OpenE2K
/
qemu-e2k
13
4
Fork 0
Code Issues 4 Pull Requests Projects 2 Releases Activity

hw/usb/imx: Fix out of bounds access in imx_usbphy_read() 

The i.MX USB Phy driver does not check register ranges, resulting in out of
bounds accesses if an attempt is made to access non-existing PHY registers.
Add range check and conditionally report bad accesses to fix the problem.

While at it, also conditionally log attempted writes to non-existing or
read-only registers.

Reported-by: Qiang Liu <cyruscyliu@gmail.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Qiang Liu <cyruscyliu@gmail.com>
Message-id: 20230316234926.208874-1-linux@roeck-us.net
Link: https://gitlab.com/qemu-project/qemu/-/issues/1408
Fixes: 0701a5efa0 ("hw/usb: Add basic i.MX USB Phy support")
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
This commit is contained in:
Guenter Roeck 2023-03-16 16:49:26 -07:00 committed by Peter Maydell
parent d399d6b179
commit 3202b2628b
1 changed files with 17 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
hw/usb/imx-usb-phy.c
View File

@ -13,6 +13,7 @@
#include "qemu/osdep.h"
#include "hw/usb/imx-usb-phy.h"
#include "migration/vmstate.h"
#include "qemu/log.h"
#include "qemu/module.h"
static const VMStateDescription vmstate_imx_usbphy = {
@ -90,7 +91,15 @@ static uint64_t imx_usbphy_read(void *opaque, hwaddr offset, unsigned size)
value = s->usbphy[index - 3];
break;
default:
value = s->usbphy[index];
if (index < USBPHY_MAX) {
value = s->usbphy[index];
} else {
qemu_log_mask(LOG_GUEST_ERROR,
"%s: Read from non-existing USB PHY register 0x%"
HWADDR_PRIx "\n",
__func__, offset);
value = 0;
}
break;
}
return (uint64_t)value;
@ -168,7 +177,13 @@ static void imx_usbphy_write(void *opaque, hwaddr offset, uint64_t value,
s->usbphy[index - 3] ^= value;
break;
default:
/* Other registers are read-only */
/* Other registers are read-only or do not exist */
qemu_log_mask(LOG_GUEST_ERROR,
"%s: Write to %s USB PHY register 0x%"
HWADDR_PRIx "\n",
__func__,
index >= USBPHY_MAX ? "non-existing" : "read-only",
offset);
break;
}
}