[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 01/29] hw/ssi/imx_spi: changed while statement to prevent underflo
From: |
Peter Maydell |
Subject: |
[PULL 01/29] hw/ssi/imx_spi: changed while statement to prevent underflow |
Date: |
Fri, 5 Jun 2020 17:49:39 +0100 |
From: Eden Mikitas <e.mikitas@gmail.com>
The while statement in question only checked if tx_burst is not 0.
tx_burst is a signed int, which is assigned the value put by the
guest driver in ECSPI_CONREG. The burst length can be anywhere
between 1 and 4096, and since tx_burst is always decremented by 8
it could possibly underflow, causing an infinite loop.
Signed-off-by: Eden Mikitas <e.mikitas@gmail.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
hw/ssi/imx_spi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/ssi/imx_spi.c b/hw/ssi/imx_spi.c
index 2dd9a631e12..6fef5c79588 100644
--- a/hw/ssi/imx_spi.c
+++ b/hw/ssi/imx_spi.c
@@ -182,7 +182,7 @@ static void imx_spi_flush_txfifo(IMXSPIState *s)
rx = 0;
- while (tx_burst) {
+ while (tx_burst > 0) {
uint8_t byte = tx & 0xff;
DPRINTF("writing 0x%02x\n", (uint32_t)byte);
--
2.20.1
- [PULL 00/29] target-arm queue, Peter Maydell, 2020/06/05
- [PULL 01/29] hw/ssi/imx_spi: changed while statement to prevent underflow,
Peter Maydell <=
- [PULL 02/29] hw/ssi/imx_spi: Removed unnecessary cast of rx data received from slave, Peter Maydell, 2020/06/05
- [PULL 03/29] hw/input/pxa2xx_keypad: Replace hw_error() by qemu_log_mask(), Peter Maydell, 2020/06/05
- [PULL 04/29] hw/arm/pxa2xx: Replace printf() call by qemu_log_mask(), Peter Maydell, 2020/06/05
- [PULL 06/29] target/arm: Convert rax1 to gvec helpers, Peter Maydell, 2020/06/05
- [PULL 05/29] target/arm: Convert aes and sm4 to gvec helpers, Peter Maydell, 2020/06/05
- [PULL 07/29] target/arm: Convert sha512 and sm3 to gvec helpers, Peter Maydell, 2020/06/05
- [PULL 08/29] target/arm: Convert sha1 and sha256 to gvec helpers, Peter Maydell, 2020/06/05
- [PULL 09/29] target/arm: Split helper_crypto_sha1_3reg, Peter Maydell, 2020/06/05
- [PULL 11/29] hw/adc/stm32f2xx_adc: Correct memory region size and access size, Peter Maydell, 2020/06/05
- [PULL 13/29] docs/system: Document Aspeed boards, Peter Maydell, 2020/06/05