izzy/xemu
0
0
Fork 0
mirror of https://github.com/izzy2lost/xemu.git synced 2026-07-06 00:20:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

ppc/pnv: ADU fix possible buffer overrun with invalid size

Browse Source 
The ADU LPC transfer-size field is 7 bits, but the supported sizes for
LPC access via ADU appear to be 1, 2, 4, 8. The data buffer could
overrun if firmware set an invalid size field, so add checks to reject
them with a message.

Cc: qemu-stable@nongnu.org
Reported-by: Cédric Le Goater <clg@redhat.com>
Resolves: Coverity CID 1558830
Fixes: 24bd283bcc ("ppc/pnv: Implement ADU access to LPC space")
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
This commit is contained in:
Nicholas Piggin
2024-11-04 09:08:58 +10:00
parent fdd9cf281d
commit ddd2a060a0
1 changed files with 12 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hw/ppc/pnv_adu.c
+12
View File
@@ -116,6 +116,12 @@ static void pnv_adu_xscom_write(void *opaque, hwaddr addr, uint64_t val,
uint32_t lpc_size = lpc_cmd_size(adu);
uint64_t data = 0;
if (!is_power_of_2(lpc_size) || lpc_size > sizeof(data)) {
qemu_log_mask(LOG_GUEST_ERROR, "ADU: Unsupported LPC access "
"size:%" PRId32 "\n", lpc_size);
break;
}
pnv_lpc_opb_read(adu->lpc, lpc_addr, (void *)&data, lpc_size);
/*
@@ -135,6 +141,12 @@ static void pnv_adu_xscom_write(void *opaque, hwaddr addr, uint64_t val,
uint32_t lpc_size = lpc_cmd_size(adu);
uint64_t data;
if (!is_power_of_2(lpc_size) || lpc_size > sizeof(data)) {
qemu_log_mask(LOG_GUEST_ERROR, "ADU: Unsupported LPC access "
"size:%" PRId32 "\n", lpc_size);
break;
}
data = cpu_to_be64(val) >> ((lpc_addr & 7) * 8); /* See above */
pnv_lpc_opb_write(adu->lpc, lpc_addr, (void *)&data, lpc_size);
}