Patchwork hw/omap_intc.c: Avoid crash on access to nonexistent banked registers

login
register
mail settings
Submitter Peter Maydell
Date Nov. 9, 2011, 6:45 p.m.
Message ID <1320864338-9702-1-git-send-email-peter.maydell@linaro.org>
Download mbox | patch
Permalink /patch/124656/
State New
Headers show

Comments

Peter Maydell - Nov. 9, 2011, 6:45 p.m.
Avoid a crash due to null pointer dereference if a guest attempts
to access banked registers for a nonexistent bank. Spotted by
Coverity (see bug 887883).

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/omap_intc.c |    6 ++++++
 1 files changed, 6 insertions(+), 0 deletions(-)
Anthony Liguori - Nov. 11, 2011, 7:44 p.m.
On 11/09/2011 12:45 PM, Peter Maydell wrote:
> Avoid a crash due to null pointer dereference if a guest attempts
> to access banked registers for a nonexistent bank. Spotted by
> Coverity (see bug 887883).
>
> Signed-off-by: Peter Maydell<peter.maydell@linaro.org>

Applied.  Thanks.

Regards,

Anthony Liguori

> ---
>   hw/omap_intc.c |    6 ++++++
>   1 files changed, 6 insertions(+), 0 deletions(-)
>
> diff --git a/hw/omap_intc.c b/hw/omap_intc.c
> index 0f7fd9d..45efa25 100644
> --- a/hw/omap_intc.c
> +++ b/hw/omap_intc.c
> @@ -398,6 +398,9 @@ static uint64_t omap2_inth_read(void *opaque, target_phys_addr_t addr,
>           if (bank_no<  s->nbanks) {
>               offset&= ~0x60;
>               bank =&s->bank[bank_no];
> +        } else {
> +            OMAP_BAD_REG(addr);
> +            return 0;
>           }
>       }
>
> @@ -476,6 +479,9 @@ static void omap2_inth_write(void *opaque, target_phys_addr_t addr,
>           if (bank_no<  s->nbanks) {
>               offset&= ~0x60;
>               bank =&s->bank[bank_no];
> +        } else {
> +            OMAP_BAD_REG(addr);
> +            return;
>           }
>       }
>

Patch

diff --git a/hw/omap_intc.c b/hw/omap_intc.c
index 0f7fd9d..45efa25 100644
--- a/hw/omap_intc.c
+++ b/hw/omap_intc.c
@@ -398,6 +398,9 @@  static uint64_t omap2_inth_read(void *opaque, target_phys_addr_t addr,
         if (bank_no < s->nbanks) {
             offset &= ~0x60;
             bank = &s->bank[bank_no];
+        } else {
+            OMAP_BAD_REG(addr);
+            return 0;
         }
     }
 
@@ -476,6 +479,9 @@  static void omap2_inth_write(void *opaque, target_phys_addr_t addr,
         if (bank_no < s->nbanks) {
             offset &= ~0x60;
             bank = &s->bank[bank_no];
+        } else {
+            OMAP_BAD_REG(addr);
+            return;
         }
     }