[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH v2 2/9] hw/i2c: pmbus: guard against out of range accesses
From: |
Titus Rwantare |
Subject: |
[PATCH v2 2/9] hw/i2c: pmbus: guard against out of range accesses |
Date: |
Tue, 1 Mar 2022 16:23:00 -0800 |
Signed-off-by: Titus Rwantare <titusr@google.com>
---
hw/i2c/pmbus_device.c | 41 ++++++++++++++++++++++++++++++++++++++++-
1 file changed, 40 insertions(+), 1 deletion(-)
diff --git a/hw/i2c/pmbus_device.c b/hw/i2c/pmbus_device.c
index 07a45c99f9..93c746bab3 100644
--- a/hw/i2c/pmbus_device.c
+++ b/hw/i2c/pmbus_device.c
@@ -243,18 +243,47 @@ void pmbus_check_limits(PMBusDevice *pmdev)
}
}
+/* assert the status_cml error upon receipt of malformed command */
+static void pmbus_cml_error(PMBusDevice *pmdev)
+{
+ for (int i = 0; i < pmdev->num_pages; i++) {
+ pmdev->pages[i].status_word |= PMBUS_STATUS_CML;
+ pmdev->pages[i].status_cml |= PB_CML_FAULT_INVALID_CMD;
+ }
+}
+
static uint8_t pmbus_receive_byte(SMBusDevice *smd)
{
PMBusDevice *pmdev = PMBUS_DEVICE(smd);
PMBusDeviceClass *pmdc = PMBUS_DEVICE_GET_CLASS(pmdev);
uint8_t ret = 0xFF;
- uint8_t index = pmdev->page;
+ uint8_t index;
if (pmdev->out_buf_len != 0) {
ret = pmbus_out_buf_pop(pmdev);
return ret;
}
+ /*
+ * Reading from all pages will return the value from page 0,
+ * this is unspecified behaviour in general.
+ */
+ if (pmdev->page == PB_ALL_PAGES) {
+ index = 0;
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "%s: tried to read from all pages\n",
+ __func__);
+ pmbus_cml_error(pmdev);
+ } else if (pmdev->page > pmdev->num_pages - 1) {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "%s: page %d is out of range\n",
+ __func__, pmdev->page);
+ pmbus_cml_error(pmdev);
+ return -1;
+ } else {
+ index = pmdev->page;
+ }
+
switch (pmdev->code) {
case PMBUS_PAGE:
pmbus_send8(pmdev, pmdev->page);
@@ -1038,6 +1067,7 @@ static int pmbus_write_data(SMBusDevice *smd, uint8_t
*buf, uint8_t len)
pmdev->page = pmbus_receive8(pmdev);
return 0;
}
+
/* loop through all the pages when 0xFF is received */
if (pmdev->page == PB_ALL_PAGES) {
for (int i = 0; i < pmdev->num_pages; i++) {
@@ -1048,6 +1078,15 @@ static int pmbus_write_data(SMBusDevice *smd, uint8_t
*buf, uint8_t len)
return 0;
}
+ if (pmdev->page > pmdev->num_pages - 1) {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "%s: page %u is out of range\n",
+ __func__, pmdev->page);
+ pmdev->page = 0; /* undefined behaviour - reset to page 0 */
+ pmbus_cml_error(pmdev);
+ return -1;
+ }
+
index = pmdev->page;
switch (pmdev->code) {
--
2.35.1.616.g0bdcbb4464-goog
- [PATCH v2 0/9] Fixups for PMBus and new sensors, Titus Rwantare, 2022/03/01
- [PATCH v2 1/9] hw/i2c: pmbus: add registers, Titus Rwantare, 2022/03/01
- [PATCH v2 3/9] hw/i2c: pmbus: add PEC unsupported warning, Titus Rwantare, 2022/03/01
- [PATCH v2 2/9] hw/i2c: pmbus: guard against out of range accesses,
Titus Rwantare <=
- [PATCH v2 4/9] hw/i2c: pmbus: refactor uint handling and update MAINTAINERS, Titus Rwantare, 2022/03/01
- [PATCH v2 5/9] hw/i2c: Added linear mode translation for pmbus devices, Titus Rwantare, 2022/03/01
- [PATCH v2 6/9] hw/sensor: add Intersil ISL69260 device model, Titus Rwantare, 2022/03/01
- [PATCH v2 9/9] hw/sensor: rename isl_pmbus to isl_pmbus_vr, Titus Rwantare, 2022/03/01
- [PATCH v2 7/9] hw/sensor: add Renesas raa229004 PMBus device, Titus Rwantare, 2022/03/01
- [PATCH v2 8/9] hw/sensor: add Renesas raa228000 device, Titus Rwantare, 2022/03/01