diff options
| author | Prasad J Pandit <pjp@fedoraproject.org> | 2020-06-04 17:05:25 +0530 |
|---|---|---|
| committer | Michael S. Tsirkin <mst@redhat.com> | 2020-06-09 14:18:04 -0400 |
| commit | f7d6a635fa3b7797f9d072e280f065bf3cfcd24d (patch) | |
| tree | 9e43e03f7f27fbda33da15a70a0bc8a74e69094b | |
| parent | 0dabc0f6544f2c0310546f6d6cf3b68979580a9c (diff) | |
| download | qemu-f7d6a635fa3b7797f9d072e280f065bf3cfcd24d.zip | |
pci: assert configuration access is within bounds
While accessing PCI configuration bytes, assert that
'address + len' is within PCI configuration space.
Generally it is within bounds. This is more of a defensive
assert, in case a buggy device was to send 'address' which
may go out of bounds.
Suggested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Message-Id: <20200604113525.58898-1-ppandit@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| -rw-r--r-- | hw/pci/pci.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/hw/pci/pci.c b/hw/pci/pci.c index 70c66965f5..7bf2ae6d92 100644 --- a/hw/pci/pci.c +++ b/hw/pci/pci.c @@ -1381,6 +1381,8 @@ uint32_t pci_default_read_config(PCIDevice *d, { uint32_t val = 0; + assert(address + len <= pci_config_size(d)); + if (pci_is_express_downstream_port(d) && ranges_overlap(address, len, d->exp.exp_cap + PCI_EXP_LNKSTA, 2)) { pcie_sync_bridge_lnk(d); @@ -1394,6 +1396,8 @@ void pci_default_write_config(PCIDevice *d, uint32_t addr, uint32_t val_in, int int i, was_irq_disabled = pci_irq_disabled(d); uint32_t val = val_in; + assert(addr + l <= pci_config_size(d)); + for (i = 0; i < l; val >>= 8, ++i) { uint8_t wmask = d->wmask[addr + i]; uint8_t w1cmask = d->w1cmask[addr + i]; |