diff options
| author | Scott Wood <scottwood@freescale.com> | 2012-12-21 16:15:50 +0000 |
|---|---|---|
| committer | Alexander Graf <agraf@suse.de> | 2013-01-07 17:37:10 +0100 |
| commit | 65b9d0d5659687ebb85b1305ac70b3a84df16e5a (patch) | |
| tree | b596c249dc9644aa357ca90473fb12c22ef8db71 | |
| parent | e69a17f65e9f12f33c48b04a789e49d40a8993f5 (diff) | |
openpic: add some bounds checking for IRQ numbers
The two checks with abort() guard against potential QEMU-internal
problems, but the EOI check stops the guest from causing updates to queue
position -1 and other havoc if it writes EOI with no interrupt in
service.
Signed-off-by: Scott Wood <scottwood@freescale.com>
[agraf: remove hunk in code that didn't get applied yet]
Signed-off-by: Alexander Graf <agraf@suse.de>
| -rw-r--r-- | hw/openpic.c | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/hw/openpic.c b/hw/openpic.c index b54308d042..35a7fe383b 100644 --- a/hw/openpic.c +++ b/hw/openpic.c @@ -414,6 +414,11 @@ static void openpic_set_irq(void *opaque, int n_IRQ, int level) OpenPICState *opp = opaque; IRQSource *src; + if (n_IRQ >= MAX_IRQ) { + fprintf(stderr, "%s: IRQ %d out of range\n", __func__, n_IRQ); + abort(); + } + src = &opp->src[n_IRQ]; DPRINTF("openpic: set irq %d = %d ivpr=0x%08x\n", n_IRQ, level, src->ivpr); @@ -888,6 +893,12 @@ static void openpic_cpu_write_internal(void *opaque, hwaddr addr, case 0xB0: /* EOI */ DPRINTF("EOI\n"); s_IRQ = IRQ_get_next(opp, &dst->servicing); + + if (s_IRQ < 0) { + DPRINTF("%s: EOI with no interrupt in service\n", __func__); + break; + } + IRQ_resetbit(&dst->servicing, s_IRQ); /* Set up next servicing IRQ */ s_IRQ = IRQ_get_next(opp, &dst->servicing); |