[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-ppc] [PATCH 21/31] openpic: add some bounds checking for IRQ numbe
From: |
Alexander Graf |
Subject: |
[Qemu-ppc] [PATCH 21/31] openpic: add some bounds checking for IRQ numbers |
Date: |
Mon, 7 Jan 2013 16:38:50 +0100 |
From: Scott Wood <address@hidden>
The two checks with abort() guard against potential QEMU-internal
problems, but the EOI check stops the guest from causing updates to queue
position -1 and other havoc if it writes EOI with no interrupt in
service.
Signed-off-by: Scott Wood <address@hidden>
[agraf: remove hunk in code that didn't get applied yet]
Signed-off-by: Alexander Graf <address@hidden>
---
hw/openpic.c | 11 +++++++++++
1 files changed, 11 insertions(+), 0 deletions(-)
diff --git a/hw/openpic.c b/hw/openpic.c
index b54308d..35a7fe3 100644
--- a/hw/openpic.c
+++ b/hw/openpic.c
@@ -414,6 +414,11 @@ static void openpic_set_irq(void *opaque, int n_IRQ, int
level)
OpenPICState *opp = opaque;
IRQSource *src;
+ if (n_IRQ >= MAX_IRQ) {
+ fprintf(stderr, "%s: IRQ %d out of range\n", __func__, n_IRQ);
+ abort();
+ }
+
src = &opp->src[n_IRQ];
DPRINTF("openpic: set irq %d = %d ivpr=0x%08x\n",
n_IRQ, level, src->ivpr);
@@ -888,6 +893,12 @@ static void openpic_cpu_write_internal(void *opaque,
hwaddr addr,
case 0xB0: /* EOI */
DPRINTF("EOI\n");
s_IRQ = IRQ_get_next(opp, &dst->servicing);
+
+ if (s_IRQ < 0) {
+ DPRINTF("%s: EOI with no interrupt in service\n", __func__);
+ break;
+ }
+
IRQ_resetbit(&dst->servicing, s_IRQ);
/* Set up next servicing IRQ */
s_IRQ = IRQ_get_next(opp, &dst->servicing);
--
1.6.0.2
- [Qemu-ppc] [PATCH 02/31] openpic: remove pcsr (CPU sensitivity register), (continued)
- [Qemu-ppc] [PATCH 02/31] openpic: remove pcsr (CPU sensitivity register), Alexander Graf, 2013/01/07
- [Qemu-ppc] [PATCH 06/31] openpic: don't crash on a register access without a CPU context, Alexander Graf, 2013/01/07
- [Qemu-ppc] [PATCH 04/31] openpic: BRR1 is not a CPU-specific register., Alexander Graf, 2013/01/07
- [Qemu-ppc] [PATCH 10/31] PPC: fix segfault in signal handling code, Alexander Graf, 2013/01/07
- [Qemu-ppc] [PATCH 07/31] powerpc: linux header sync script includes epapr_hcalls.h, Alexander Graf, 2013/01/07
- [Qemu-ppc] [PATCH 03/31] openpic: support large vectors on FSL mpic, Alexander Graf, 2013/01/07
- [Qemu-ppc] [PATCH 08/31] openpic: fix coding style issues, Alexander Graf, 2013/01/07
- [Qemu-ppc] [PATCH 18/31] openpic: always call IRQ_check from IRQ_get_next, Alexander Graf, 2013/01/07
- [Qemu-ppc] [PATCH 19/31] Revert "openpic: Accelerate pending irq search", Alexander Graf, 2013/01/07
- [Qemu-ppc] [PATCH 23/31] openpic: IRQ_check: search the queue a word at a time, Alexander Graf, 2013/01/07
- [Qemu-ppc] [PATCH 21/31] openpic: add some bounds checking for IRQ numbers,
Alexander Graf <=
- [Qemu-ppc] [PATCH 29/31] target-ppc: Slim conversion of model definitions to QOM subclasses, Alexander Graf, 2013/01/07
- [Qemu-ppc] [PATCH 31/31] PPC: linux-user: Calculate context pointer explicitly, Alexander Graf, 2013/01/07
- [Qemu-ppc] [PATCH 26/31] kvm: Update kernel headers, Alexander Graf, 2013/01/07
- [Qemu-ppc] [PATCH 09/31] PPC: Reset qemu timers when guest reset, Alexander Graf, 2013/01/07
- [Qemu-ppc] [PATCH 01/31] openpic: symbolicize some magic numbers, Alexander Graf, 2013/01/07
- Re: [Qemu-ppc] [Qemu-devel] [PULL 00/31] ppc patch queue 2013-01-07, Andreas Färber, 2013/01/07