From patchwork Mon Jan 7 15:38:50 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alexander Graf X-Patchwork-Id: 209983 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id BFAB92C0085 for ; Tue, 8 Jan 2013 03:43:49 +1100 (EST) Received: from localhost ([::1]:48440 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TsFnf-00043A-Tw for incoming@patchwork.ozlabs.org; Mon, 07 Jan 2013 11:43:47 -0500 Received: from eggs.gnu.org ([208.118.235.92]:41188) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TsEnO-00055m-Ul for qemu-devel@nongnu.org; Mon, 07 Jan 2013 10:39:32 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1TsEnI-0007BT-4K for qemu-devel@nongnu.org; Mon, 07 Jan 2013 10:39:26 -0500 Received: from cantor2.suse.de ([195.135.220.15]:39914 helo=mx2.suse.de) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TsEnH-0007BI-U0; Mon, 07 Jan 2013 10:39:20 -0500 Received: from relay1.suse.de (unknown [195.135.220.254]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mx2.suse.de (Postfix) with ESMTP id 238C2A51F5; Mon, 7 Jan 2013 16:39:19 +0100 (CET) From: Alexander Graf To: qemu-devel@nongnu.org Date: Mon, 7 Jan 2013 16:38:50 +0100 Message-Id: <1357573140-8877-22-git-send-email-agraf@suse.de> X-Mailer: git-send-email 1.6.0.2 In-Reply-To: <1357573140-8877-1-git-send-email-agraf@suse.de> References: <1357573140-8877-1-git-send-email-agraf@suse.de> X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.4.x X-Received-From: 195.135.220.15 Cc: Blue Swirl , Scott Wood , qemu-ppc@nongnu.org, Aurelien Jarno Subject: [Qemu-devel] [PATCH 21/31] openpic: add some bounds checking for IRQ numbers X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org From: Scott Wood The two checks with abort() guard against potential QEMU-internal problems, but the EOI check stops the guest from causing updates to queue position -1 and other havoc if it writes EOI with no interrupt in service. Signed-off-by: Scott Wood [agraf: remove hunk in code that didn't get applied yet] Signed-off-by: Alexander Graf --- hw/openpic.c | 11 +++++++++++ 1 files changed, 11 insertions(+), 0 deletions(-) diff --git a/hw/openpic.c b/hw/openpic.c index b54308d..35a7fe3 100644 --- a/hw/openpic.c +++ b/hw/openpic.c @@ -414,6 +414,11 @@ static void openpic_set_irq(void *opaque, int n_IRQ, int level) OpenPICState *opp = opaque; IRQSource *src; + if (n_IRQ >= MAX_IRQ) { + fprintf(stderr, "%s: IRQ %d out of range\n", __func__, n_IRQ); + abort(); + } + src = &opp->src[n_IRQ]; DPRINTF("openpic: set irq %d = %d ivpr=0x%08x\n", n_IRQ, level, src->ivpr); @@ -888,6 +893,12 @@ static void openpic_cpu_write_internal(void *opaque, hwaddr addr, case 0xB0: /* EOI */ DPRINTF("EOI\n"); s_IRQ = IRQ_get_next(opp, &dst->servicing); + + if (s_IRQ < 0) { + DPRINTF("%s: EOI with no interrupt in service\n", __func__); + break; + } + IRQ_resetbit(&dst->servicing, s_IRQ); /* Set up next servicing IRQ */ s_IRQ = IRQ_get_next(opp, &dst->servicing);