Commit d07945e7 authored by Prasad J Pandit's avatar Prasad J Pandit Committed by David Gibson
Browse files

ppc/pnv: check size before data buffer access 



While performing PowerNV memory r/w operations, the access length
'sz' could exceed the data[4] buffer size. Add check to avoid OOB
access.

Reported-by: default avatarMoguofang <moguofang@huawei.com>
Signed-off-by: default avatarPrasad J Pandit <pjp@fedoraproject.org>
Reviewed-by: default avatarCédric Le Goater <clg@kaod.org>
Signed-off-by: default avatarDavid Gibson <david@gibson.dropbear.id.au>
parent b8edea50

hw/ppc/pnv_lpc.c

+7 −1
Original line number Diff line number Diff line
@@ -155,9 +155,15 @@ static void pnv_lpc_do_eccb(PnvLpcController *lpc, uint64_t cmd) 
    /* XXX Check for magic bits at the top, addr size etc... */

    unsigned int sz = (cmd & ECCB_CTL_SZ_MASK) >> ECCB_CTL_SZ_LSH;

    uint32_t opb_addr = cmd & ECCB_CTL_ADDR_MASK;

    uint8_t data[4];

    uint8_t data[8];

    bool success;



    if (sz > sizeof(data)) {

        qemu_log_mask(LOG_GUEST_ERROR,

            "ECCB: invalid operation at @0x%08x size %d\n", opb_addr, sz);

        return;

    }



    if (cmd & ECCB_CTL_READ) {

        success = opb_read(lpc, opb_addr, data, sz);

        if (success) {