mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
qemu/hw/misc
History
Peter Maydell 32f1c201ee hw/misc/bcm2835_property: Avoid overflow in OTP access properties 
Coverity points out that in our handling of the property
RPI_FWREQ_SET_CUSTOMER_OTP we have a potential overflow.  This
happens because we read start_num and number from the guest as
unsigned 32 bit integers, but then the variable 'n' we use as a loop
counter as we iterate from start_num to start_num + number is only an
"int".  That means that if the guest passes us a very large start_num
we will interpret it as negative.  This will result in an assertion
failure inside bcm2835_otp_set_row(), which checks that we didn't
pass it an invalid row number.

A similar issue applies to all the properties for accessing OTP rows
where we are iterating through with a start and length read from the
guest.

Use uint32_t for the loop counter to avoid this problem. Because in
all cases 'n' is only used as a loop counter, we can do this as
part of the for(), restricting its scope to exactly where we need it.

Resolves: Coverity CID 1549401
Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20240723131029.1159908-3-peter.maydell@linaro.org
2024-07-29 16:55:59 +01:00
..
macio
hw, target: Add ResetType argument to hold and exit phase methods
2024-04-25 10:21:06 +01:00
a9scu.c
hw/misc: Constify VMState
2023-12-30 07:38:06 +11:00
allwinner-a10-ccm.c
hw/misc: Constify VMState
2023-12-30 07:38:06 +11:00
allwinner-a10-dramc.c
hw/misc: Constify VMState
2023-12-30 07:38:06 +11:00
allwinner-cpucfg.c
hw/misc: Constify VMState
2023-12-30 07:38:06 +11:00
allwinner-h3-ccu.c
hw/misc: Constify VMState
2023-12-30 07:38:06 +11:00
allwinner-h3-dramc.c
hw/misc: Constify VMState
2023-12-30 07:38:06 +11:00
allwinner-h3-sysctrl.c
hw/misc: Constify VMState
2023-12-30 07:38:06 +11:00
allwinner-r40-ccu.c
hw/misc: Constify VMState
2023-12-30 07:38:06 +11:00
allwinner-r40-dramc.c
hw/misc: Constify VMState
2023-12-30 07:38:06 +11:00
allwinner-sid.c
hw/misc: Constify VMState
2023-12-30 07:38:06 +11:00
allwinner-sramc.c
hw/misc: Constify VMState
2023-12-30 07:38:06 +11:00
applesmc.c
hw/misc/applesmc: Simplify DeviceReset handler
2024-04-25 12:48:12 +02:00
arm11scu.c
…
arm_integrator_debug.c
arm: Update infocenter.arm.com URLs
2021-02-11 11:50:14 +00:00
arm_l2x0.c
hw/misc: Constify VMState
2023-12-30 07:38:06 +11:00
arm_sysctl.c
hw/misc: Constify VMState
2023-12-30 07:38:06 +11:00
armsse-cpu-pwrctrl.c
hw/misc: Constify VMState
2023-12-30 07:38:06 +11:00
armsse-cpuid.c
hw/arm/mps2: Update old infocenter.arm.com URLs
2021-03-08 11:54:16 +00:00
armsse-mhu.c
hw/misc: Constify VMState
2023-12-30 07:38:06 +11:00
armv7m_ras.c
arm: Move M-profile RAS register block into its own device
2021-09-01 11:08:18 +01:00
aspeed_hace.c
hw/misc: Constify VMState
2023-12-30 07:38:06 +11:00
aspeed_i3c.c
hw/misc: Constify VMState
2023-12-30 07:38:06 +11:00
aspeed_lpc.c
hw/misc: Constify VMState
2023-12-30 07:38:06 +11:00
aspeed_peci.c
hw/misc/aspeed: Add PECI controller
2022-06-30 09:21:14 +02:00
aspeed_sbc.c
hw/misc: Constify VMState
2023-12-30 07:38:06 +11:00
aspeed_scu.c
aspeed/scu: Add AST2700 support
2024-06-16 21:08:54 +02:00
aspeed_sdmc.c
aspeed/sdmc: Remove extra R_MAIN_STATUS case
2024-07-02 07:52:43 +02:00
aspeed_sli.c
aspeed/sli: Add AST2700 support
2024-06-16 21:08:54 +02:00
aspeed_xdma.c
hw/misc: Constify VMState
2023-12-30 07:38:06 +11:00
auxbus.c
bulk: Rename TARGET_FMT_plx -> HWADDR_FMT_plx
2023-01-18 11:14:34 +01:00
avr_power.c
…
axp2xx.c
hw/misc: Constify VMState
2023-12-30 07:38:06 +11:00
bcm2835_cprman.c
hw/misc: Constify VMState
2023-12-30 07:38:06 +11:00
bcm2835_mbox.c
hw/misc: Constify VMState
2023-12-30 07:38:06 +11:00
bcm2835_mphi.c
hw/misc: Constify VMState
2023-12-30 07:38:06 +11:00
bcm2835_powermgt.c
hw/misc: Constify VMState
2023-12-30 07:38:06 +11:00
bcm2835_property.c
hw/misc/bcm2835_property: Avoid overflow in OTP access properties
2024-07-29 16:55:59 +01:00
bcm2835_rng.c
hw/misc: Constify VMState
2023-12-30 07:38:06 +11:00
bcm2835_thermal.c
hw/misc/bcm2835_thermal: Fix access size handling in bcm2835_thermal_ops
2024-07-11 11:41:33 +01:00
cbus.c
Drop useless casts from g_malloc() & friends to pointer
2022-10-22 23:15:40 +02:00
debugexit.c
hw/misc/debugexit: use runstate API instead of plain exit()
2024-06-04 11:53:43 +02:00
djmemc.c
hw, target: Add ResetType argument to hold and exit phase methods
2024-04-25 10:21:06 +01:00
eccmemctl.c
hw/misc: Constify VMState
2023-12-30 07:38:06 +11:00
edu.c
Remove inclusion of hw/hw.h from files that don't need it
2024-07-02 06:58:48 +02:00
empty_slot.c
Use OBJECT_DECLARE_SIMPLE_TYPE when possible
2020-09-18 14:12:32 -04:00
exynos4210_clk.c
hw/misc: Constify VMState
2023-12-30 07:38:06 +11:00
exynos4210_pmu.c
hw/misc: Constify VMState
2023-12-30 07:38:06 +11:00
exynos4210_rng.c
hw/misc: Set valid access size for Exynos4210 RNG
2024-06-21 16:20:45 +01:00
grlib_ahb_apb_pnp.c
hw/misc/grlib_ahb_apb_pnp: Support 8 and 16 bit accesses
2022-08-08 23:43:11 +02:00
i2c-echo.c
hw/misc/i2c-echo: add copyright/license note
2023-10-12 14:11:44 +02:00
imx6_ccm.c
hw/misc/imx: Replace sprintf() by snprintf()
2024-04-25 12:48:12 +02:00
imx6_src.c
hw/misc/imx: Replace sprintf() by snprintf()
2024-04-25 12:48:12 +02:00
imx6ul_ccm.c
hw/misc/imx: Replace sprintf() by snprintf()
2024-04-25 12:48:12 +02:00
imx7_ccm.c
hw/misc: Constify VMState
2023-12-30 07:38:06 +11:00
imx7_gpr.c
…
imx7_snvs.c
hw/misc: Constify VMState
2023-12-30 07:38:06 +11:00
imx7_src.c
hw/misc/imx: Replace sprintf() by snprintf()
2024-04-25 12:48:12 +02:00
imx25_ccm.c
hw/misc/imx: Replace sprintf() by snprintf()
2024-04-25 12:48:12 +02:00
imx31_ccm.c
hw/misc/imx: Replace sprintf() by snprintf()
2024-04-25 12:48:12 +02:00
imx_ccm.c
hw: Do not include qemu/log.h if it is not necessary
2021-05-02 17:24:50 +02:00
imx_rngc.c
hw/misc: Constify VMState
2023-12-30 07:38:06 +11:00
iosb.c
hw, target: Add ResetType argument to hold and exit phase methods
2024-04-25 10:21:06 +01:00
iotkit-secctl.c
hw/misc: Constify VMState
2023-12-30 07:38:06 +11:00
iotkit-sysctl.c
hw/misc: Constify VMState
2023-12-30 07:38:06 +11:00
iotkit-sysinfo.c
hw/misc/iotkit-sysinfo.c: Implement SYS_CONFIG1 and IIDR
2021-03-08 17:20:01 +00:00
ivshmem.c
hw/misc/ivshmem: Fix missing ERRP_GUARD() for error_prepend()
2024-03-11 22:10:18 +01:00
Kconfig
hw/misc/stm32l4x5_rcc: Implement STM32L4x5_RCC skeleton
2024-03-05 13:22:55 +00:00
lasi.c
lasi: Add reset I/O ports for LASI audio and FDC
2024-02-11 13:20:23 +01:00
led.c
hw/misc: Constify VMState
2023-12-30 07:38:06 +11:00
mac_via.c
hw, target: Add ResetType argument to hold and exit phase methods
2024-04-25 10:21:06 +01:00
mchp_pfsoc_dmc.c
hw: Remove superfluous includes of hw/hw.h
2021-05-02 17:24:50 +02:00
mchp_pfsoc_ioscb.c
hw/{misc, riscv}: pfsoc: add system controller as unimplemented
2023-01-06 10:42:55 +10:00
mchp_pfsoc_sysreg.c
hw/{misc, riscv}: pfsoc: add system controller as unimplemented
2023-01-06 10:42:55 +10:00
meson.build
aspeed/sli: Add AST2700 support
2024-06-16 21:08:54 +02:00
mips_cmgcr.c
hw/misc: Constify VMState
2023-12-30 07:38:06 +11:00
mips_cpc.c
hw/misc: Constify VMState
2023-12-30 07:38:06 +11:00
mips_itu.c
hw/misc/mips_itu: Remove MIPSITUState::saar field
2024-02-15 15:53:12 +01:00
mos6522.c
hw, target: Add ResetType argument to hold and exit phase methods
2024-04-25 10:21:06 +01:00
mps2-fpgaio.c
hw/misc: Constify VMState
2023-12-30 07:38:06 +11:00
mps2-scc.c
hw/misc/mps2-scc: Make changes needed for AN536 FPGA image
2024-02-15 14:32:38 +00:00
msf2-sysreg.c
hw/misc: Constify VMState
2023-12-30 07:38:06 +11:00
mst_fpga.c
hw/misc: Constify VMState
2023-12-30 07:38:06 +11:00
npcm7xx_clk.c
hw/misc: Don't special case RESET_TYPE_COLD in npcm7xx_clk, gcr
2024-04-25 10:21:06 +01:00
npcm7xx_gcr.c
hw/misc: Don't special case RESET_TYPE_COLD in npcm7xx_clk, gcr
2024-04-25 10:21:06 +01:00
npcm7xx_mft.c
hw, target: Add ResetType argument to hold and exit phase methods
2024-04-25 10:21:06 +01:00
npcm7xx_pwm.c
hw, target: Add ResetType argument to hold and exit phase methods
2024-04-25 10:21:06 +01:00
npcm7xx_rng.c
hw/misc: Constify VMState
2023-12-30 07:38:06 +11:00
nrf51_rng.c
hw/misc: Constify VMState
2023-12-30 07:38:06 +11:00
omap_clk.c
…
omap_gpmc.c
hw/arm/omap: Drop useless casts from void * to pointer
2023-01-12 17:15:09 +00:00
omap_l4.c
hw/arm/omap: Drop useless casts from void * to pointer
2023-01-12 17:15:09 +00:00
omap_sdrc.c
hw/arm/omap: Drop useless casts from void * to pointer
2023-01-12 17:15:09 +00:00
omap_tap.c
hw/arm/omap: Drop useless casts from void * to pointer
2023-01-12 17:15:09 +00:00
pc-testdev.c
Use OBJECT_DECLARE_SIMPLE_TYPE when possible
2020-09-18 14:12:32 -04:00
pci-testdev.c
kvm: require KVM_CAP_IOEVENTFD and KVM_CAP_IOEVENTFD_ANY_LENGTH
2023-10-25 17:35:15 +02:00
pvpanic-isa.c
hw/misc/pvpanic: centralize definition of supported events
2024-07-01 17:16:04 -04:00
pvpanic-pci.c
hw/misc/pvpanic: centralize definition of supported events
2024-07-01 17:16:04 -04:00
pvpanic.c
hw/misc/pvpanic: add support for normal shutdowns
2024-07-01 17:16:04 -04:00
sbsa_ec.c
hw/misc/sbsa_ec: Declare QOM macros using OBJECT_DECLARE_SIMPLE_TYPE()
2023-01-12 17:15:09 +00:00
sifive_e_aon.c
hw/misc: sifive_e_aon: Support the watchdog timer of HiFive 1 rev b.
2023-07-10 22:29:14 +10:00
sifive_e_prci.c
hw: Remove superfluous includes of hw/hw.h
2021-05-02 17:24:50 +02:00
sifive_test.c
hw/misc/sifive_test.c: replace exit calls with proper shutdown
2023-10-12 12:34:30 +10:00
sifive_u_otp.c
hw/misc/sifive_u_otp: Remove the deprecated OTP config with '-drive if=none'
2023-01-26 13:25:07 +01:00
sifive_u_prci.c
hw/riscv: Move sifive_u_prci model to hw/misc
2020-09-09 15:54:19 -07:00
slavio_misc.c
hw/misc: Constify VMState
2023-12-30 07:38:06 +11:00
stm32f2xx_syscfg.c
hw/other: spelling fixes
2023-09-21 11:31:16 +03:00
stm32f4xx_exti.c
hw/misc: Constify VMState
2023-12-30 07:38:06 +11:00
stm32f4xx_syscfg.c
hw/misc: Constify VMState
2023-12-30 07:38:06 +11:00
stm32l4x5_exti.c
hw/misc: In STM32L4x5 EXTI, handle direct interrupts
2024-07-11 11:41:34 +01:00
stm32l4x5_rcc.c
hw, target: Add ResetType argument to hold and exit phase methods
2024-04-25 10:21:06 +01:00
stm32l4x5_syscfg.c
hw, target: Add ResetType argument to hold and exit phase methods
2024-04-25 10:21:06 +01:00
trace-events
aspeed/scu: Add AST2700 support
2024-06-16 21:08:54 +02:00
trace.h
…
tz-mpc.c
hw/misc: Constify VMState
2023-12-30 07:38:06 +11:00
tz-msc.c
hw/misc: Constify VMState
2023-12-30 07:38:06 +11:00
tz-ppc.c
hw/misc: Constify VMState
2023-12-30 07:38:06 +11:00
unimp.c
hw/misc/unimp: Display the offset with width of the region size
2020-08-28 10:02:46 +01:00
virt_ctrl.c
hw/misc: Constify VMState
2023-12-30 07:38:06 +11:00
vmcoreinfo.c
hw/misc: Constify VMState
2023-12-30 07:38:06 +11:00
xlnx-cfi-if.c
hw/misc: Introduce the Xilinx CFI interface
2023-09-08 16:41:34 +01:00
xlnx-versal-cframe-reg.c
hw, target: Add ResetType argument to hold and exit phase methods
2024-04-25 10:21:06 +01:00
xlnx-versal-cfu.c
hw/misc: Constify VMState
2023-12-30 07:38:06 +11:00
xlnx-versal-crl.c
hw, target: Add ResetType argument to hold and exit phase methods
2024-04-25 10:21:06 +01:00
xlnx-versal-pmc-iou-slcr.c
hw, target: Add ResetType argument to hold and exit phase methods
2024-04-25 10:21:06 +01:00
xlnx-versal-trng.c
hw, target: Add ResetType argument to hold and exit phase methods
2024-04-25 10:21:06 +01:00
xlnx-versal-xramc.c
hw, target: Add ResetType argument to hold and exit phase methods
2024-04-25 10:21:06 +01:00
xlnx-zynqmp-apu-ctrl.c
hw, target: Add ResetType argument to hold and exit phase methods
2024-04-25 10:21:06 +01:00
xlnx-zynqmp-crf.c
hw, target: Add ResetType argument to hold and exit phase methods
2024-04-25 10:21:06 +01:00
zynq_slcr.c
hw/misc/zynq_slcr: Add boot-mode property
2024-07-01 15:40:54 +01:00