From 9a93b2fa0ed8de66a9deb9106ce5ddc2a65d68f0 Mon Sep 17 00:00:00 2001 From: Prasad J Pandit Date: Tue, 30 Oct 2018 15:23:56 +0000 Subject: [PATCH] strongarm: mask off high[31:28] bits from dir and state registers The high[31:28] bits of 'direction' and 'state' registers of SA-1100/SA-1110 device are reserved. Setting them may lead to OOB 's->handler[]' array access issue. Mask off [31:28] bits to avoid it. Reported-by: Moguofang Signed-off-by: Prasad J Pandit Message-id: 20181030114635.31232-1-ppandit@redhat.com Reviewed-by: Peter Maydell Signed-off-by: Peter Maydell --- hw/arm/strongarm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hw/arm/strongarm.c b/hw/arm/strongarm.c index ec2627374d..644a9c45b4 100644 --- a/hw/arm/strongarm.c +++ b/hw/arm/strongarm.c @@ -587,12 +587,12 @@ static void strongarm_gpio_write(void *opaque, hwaddr offset, switch (offset) { case GPDR: /* GPIO Pin-Direction registers */ - s->dir = value; + s->dir = value & 0x0fffffff; strongarm_gpio_handler_update(s); break; case GPSR: /* GPIO Pin-Output Set registers */ - s->olevel |= value; + s->olevel |= value & 0x0fffffff; strongarm_gpio_handler_update(s); break;