In the exynos420_combiner read and write functions, we check whether offset >> 2 is too large for the s->reg_set[] array we're about to access. This is written to log a guest error if it happens, but in fact the condition can't be true unless there's a QEMU bug:
* we have already dealt with and returned early for registers beyond the "sets of 4" range, by checking grp_quad_base_n; this accounts for all offsets 0x100 and above * this means offset >> 2 is at most 0x3F * IIC_REGSET_SIZE is 0x41, which is in fact one larger than it needs to be, but in any case the offset can't be out of range Use assert() checking against ARRAY_SIZE for this sanity check, as failing it would be a QEMU bug, not a guest bug. Signed-off-by: Peter Maydell <[email protected]> --- hw/intc/exynos4210_combiner.c | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-) diff --git a/hw/intc/exynos4210_combiner.c b/hw/intc/exynos4210_combiner.c index 4f079fedaff..2bdb9a0152c 100644 --- a/hw/intc/exynos4210_combiner.c +++ b/hw/intc/exynos4210_combiner.c @@ -119,12 +119,7 @@ exynos4210_combiner_read(void *opaque, hwaddr offset, unsigned size) s->group[grp_quad_base_n + 3].src_pending) << 24; break; default: - if (offset >> 2 >= IIC_REGSET_SIZE) { - qemu_log_mask(LOG_GUEST_ERROR, - "exynos4210.combiner: overflow of reg_set by 0x" - HWADDR_FMT_plx "offset\n", offset); - return 0; - } + assert((offset >> 2) < ARRAY_SIZE(s->reg_set)); val = s->reg_set[offset >> 2]; } return val; @@ -199,12 +194,7 @@ static void exynos4210_combiner_write(void *opaque, hwaddr offset, return; } - if (offset >> 2 >= IIC_REGSET_SIZE) { - qemu_log_mask(LOG_GUEST_ERROR, - "exynos4210.combiner: overflow of reg_set by 0x" - HWADDR_FMT_plx "offset\n", offset); - return; - } + assert((offset >> 2) < ARRAY_SIZE(s->reg_set)); s->reg_set[offset >> 2] = val; switch (reg_n) { -- 2.43.0
