[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 08/12] hw/arm/armsse: Assert info->num_cpus is in-bounds in armsse
From: |
Peter Maydell |
Subject: |
[PULL 08/12] hw/arm/armsse: Assert info->num_cpus is in-bounds in armsse_realize() |
Date: |
Mon, 20 Jul 2020 13:56:17 +0100 |
In armsse_realize() we have a loop over [0, info->num_cpus), which
indexes into various fixed-size arrays in the ARMSSE struct. This
confuses Coverity, which warns that we might overrun those arrays
(CID 1430326, 1430337, 1430371, 1430414, 1430430). This can't
actually happen, because the info struct is always one of the entries
in the armsse_variants[] array and num_cpus is either 1 or 2; we also
already assert in armsse_init() that num_cpus is not too large.
However, adding an assert to armsse_realize() like the one in
armsse_init() should help Coverity figure out that these code paths
aren't possible.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20200713143716.9881-1-peter.maydell@linaro.org
---
hw/arm/armsse.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
index 64fcab895f7..dcbff9bd8f4 100644
--- a/hw/arm/armsse.c
+++ b/hw/arm/armsse.c
@@ -452,6 +452,8 @@ static void armsse_realize(DeviceState *dev, Error **errp)
return;
}
+ assert(info->num_cpus <= SSE_MAX_CPUS);
+
/* max SRAM_ADDR_WIDTH: 24 - log2(SRAM_NUM_BANK) */
assert(is_power_of_2(info->sram_banks));
addr_width_max = 24 - ctz32(info->sram_banks);
--
2.20.1
- [PULL 00/12] target-arm queue, Peter Maydell, 2020/07/20
- [PULL 01/12] hw/arm/virt: Enable MTE via a machine property, Peter Maydell, 2020/07/20
- [PULL 02/12] hw/arm/virt: Error for MTE enabled with KVM, Peter Maydell, 2020/07/20
- [PULL 04/12] util: Implement qemu_get_thread_id() for OpenBSD, Peter Maydell, 2020/07/20
- [PULL 03/12] hw/arm/virt: Disable memory hotplug when MTE is enabled, Peter Maydell, 2020/07/20
- [PULL 05/12] qdev: Move doc comments from qdev.c to qdev-core.h, Peter Maydell, 2020/07/20
- [PULL 06/12] qdev: Document qdev_unrealize(), Peter Maydell, 2020/07/20
- [PULL 07/12] qdev: Document GPIO related functions, Peter Maydell, 2020/07/20
- [PULL 08/12] hw/arm/armsse: Assert info->num_cpus is in-bounds in armsse_realize(),
Peter Maydell <=
- [PULL 09/12] docs/system: Briefly document canon-a1100 board, Peter Maydell, 2020/07/20
- [PULL 11/12] docs/system: Briefly document gumstix boards, Peter Maydell, 2020/07/20
- [PULL 10/12] docs/system: Briefly document collie board, Peter Maydell, 2020/07/20
- [PULL 12/12] docs/system: Document the arm virt board, Peter Maydell, 2020/07/20
- Re: [PULL 00/12] target-arm queue, Peter Maydell, 2020/07/20