hw/usb/imx: Fix out of bounds access in imx_usbphy_read()
The i.MX USB Phy driver does not check register ranges, resulting in out of
bounds accesses if an attempt is made to access non-existing PHY registers.
Add range check and conditionally report bad accesses to fix the problem.
While at it, also conditionally log attempted writes to non-existing or
read-only registers.
Reported-by: Qiang Liu <cyruscyliu@gmail.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Qiang Liu <cyruscyliu@gmail.com>
Message-id: 20230316234926.208874-1-linux@roeck-us.net
Link: https://gitlab.com/qemu-project/qemu/-/issues/1408
Fixes: 0701a5efa0
("hw/usb: Add basic i.MX USB Phy support")
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
This commit is contained in:
parent
d399d6b179
commit
3202b2628b
|
@ -13,6 +13,7 @@
|
|||
#include "qemu/osdep.h"
|
||||
#include "hw/usb/imx-usb-phy.h"
|
||||
#include "migration/vmstate.h"
|
||||
#include "qemu/log.h"
|
||||
#include "qemu/module.h"
|
||||
|
||||
static const VMStateDescription vmstate_imx_usbphy = {
|
||||
|
@ -90,7 +91,15 @@ static uint64_t imx_usbphy_read(void *opaque, hwaddr offset, unsigned size)
|
|||
value = s->usbphy[index - 3];
|
||||
break;
|
||||
default:
|
||||
value = s->usbphy[index];
|
||||
if (index < USBPHY_MAX) {
|
||||
value = s->usbphy[index];
|
||||
} else {
|
||||
qemu_log_mask(LOG_GUEST_ERROR,
|
||||
"%s: Read from non-existing USB PHY register 0x%"
|
||||
HWADDR_PRIx "\n",
|
||||
__func__, offset);
|
||||
value = 0;
|
||||
}
|
||||
break;
|
||||
}
|
||||
return (uint64_t)value;
|
||||
|
@ -168,7 +177,13 @@ static void imx_usbphy_write(void *opaque, hwaddr offset, uint64_t value,
|
|||
s->usbphy[index - 3] ^= value;
|
||||
break;
|
||||
default:
|
||||
/* Other registers are read-only */
|
||||
/* Other registers are read-only or do not exist */
|
||||
qemu_log_mask(LOG_GUEST_ERROR,
|
||||
"%s: Write to %s USB PHY register 0x%"
|
||||
HWADDR_PRIx "\n",
|
||||
__func__,
|
||||
index >= USBPHY_MAX ? "non-existing" : "read-only",
|
||||
offset);
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
|
Loading…
Reference in New Issue