mirrors/qemu
0
0
Fork 0
mirror of https://github.com/qemu/qemu.git synced 2024-12-12 05:03:42 +08:00
Code Issues Packages Projects Releases Wiki Activity

hw/intc: sifive_plic: fix out-of-bound access of source_priority array

Browse Source 
If the number of interrupt is not multiple of 32, PLIC will have
out-of-bound access to source_priority array. Compute the number of
interrupt in the last word to avoid this out-of-bound access of array.

Signed-off-by: Jim Shu <jim.shu@sifive.com>
Reviewed-by: Bin Meng <bmeng@tinylab.org>
Message-Id: <20221127165753.30533-1-jim.shu@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
This commit is contained in:
Jim Shu 2022-11-27 16:57:46 +00:00 committed by Alistair Francis
parent 592f0a9429
commit bb22d39112
1 changed files with 11 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
hw/intc/sifive_plic.c
View File

@ -78,6 +78,7 @@ static uint32_t sifive_plic_claimed(SiFivePLICState *plic, uint32_t addrid)
uint32_t max_irq = 0;
uint32_t max_prio = plic->target_priority[addrid];
int i, j;
int num_irq_in_word = 32;
for (i = 0; i < plic->bitfield_words; i++) {
uint32_t pending_enabled_not_claimed =
@ -88,7 +89,16 @@ static uint32_t sifive_plic_claimed(SiFivePLICState *plic, uint32_t addrid)
continue;
}
for (j = 0; j < 32; j++) {
if (i == (plic->bitfield_words - 1)) {
/*
* If plic->num_sources is not multiple of 32, num-of-irq in last
* word is not 32. Compute the num-of-irq of last word to avoid
* out-of-bound access of source_priority array.
*/
num_irq_in_word = plic->num_sources - ((plic->bitfield_words - 1) << 5);
}
for (j = 0; j < num_irq_in_word; j++) {
int irq = (i << 5) + j;
uint32_t prio = plic->source_priority[irq];
int enabled = pending_enabled_not_claimed & (1 << j);