OpenE2K/qemu-e2k
13
4
Fork 0
Code Issues 4 Pull Requests Projects 2 Releases Activity

openpic: add some bounds checking for IRQ numbers

Browse Source 
The two checks with abort() guard against potential QEMU-internal
problems, but the EOI check stops the guest from causing updates to queue
position -1 and other havoc if it writes EOI with no interrupt in
service.

Signed-off-by: Scott Wood <scottwood@freescale.com>
[agraf: remove hunk in code that didn't get applied yet]
Signed-off-by: Alexander Graf <agraf@suse.de>
This commit is contained in:
Scott Wood 2012-12-21 16:15:50 +00:00 committed by Alexander Graf
parent e69a17f65e
commit 65b9d0d565
1 changed files with 11 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
hw/openpic.c
View File

@ -414,6 +414,11 @@ static void openpic_set_irq(void *opaque, int n_IRQ, int level)
OpenPICState *opp = opaque;
IRQSource *src;
if (n_IRQ >= MAX_IRQ) {
fprintf(stderr, "%s: IRQ %d out of range\n", __func__, n_IRQ);
abort();
}
src = &opp->src[n_IRQ];
DPRINTF("openpic: set irq %d = %d ivpr=0x%08x\n",
n_IRQ, level, src->ivpr);
@ -888,6 +893,12 @@ static void openpic_cpu_write_internal(void *opaque, hwaddr addr,
case 0xB0: /* EOI */
DPRINTF("EOI\n");
s_IRQ = IRQ_get_next(opp, &dst->servicing);
if (s_IRQ < 0) {
DPRINTF("%s: EOI with no interrupt in service\n", __func__);
break;
}
IRQ_resetbit(&dst->servicing, s_IRQ);
/* Set up next servicing IRQ */
s_IRQ = IRQ_get_next(opp, &dst->servicing);