diff mbox series

[PATCH-for-5.2,2/2] hw/core/sysbus: Assert memory region index is in range

Message ID 20200806130945.21629-3-f4bug@amsat.org (mailing list archive)
State New, archived
Headers show
Series hw/core/sysbus: Trivial cleanup patches | expand

Commit Message

Philippe Mathieu-Daudé Aug. 6, 2020, 1:09 p.m. UTC 
Devices incorrectly modelled might use invalid index while
calling sysbus_mmio_get_region(), leading to OOB access.
Help developers by asserting the index is in range.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
 hw/core/sysbus.c | 1 +
 1 file changed, 1 insertion(+)

Comments

Richard Henderson Aug. 12, 2020, 5:48 p.m. UTC | #1 
On 8/6/20 6:09 AM, Philippe Mathieu-Daudé wrote:
> Devices incorrectly modelled might use invalid index while
> calling sysbus_mmio_get_region(), leading to OOB access.
> Help developers by asserting the index is in range.
> 
> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
> ---
>  hw/core/sysbus.c | 1 +
>  1 file changed, 1 insertion(+)

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>


r~
Laurent Vivier Sept. 1, 2020, 7:28 a.m. UTC | #2 
Le 06/08/2020 à 15:09, Philippe Mathieu-Daudé a écrit :
> Devices incorrectly modelled might use invalid index while
> calling sysbus_mmio_get_region(), leading to OOB access.
> Help developers by asserting the index is in range.
> 
> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
> ---
>  hw/core/sysbus.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/hw/core/sysbus.c b/hw/core/sysbus.c
> index 77ab351ce1..294f90b7de 100644
> --- a/hw/core/sysbus.c
> +++ b/hw/core/sysbus.c
> @@ -199,6 +199,7 @@ void sysbus_init_mmio(SysBusDevice *dev, MemoryRegion *memory)
>  
>  MemoryRegion *sysbus_mmio_get_region(SysBusDevice *dev, int n)
>  {
> +    assert(n >= 0 && n < QDEV_MAX_MMIO);
>      return dev->mmio[n].memory;
>  }
>  
> 

Applied to my trivial-patches branch.

Thanks,
Laurent
diff mbox series

Patch

diff --git a/hw/core/sysbus.c b/hw/core/sysbus.c
index 77ab351ce1..294f90b7de 100644
--- a/hw/core/sysbus.c
+++ b/hw/core/sysbus.c
@@ -199,6 +199,7 @@  void sysbus_init_mmio(SysBusDevice *dev, MemoryRegion *memory)
 
 MemoryRegion *sysbus_mmio_get_region(SysBusDevice *dev, int n)
 {
+    assert(n >= 0 && n < QDEV_MAX_MMIO);
     return dev->mmio[n].memory;
 }