[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH v2] ppc/pnv: Fix potential overflow in I2C model
From: |
Cédric Le Goater |
Subject: |
[PATCH v2] ppc/pnv: Fix potential overflow in I2C model |
Date: |
Thu, 9 Nov 2023 18:15:25 +0100 |
Coverity warns that "i2c_bus_busy(i2c->busses[i]) << i" might overflow
because the expression is evaluated using 32-bit arithmetic and then
used in a context expecting a uint64_t.
While we are at it, introduce a PNV_I2C_MAX_BUSSES constant and check
the number of busses at realize time.
Fixes: Coverity CID 1523918
Cc: Glenn Miles <milesg@linux.vnet.ibm.com>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
v2: - check PNV_I2C_MAX_BUSSES in realize
- removed extra space before cast.
hw/ppc/pnv_i2c.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/hw/ppc/pnv_i2c.c b/hw/ppc/pnv_i2c.c
index f75e59e70977..483d91d15a77 100644
--- a/hw/ppc/pnv_i2c.c
+++ b/hw/ppc/pnv_i2c.c
@@ -151,6 +151,7 @@
#define I2C_RESET_S_SDA_REG 0x11
#define PNV_I2C_FIFO_SIZE 8
+#define PNV_I2C_MAX_BUSSES 64
static I2CBus *pnv_i2c_get_bus(PnvI2C *i2c)
{
@@ -437,7 +438,7 @@ static uint64_t pnv_i2c_xscom_read(void *opaque, hwaddr
addr,
case I2C_PORT_BUSY_REG: /* compute busy bit for each port */
val = 0;
for (i = 0; i < i2c->num_busses; i++) {
- val |= i2c_bus_busy(i2c->busses[i]) << i;
+ val |= (uint64_t)i2c_bus_busy(i2c->busses[i]) << i;
}
break;
@@ -641,6 +642,11 @@ static void pnv_i2c_realize(DeviceState *dev, Error **errp)
assert(i2c->chip);
+ if (i2c->num_busses > PNV_I2C_MAX_BUSSES) {
+ error_setg(errp, "Invalid number of busses: %u", i2c->num_busses);
+ return;
+ }
+
pnv_xscom_region_init(&i2c->xscom_regs, OBJECT(i2c), &pnv_i2c_xscom_ops,
i2c, "xscom-i2c", PNV9_XSCOM_I2CM_SIZE);
--
2.41.0
- [PATCH v2] ppc/pnv: Fix potential overflow in I2C model,
Cédric Le Goater <=