qemu-e2k/hw/ssi
Frederic Konrad 90bb6d6764 hw/ssi/xilinx_spips: fix an out of bound access
The spips, qspips, and zynqmp-qspips share the same realize function
(xilinx_spips_realize) and initialize their io memory region with different
mmio_ops passed through the class.  The size of the memory region is set to
the largest area (0x200 bytes for zynqmp-qspips) thus it is possible to write
out of s->regs[addr] in xilinx_spips_write for spips and qspips.

This fixes that wrong behavior.

Reviewed-by: Luc Michel <luc.michel@amd.com>
Signed-off-by: Frederic Konrad <fkonrad@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Message-id: 20231124143505.1493184-2-fkonrad@amd.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-11-27 15:38:43 +00:00
..
aspeed_smc.c aspeed/smc: Wire CS lines at reset 2023-09-01 11:40:04 +02:00
ibex_spi_host.c hw/ssi: ibex_spi_host: Clear the interrupt even if disabled 2023-11-07 11:06:02 +10:00
imx_spi.c hw/ssi: imx_spi: Correct tx and rx fifo endianness 2021-02-02 17:00:55 +00:00
Kconfig hw/ssi: Add SiFive SPI controller support 2021-03-04 09:43:29 -05:00
meson.build meson: Replace softmmu_ss -> system_ss 2023-06-20 10:01:30 +02:00
mss-spi.c
npcm7xx_fiu.c hw/*: Use type casting for SysBusDevice in NPCM7XX 2021-01-12 21:19:02 +00:00
npcm_pspi.c hw/ssi: Add Nuvoton PSPI Module 2023-02-16 16:00:48 +00:00
omap_spi.c hw/arm/omap: Drop useless casts from void * to pointer 2023-01-12 17:15:09 +00:00
pl022.c hw/ssi: Rename SSI 'slave' as 'peripheral' 2020-12-10 12:15:03 -05:00
sifive_spi.c hw/ssi/sifive_spi.c: spelling: reigster 2023-01-17 10:02:37 +01:00
ssi.c hw/ssi: Check for duplicate CS indexes 2023-09-01 11:40:04 +02:00
stm32f2xx_spi.c
trace-events hw/ssi: Add Nuvoton PSPI Module 2023-02-16 16:00:48 +00:00
trace.h
xilinx_spi.c hw/ssi: Fix Linux driver init issue with xilinx_spi 2023-04-03 16:12:30 +01:00
xilinx_spips.c hw/ssi/xilinx_spips: fix an out of bound access 2023-11-27 15:38:43 +00:00
xlnx-versal-ospi.c hw/other: spelling fixes 2023-09-21 11:31:16 +03:00