On 17:19 Mon 19 Oct , Peter Maydell wrote: > The clock mux control registers in bcm2835_cprman have a 4 bit SRC > field that selects the input clock source to use. There are only 10 > valid SRC values. Treat the invalid values as producing no clock > output, as if the GND clock source was used or the mux was disabled. > This avoids reading off the end of the mux->srcs[] array. > > Cc: [email protected] > Fixes: fc9840850ba ("hw/misc/bcm2835_cprman: implement clock mux behaviour") > Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4695 > Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Luc Michel <[email protected]> > --- > hw/misc/bcm2835_cprman.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/hw/misc/bcm2835_cprman.c b/hw/misc/bcm2835_cprman.c > index f9a77ff9bb0..10cad07623d 100644 > --- a/hw/misc/bcm2835_cprman.c > +++ b/hw/misc/bcm2835_cprman.c > @@ -271,7 +271,7 @@ static void clock_mux_update(CprmanClockMuxState *mux) > > *mux->reg_ctl = FIELD_DP32(*mux->reg_ctl, CM_CLOCKx_CTL, BUSY, enabled); > > - if (!enabled) { > + if (!enabled || src >= ARRAY_SIZE(mux->srcs)) { > clock_update(mux->out, 0); > return; > } > -- > 2.43.0 > > --
