX_IRQ) {
+ abort();
+ }
+
DPRINTF("IRQ_check: irq %d set ivpr_pr=%d pr=%d\n",
irq, IVPR_PRIORITY(opp->src[irq].ivpr), priority);
@@ -428,6 +432,11 @@ static void openpic_set_irq(void *opaque, int n_IRQ, int
level)
OpenPICState *opp = opaque;
IRQ_src_t *src;
+ if (n_IRQ >= MAX_IRQ) {
+ fprintf(stderr, "%s: IRQ %d out of range\n", __func__, n_IRQ);
+ abort();
+ }
+
src = &opp->src[n_IRQ];
DPRINTF("openpic: set irq %d = %d ivpr=0x%08x\n",
n_IRQ, level, src->ivpr);
@@ -923,6 +932,12 @@ static void openpic_cpu_write_internal(void *opaque,
hwaddr addr,
case 0xB0: /* EOI */
DPRINTF("EOI\n");
s_IRQ = IRQ_get_next(opp, &dst->servicing);
+
+ if (s_IRQ < 0) {
+ DPRINTF("%s: EOI with no interrupt in service\n", __func__);
+ break;
+ }
+
IRQ_resetbit(&dst->servicing, s_IRQ);
/* Set up next servicing IRQ */
s_IRQ = IRQ_get_next(opp, &dst->servicing);
--
1.7.9.5
- [Qemu-devel] [PATCH 03/15] openpic: fix sense and priority bits, (continued)
- [Qemu-devel] [PATCH 03/15] openpic: fix sense and priority bits, Scott Wood, 2012/12/21
- [Qemu-devel] [PATCH 07/15] openpic: make ctpr signed, Scott Wood, 2012/12/21
- [Qemu-devel] [PATCH 06/15] openpic: rework critical interrupt support, Scott Wood, 2012/12/21
- [Qemu-devel] [PATCH 08/15] openpic/fsl: critical interrupts ignore mask before v4.1, Scott Wood, 2012/12/21
- [Qemu-devel] [PATCH 10/15] Revert "openpic: Accelerate pending irq search", Scott Wood, 2012/12/21
- [Qemu-devel] [PATCH 12/15] openpic: IRQ_check: search the queue a word at a time, Scott Wood, 2012/12/21
- [Qemu-devel] [PATCH 09/15] openpic: always call IRQ_check from IRQ_get_next, Scott Wood, 2012/12/21
- [Qemu-devel] [PATCH 11/15] openpic: use standard bitmap operations, Scott Wood, 2012/12/21
- [Qemu-devel] [PATCH 05/15] openpic: make register names correspond better with hw docs, Scott Wood, 2012/12/21
- [Qemu-devel] [PATCH 15/15] openpic: fix CTPR and de-assertion of interrupts, Scott Wood, 2012/12/21
- [Qemu-devel] [PATCH 13/15] openpic: add some bounds checking for IRQ numbers,
Scott Wood <=
- [Qemu-devel] [PATCH 14/15] openpic: move IACK to its own function, Scott Wood, 2012/12/21