Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/2194457/?format=api
{ "id": 2194457, "url": "http://patchwork.ozlabs.org/api/patches/2194457/?format=api", "web_url": "http://patchwork.ozlabs.org/project/qemu-devel/patch/20260209014540.823794-1-jamin_lin@aspeedtech.com/", "project": { "id": 14, "url": "http://patchwork.ozlabs.org/api/projects/14/?format=api", "name": "QEMU Development", "link_name": "qemu-devel", "list_id": "qemu-devel.nongnu.org", "list_email": "qemu-devel@nongnu.org", "web_url": "", "scm_url": "", "webscm_url": "", "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<20260209014540.823794-1-jamin_lin@aspeedtech.com>", "list_archive_url": null, "date": "2026-02-09T01:45:41", "name": "[v1] hw/i2c/aspeed_i2c: Fix Out-of-Bounds access by using dynamic register array", "commit_ref": null, "pull_url": null, "state": "new", "archived": false, "hash": "6a8cf314d4f0e23893d6078410c4dc78756c9c22", "submitter": { "id": 81768, "url": "http://patchwork.ozlabs.org/api/people/81768/?format=api", "name": "Jamin Lin", "email": "jamin_lin@aspeedtech.com" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/qemu-devel/patch/20260209014540.823794-1-jamin_lin@aspeedtech.com/mbox/", "series": [ { "id": 491456, "url": "http://patchwork.ozlabs.org/api/series/491456/?format=api", "web_url": "http://patchwork.ozlabs.org/project/qemu-devel/list/?series=491456", "date": "2026-02-09T01:45:41", "name": "[v1] hw/i2c/aspeed_i2c: Fix Out-of-Bounds access by using dynamic register array", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/491456/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2194457/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2194457/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "<qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org>", "X-Original-To": "incoming@patchwork.ozlabs.org", "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=aspeedtech.com header.i=@aspeedtech.com\n header.a=rsa-sha256 header.s=selector1 header.b=BVVBYb5u;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=nongnu.org\n (client-ip=209.51.188.17; helo=lists.gnu.org;\n envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org;\n receiver=patchwork.ozlabs.org)", "dkim=none (message not signed)\n header.d=none;dmarc=none action=none header.from=aspeedtech.com;" ], "Received": [ "from lists.gnu.org (lists.gnu.org [209.51.188.17])\n\t(using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4f8SH12m65z1xvY\n\tfor <incoming@patchwork.ozlabs.org>; Mon, 09 Feb 2026 12:46:53 +1100 (AEDT)", "from localhost ([::1] helo=lists1p.gnu.org)\n\tby lists.gnu.org with esmtp (Exim 4.90_1)\n\t(envelope-from <qemu-devel-bounces@nongnu.org>)\n\tid 1vpGLd-0003ps-H1; Sun, 08 Feb 2026 20:45:57 -0500", "from eggs.gnu.org ([2001:470:142:3::10])\n by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)\n (Exim 4.90_1) (envelope-from <jamin_lin@aspeedtech.com>)\n id 1vpGLa-0003pA-GX; Sun, 08 Feb 2026 20:45:54 -0500", "from mail-japanwestazlp170120003.outbound.protection.outlook.com\n ([2a01:111:f403:c406::3] helo=OS8PR02CU002.outbound.protection.outlook.com)\n by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)\n (Exim 4.90_1) (envelope-from <jamin_lin@aspeedtech.com>)\n id 1vpGLX-0001EZ-Q8; Sun, 08 Feb 2026 20:45:54 -0500", "from TYPPR06MB8206.apcprd06.prod.outlook.com (2603:1096:405:383::19)\n by KL1PR06MB6042.apcprd06.prod.outlook.com (2603:1096:820:d5::12)\n with Microsoft SMTP Server (version=TLS1_2,\n cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9587.18; Mon, 9 Feb\n 2026 01:45:42 +0000", "from TYPPR06MB8206.apcprd06.prod.outlook.com\n ([fe80::e659:1ead:77cb:f6d3]) by TYPPR06MB8206.apcprd06.prod.outlook.com\n ([fe80::e659:1ead:77cb:f6d3%3]) with mapi id 15.20.9587.017; Mon, 9 Feb 2026\n 01:45:42 +0000" ], "ARC-Seal": "i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;\n b=E7qmv7mUZE7/UTchKnT7PcTJ/WJQEc9xMG4NZw9weaGrmRg6n74+PewB2WdCH+wdoUXLhgha/BdHFKiQ7eHyypiIdywGr+rOexpk1wOCUAbNP86Dm+Z1mI8UaF4uVvSjPyzI1t5Ay4DMBP33m8tLp64bSFVN6llSjbhRrdiNnSy9CZC/+W8Fp0vvJ+px2BYd3Z5NsKNUomLB/WTOlFclZkrFMIyqaz9foXuljgeiwatF/9JLCTyOFKDvBGqxwTpeyGpEJ86nMWDeQstP3terMeluUf1Ftq9AojpTdW6Eop2Q07jp5UOjG0l1fmUDw+9REdnnMZV5i6beqH0gBqBKNA==", "ARC-Message-Signature": "i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;\n s=arcselector10001;\n h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;\n bh=Fr/qxde3ZydKElB3sZXn2Z2i6aTbK+RJLcmv6aSzZOs=;\n b=LbzEcOiwp3kJrH+aeNSZIkcdcRbpY4ARa75g/VL8rfqORJKydeyg6QAb8H8eCCCULcLThaHUvEpM9qXMOtkkjHVMUJ4W2uiHXueDOhUI6tZGywkdZMEkKL506dHKa5nY0Xo14YzqqfUVDJnhpqGqdSxHHkf+oM2wlmVdh+0+iUO+VYkkFJsuCNrUGDCmk6SKWJKZndoPrgDlUCBuxnqe5z2sT0HMOSyiRuplIEannXH2TsMFuMS2l09LmVoQmnq61rrF4uop+b5AfgLf+le+1BtE7x2WTmAoHGxeUbez2IVJI33dHzgRnkC7AhrXmFEIRDCbYDA9bstnZgyPwAkGLg==", "ARC-Authentication-Results": "i=1; mx.microsoft.com 1; spf=pass\n smtp.mailfrom=aspeedtech.com; dmarc=pass action=none\n header.from=aspeedtech.com; dkim=pass header.d=aspeedtech.com; arc=none", "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=aspeedtech.com;\n s=selector1;\n h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;\n bh=Fr/qxde3ZydKElB3sZXn2Z2i6aTbK+RJLcmv6aSzZOs=;\n b=BVVBYb5utZtz3r5E3Nb24FwSzK2RCaefhUV/FFV2BlLbwbFsG5gL4fklXDnKWZEOtlrVVOf0yr4+0s2HMpOrxk5x7l587urhNEPi2DPDczssoths8BsEBA62Z07OisZ1TEDM0ZPOHhaSyr6NJ+hDcNUCTkvYR7GQbE4FySEB3mh9ahlRphjK7qNhgYU6eF0eNCMnwo7AuqRvi7e03ZYOHKObxpKsjb+Ih8wHLYKysreMUyy3QQcWKUfSSghjfoTu2dSY7rtDyrDJ81v2ROu7F1xxb6RLmUUL4ZA9UXYTUWHn7zJCsM6Hnbey20Cn481AEt7zPcC6tqT3iiXejzpVng==", "From": "Jamin Lin <jamin_lin@aspeedtech.com>", "To": "=?iso-8859-1?q?C=E9dric_Le_Goater?= <clg@kaod.org>,\n Peter Maydell <peter.maydell@linaro.org>,\n Steven Lee <steven_lee@aspeedtech.com>, Troy Lee <leetroy@gmail.com>,\n Andrew Jeffery <andrew@codeconstruct.com.au>, Joel Stanley <joel@jms.id.au>,\n \"open list:ASPEED BMCs\" <qemu-arm@nongnu.org>,\n \"open list:All patches CC here\" <qemu-devel@nongnu.org>", "CC": "Jamin Lin <jamin_lin@aspeedtech.com>, Troy Lee <troy_lee@aspeedtech.com>,\n Kane Chen <kane_chen@aspeedtech.com>", "Subject": "[PATCH v1] hw/i2c/aspeed_i2c: Fix Out-of-Bounds access by using\n dynamic register array", "Thread-Topic": "[PATCH v1] hw/i2c/aspeed_i2c: Fix Out-of-Bounds access by using\n dynamic register array", "Thread-Index": "AQHcmWXMoUJBn9wsH0SaWe2SvMw7UA==", "Date": "Mon, 9 Feb 2026 01:45:41 +0000", "Message-ID": "<20260209014540.823794-1-jamin_lin@aspeedtech.com>", "Accept-Language": "zh-TW, en-US", "Content-Language": "en-US", "X-MS-Has-Attach": "", "X-MS-TNEF-Correlator": "", "authentication-results": [ "legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=aspeedtech.com header.i=@aspeedtech.com\n header.a=rsa-sha256 header.s=selector1 header.b=BVVBYb5u;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=nongnu.org\n (client-ip=209.51.188.17; helo=lists.gnu.org;\n envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org;\n receiver=patchwork.ozlabs.org)", "dkim=none (message not signed)\n header.d=none;dmarc=none action=none header.from=aspeedtech.com;" ], "x-ms-publictraffictype": "Email", "x-ms-traffictypediagnostic": "TYPPR06MB8206:EE_|KL1PR06MB6042:EE_", "x-ms-office365-filtering-correlation-id": "cb5cfd10-7126-4497-777a-08de677cef25", "x-ms-exchange-senderadcheck": "1", "x-ms-exchange-antispam-relay": "0", "x-microsoft-antispam": "BCL:0;\n ARA:13230040|376014|366016|1800799024|38070700021;", "x-microsoft-antispam-message-info": "=?iso-8859-1?q?JX/SkaGMYQxR/bTRZ9c1RiNj8H?=\n\t=?iso-8859-1?q?07YGBgpr9ykqGTqE0jZjk6M9DDFpmxcFmuhTYjGIjeghNwF0c3paz2uQ/n56?=\n\t=?iso-8859-1?q?ovPSFkTmWaxV/g+wtSqjw/jmkk1xsget7NMZXl2CnQpvjGcQmeO6g04T0Bv3?=\n\t=?iso-8859-1?q?pdzPCtjbPK9a54IKNsMWvGc6JeRUPufAYs6oHn9XsGA1La36tN4thLKSQH2x?=\n\t=?iso-8859-1?q?4wLq/+2QQsugBgKDuJ5YXcLB3QvJbuqAoUSh7YiMzioxe1g4TofFEEr28odT?=\n\t=?iso-8859-1?q?v5TFHQD578nuabDispBye9pAphHz6SqYLfQIyLK3sz+vNMCN5sEHiE+VCRFd?=\n\t=?iso-8859-1?q?qrJlKWeM/ahAPAdEKywpO5auaCl86GOThFC7HoXgSCX6kQaAPdERg/ceRpXC?=\n\t=?iso-8859-1?q?rx+cvq1maxO/zYgzMjCgcWT6Q4oXVsxx/J18Kiq4AiXcyOmkTa9yLtxQDN5P?=\n\t=?iso-8859-1?q?QtpSA+nvYXUVLagizu/WnhsHrDIKNNORWsf2hsjYh8v5uB1JJMBUaRPqZqC+?=\n\t=?iso-8859-1?q?KMN/h/FPBulzSfHa6VuoFfOhC1bJp9tbkLT3s9IZbfXBSHyHuNFvJox79IU8?=\n\t=?iso-8859-1?q?+D8wS9D1fJ0vCZ+P2bmYry9gmGcNJoJ7r5Mx8iVLgBcNweNPd3BmnYOXx6ix?=\n\t=?iso-8859-1?q?xwgdj+J9WjxmahTmXBdy/SGU8Pkp3+txDmL+GsOikwwrZpgXJIlxrPjf3c5N?=\n\t=?iso-8859-1?q?BztbkDnaRkaNPSaLjzK/CRpI1DL8tBg8GqwOhBFyAhJWGpmyB0xL2RyYUCpi?=\n\t=?iso-8859-1?q?ehGvIjqZhIbaNt6/B6v07Uqh6DQPseKPYQmyiyJ66CHe3cweel0cdn1lIxrn?=\n\t=?iso-8859-1?q?ujJtTghR+GeG9GkRM6DW5C29b6lGxxVtfWMycddSILkdS4L90XsS3nDhpcrD?=\n\t=?iso-8859-1?q?9VjIh74tS+pdx8k3uVnmWpp636mzEUhf4qviIhgqroNrdApy9czzXvDNBedH?=\n\t=?iso-8859-1?q?hoi2+8z1Eso2zb0p8TIplq9bWXK7T85tZrUhSoE8UbIrZWKyrP3+s8gQ1xPC?=\n\t=?iso-8859-1?q?2syxkJAci/ifsJ6OC4q9Nm09+UmZOQ+gGOX+XFOZd26DnsNsIVFYsbgKI2G/?=\n\t=?iso-8859-1?q?gQBKIfEh7sTash/yAAYR4QsSfy+dKCC1fGT6yVVjIFuRvT4ugaGwFT2B1rFP?=\n\t=?iso-8859-1?q?Ty2Dyvlzt94jsBYzmGwkAFLdMkD4AtpOJFNTaSOFOst0Af+GLqSxuF4lCn1p?=\n\t=?iso-8859-1?q?OuX/USi1I4O+K7d+QkQnuIBuALkj5hgAn0/hqocpyUrtm+iF4Q3jiE2z9M+L?=\n\t=?iso-8859-1?q?ADXg3v2nT0lSZoijYeY3fs4IdQjMiwyWn92X3My6ihnJpXRoaaHjTtIi0YxC?=\n\t=?iso-8859-1?q?imOWPzSPIhU0Q/VGj/hvtJPLgtXeu89SiJw4DdA5GcbqjmGqL8CnrA2Q0+Un?=\n\t=?iso-8859-1?q?lLUAJCBS7EB9Ccv55pA8CYVXAyZHrN6kVDHCVSrjqF2zMKUxLeuyuX/IqNar?=\n\t=?iso-8859-1?q?/qaCOBMTuonUcAlTd11xZ2g2jrs8QNC/wBA7YZ6jT0OcNbG3pRaaq+0XOTEm?=\n\t=?iso-8859-1?q?0DANK++Accs2bkeYo35hLxzqtAiyQu4JYNIDKljj1ndtTd59Z4duC7OldDpp?=\n\t=?iso-8859-1?q?Hti915H/6UakKS7IyH+elI9t9jEJSUDxQHe7479lgPZcTNw1h2GEnjDLwrtx?=\n\t=?iso-8859-1?q?HR+ttIwQJKnzmHCicOGkVXPCcuVfs3IBZtkvp1OudaZzmAB4ebScCx1rI=3D?=", "x-forefront-antispam-report": "CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:;\n IPV:NLI; SFV:NSPM; H:TYPPR06MB8206.apcprd06.prod.outlook.com; PTR:; CAT:NONE;\n SFS:(13230040)(376014)(366016)(1800799024)(38070700021); DIR:OUT; SFP:1102;", "x-ms-exchange-antispam-messagedata-chunkcount": "1", "x-ms-exchange-antispam-messagedata-0": "=?iso-8859-1?q?QeErq8osUJ8U1Zfg5WGJ2+r?=\n\t=?iso-8859-1?q?bwnLBH8HldE762UgDRh43WRLkoC3ewr+4LUKucSepDCmHB5pOT4KA7/a84Dg?=\n\t=?iso-8859-1?q?mAJjEU/1tbkxBa446UZtU1naUl1iAUy8TuxbUxnhjlQkCLyhkOrrU4lGwQ/v?=\n\t=?iso-8859-1?q?mMVCfa/YKy+3qWaZRLk9ohQE9tdCskJmflwddYPXmQXUomHwzQPpYoQj2Rbh?=\n\t=?iso-8859-1?q?WQXNpUh9lUiqL3geJc+2E57PVhpGKXaD8Ql8s++m3sV5WSFs4EOA4cQrY2Wo?=\n\t=?iso-8859-1?q?ipQGTgc3C0o2EWkG2tkyMf1HF4dze1MaAlx41UlrijkIRnAf8h1YDRIkdS6n?=\n\t=?iso-8859-1?q?DnJmvAC/I8M52vQ/LuAITT17TiX4wUu1eoItbqV1RDey9dTsjWjbQLTCdbdV?=\n\t=?iso-8859-1?q?QrXsaU/54AkTAeQ6OS0+ud+3OQQ6WQrsRkjhM/no8rfAyqa2M1tyOu8LDnck?=\n\t=?iso-8859-1?q?+mFxmdqB4uxF2d1k3sHnH1qlE5DTgVF3LaNGvsE4imUR6fUvgU7h0ZPOlo9e?=\n\t=?iso-8859-1?q?m/R+QO5HzJIu00r3ta/mvh41ylu4vbE8qTlSkFFzOtkfhH+tj3fUs1eXdHW1?=\n\t=?iso-8859-1?q?vNwuWFUYFG2LOM7OXdghVBdJ0TQnvVsqbNnbiDfRkeEkH74pAJ7qV01t7Rua?=\n\t=?iso-8859-1?q?M4P57Igz/x0G1MzRkMgSDlQJ6l7Tv1xbw5iI/LcDfGD9uMaOisA9HIDikO1W?=\n\t=?iso-8859-1?q?6Y8Q4mI06x/aXwuEUsee2bPHEVRMH4UhN1R83H6qsgJaEuvUeMns1w2Gx6R2?=\n\t=?iso-8859-1?q?nF5d7aAKIyGuOwydK3AOeQh9fqAnGqY2uEKSHNAVrreZkybqVopsmz5o16We?=\n\t=?iso-8859-1?q?hes72vrK4R00SbDD0UC92L6rApVHXWHXZy8iXj+bOlosmHF7Hikhc/KFcQ8d?=\n\t=?iso-8859-1?q?/vIkng5y6B1YSV/q11buQhf0h+ugPN2xnuDrdc7SD/9ds5rLdR1gDJHoyHA4?=\n\t=?iso-8859-1?q?BnJ9hjL9Zcy0PGpRAN4SZj75FkuljZ+fykOk8YTPjumAQGpf+o5b/p7a4p/W?=\n\t=?iso-8859-1?q?iNm8YaFNlk1aSeW38jAEpdeEstZnCxUmTNixyH/zR0X1tNj3ufXgVeIQuzzf?=\n\t=?iso-8859-1?q?Yd9/um5nNMgadoeNQsjbpime1m8Lc7s2J3hbXsN0K25mCnNFiZFj1uzOhOI0?=\n\t=?iso-8859-1?q?eCNLx4s90hzohu05soCQpYU5s8kLpDLB9kHgCao+RdJDlqeBfx6oKtJN+crV?=\n\t=?iso-8859-1?q?LlwmH/dQsBF2jQnv30K1wRiJcIPuf2h+gdxzry9PiuKJigwi4mW7vstiUtlr?=\n\t=?iso-8859-1?q?+gLaHIEpPyX/rN7wewOtMYrov/ZH9tp6e9XV0PUF/nAQtfKKvfGfTaF0Exhh?=\n\t=?iso-8859-1?q?z6nvlVXAK7MYGIN5nRe1dpdBJ9qsuB5hftOLV9W1S/qSLetLh4dM14pdQW96?=\n\t=?iso-8859-1?q?9GX7NmzdiMMAMxxoMMiTehzcFEUPkoXP6bOzxRSv3IKwBibPBA9qYM9Zjx/Y?=\n\t=?iso-8859-1?q?XSwvJ6bVVWiU4W3fBOBqgorXoBxTqUnghoMkNtMvBTJAtHDXFsLmjH8fRNnF?=\n\t=?iso-8859-1?q?iihVpsUyDURceiPp6yCEIlm0nIACfNfzyd8sO4UmNNbFjHcC/jQAFtubus5s?=\n\t=?iso-8859-1?q?qlBXyxxwbZmedrtBdy0Ib7GLkmYt7xFNCd7MnNnHksHAf26OeogFHLm5ot4M?=\n\t=?iso-8859-1?q?WamQ60eigjjUwb/YTdgwWvBmhsLLQIKUH9F3huj9DmfAR84yKCWE5J1L028o?=\n\t=?iso-8859-1?q?MUJ7eXRL3eUQcPiTvnHPIWWFhMbvQOMUqb0vIZn3cwnHO/ZobE9zKX9+VL8t?=\n\t=?iso-8859-1?q?5lxZuuPFb3PoJdRPYnmQHq0tLfA7kzio+XtKlFm5+HjEeWw=3D=3D?=", "Content-Type": "text/plain; charset=\"iso-8859-1\"", "Content-Transfer-Encoding": "quoted-printable", "MIME-Version": "1.0", "X-OriginatorOrg": "aspeedtech.com", "X-MS-Exchange-CrossTenant-AuthAs": "Internal", "X-MS-Exchange-CrossTenant-AuthSource": "TYPPR06MB8206.apcprd06.prod.outlook.com", "X-MS-Exchange-CrossTenant-Network-Message-Id": "\n cb5cfd10-7126-4497-777a-08de677cef25", "X-MS-Exchange-CrossTenant-originalarrivaltime": "09 Feb 2026 01:45:41.8474 (UTC)", "X-MS-Exchange-CrossTenant-fromentityheader": "Hosted", "X-MS-Exchange-CrossTenant-id": "43d4aa98-e35b-4575-8939-080e90d5a249", "X-MS-Exchange-CrossTenant-mailboxtype": "HOSTED", "X-MS-Exchange-CrossTenant-userprincipalname": "\n EpGpuEQV7vCynIGdqoB7rn+LTdk47wj3tctxBzVOrx4HcO9WULPh6vQQ1ZHU30vdAKbz1JoO0i5lq5gzkc9LTxgcVqJcUGnKxktxGBLZxu8=", "X-MS-Exchange-Transport-CrossTenantHeadersStamped": "KL1PR06MB6042", "Received-SPF": "pass client-ip=2a01:111:f403:c406::3;\n envelope-from=jamin_lin@aspeedtech.com;\n helo=OS8PR02CU002.outbound.protection.outlook.com", "X-Spam_score_int": "-20", "X-Spam_score": "-2.1", "X-Spam_bar": "--", "X-Spam_report": "(-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1,\n DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001,\n SPF_PASS=-0.001 autolearn=ham autolearn_force=no", "X-Spam_action": "no action", "X-BeenThere": "qemu-devel@nongnu.org", "X-Mailman-Version": "2.1.29", "Precedence": "list", "List-Id": "qemu development <qemu-devel.nongnu.org>", "List-Unsubscribe": "<https://lists.nongnu.org/mailman/options/qemu-devel>,\n <mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>", "List-Archive": "<https://lists.nongnu.org/archive/html/qemu-devel>", "List-Post": "<mailto:qemu-devel@nongnu.org>", "List-Help": "<mailto:qemu-devel-request@nongnu.org?subject=help>", "List-Subscribe": "<https://lists.nongnu.org/mailman/listinfo/qemu-devel>,\n <mailto:qemu-devel-request@nongnu.org?subject=subscribe>", "Errors-To": "qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org", "Sender": "qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org" }, "content": "The ASPEED I2C controller emulation used a fixed-size register array\n(28 dwords) for all SoC variants, while multiple ASPEED SoCs\n(AST2600, AST1030, AST2700) expose a larger MMIO register window\n(e.g. reg_size = 0x80).\n\nThis mismatch allows MMIO accesses beyond the allocated register\narray, leading to out-of-bounds reads in the I2C controller model.\n\nFix this by converting the register storage to a dynamically allocated\narray sized according to the controller class reg_size. The register\narray is now allocated during bus realize and free on unrealize,\nensuring safe access across different ASPEED SoC implementations.\n\nThis change eliminates I2C register out-of-bounds access caused by\nSoC-specific register size differences.\n\nSigned-off-by: Jamin Lin <jamin_lin@aspeedtech.com>\nResolves: https://gitlab.com/qemu-project/qemu/-/issues/3290\n---\n include/hw/i2c/aspeed_i2c.h | 4 +---\n hw/i2c/aspeed_i2c.c | 18 ++++++++++++++----\n 2 files changed, 15 insertions(+), 7 deletions(-)", "diff": "diff --git a/include/hw/i2c/aspeed_i2c.h b/include/hw/i2c/aspeed_i2c.h\nindex 68bd138026..205f0a58d2 100644\n--- a/include/hw/i2c/aspeed_i2c.h\n+++ b/include/hw/i2c/aspeed_i2c.h\n@@ -36,8 +36,6 @@ OBJECT_DECLARE_TYPE(AspeedI2CState, AspeedI2CClass, ASPEED_I2C)\n #define ASPEED_I2C_NR_BUSSES 16\n #define ASPEED_I2C_SHARE_POOL_SIZE 0x800\n #define ASPEED_I2C_BUS_POOL_SIZE 0x20\n-#define ASPEED_I2C_OLD_NUM_REG 11\n-#define ASPEED_I2C_NEW_NUM_REG 28\n \n #define A_I2CD_M_STOP_CMD BIT(5)\n #define A_I2CD_M_RX_CMD BIT(3)\n@@ -256,7 +254,7 @@ struct AspeedI2CBus {\n uint8_t id;\n qemu_irq irq;\n \n- uint32_t regs[ASPEED_I2C_NEW_NUM_REG];\n+ uint32_t *regs;\n uint8_t pool[ASPEED_I2C_BUS_POOL_SIZE];\n uint64_t dma_dram_offset;\n };\ndiff --git a/hw/i2c/aspeed_i2c.c b/hw/i2c/aspeed_i2c.c\nindex fb3d6a5600..cf3a003978 100644\n--- a/hw/i2c/aspeed_i2c.c\n+++ b/hw/i2c/aspeed_i2c.c\n@@ -1091,10 +1091,9 @@ static const MemoryRegionOps aspeed_i2c_bus_pool_ops = {\n \n static const VMStateDescription aspeed_i2c_bus_vmstate = {\n .name = TYPE_ASPEED_I2C,\n- .version_id = 6,\n- .minimum_version_id = 6,\n+ .version_id = 7,\n+ .minimum_version_id = 7,\n .fields = (const VMStateField[]) {\n- VMSTATE_UINT32_ARRAY(regs, AspeedI2CBus, ASPEED_I2C_NEW_NUM_REG),\n VMSTATE_UINT8_ARRAY(pool, AspeedI2CBus, ASPEED_I2C_BUS_POOL_SIZE),\n VMSTATE_UINT64(dma_dram_offset, AspeedI2CBus),\n VMSTATE_END_OF_LIST()\n@@ -1465,8 +1464,9 @@ static const TypeInfo aspeed_i2c_bus_slave_info = {\n static void aspeed_i2c_bus_reset(DeviceState *dev)\n {\n AspeedI2CBus *s = ASPEED_I2C_BUS(dev);\n+ AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(s->controller);\n \n- memset(s->regs, 0, sizeof(s->regs));\n+ memset(s->regs, 0, aic->reg_size);\n i2c_end_transfer(s->bus);\n }\n \n@@ -1492,6 +1492,7 @@ static void aspeed_i2c_bus_realize(DeviceState *dev, Error **errp)\n s->slave = i2c_slave_create_simple(s->bus, TYPE_ASPEED_I2C_BUS_SLAVE,\n 0xff);\n \n+ s->regs = g_new(uint32_t, aic->reg_size >> 2);\n memory_region_init_io(&s->mr, OBJECT(s), &aspeed_i2c_bus_ops,\n s, s->name, aic->reg_size);\n sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->mr);\n@@ -1501,6 +1502,14 @@ static void aspeed_i2c_bus_realize(DeviceState *dev, Error **errp)\n sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->mr_pool);\n }\n \n+static void aspeed_i2c_bus_unrealize(DeviceState *dev)\n+{\n+ AspeedI2CBus *s = ASPEED_I2C_BUS(dev);\n+\n+ g_free(s->regs);\n+ s->regs = NULL;\n+}\n+\n static const Property aspeed_i2c_bus_properties[] = {\n DEFINE_PROP_UINT8(\"bus-id\", AspeedI2CBus, id, 0),\n DEFINE_PROP_LINK(\"controller\", AspeedI2CBus, controller, TYPE_ASPEED_I2C,\n@@ -1514,6 +1523,7 @@ static void aspeed_i2c_bus_class_init(ObjectClass *klass, const void *data)\n \n dc->desc = \"Aspeed I2C Bus\";\n dc->realize = aspeed_i2c_bus_realize;\n+ dc->unrealize = aspeed_i2c_bus_unrealize;\n device_class_set_legacy_reset(dc, aspeed_i2c_bus_reset);\n device_class_set_props(dc, aspeed_i2c_bus_properties);\n }\n", "prefixes": [ "v1" ] }