From: Prasad J Pandit <p...@fedoraproject.org> The high[31:28] bits of 'direction' and 'state' registers of SA-1100/SA-1110 device are reserved. Setting them may lead to OOB 's->handler[]' array access issue. Mask off [31:28] bits to avoid it.
Reported-by: Moguofang <moguof...@huawei.com> Signed-off-by: Prasad J Pandit <p...@fedoraproject.org> --- hw/arm/strongarm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) Update v3: fix the mask value to 0x0fffffff -> https://lists.gnu.org/archive/html/qemu-devel/2018-10/msg06088.html diff --git a/hw/arm/strongarm.c b/hw/arm/strongarm.c index ec2627374d..644a9c45b4 100644 --- a/hw/arm/strongarm.c +++ b/hw/arm/strongarm.c @@ -587,12 +587,12 @@ static void strongarm_gpio_write(void *opaque, hwaddr offset, switch (offset) { case GPDR: /* GPIO Pin-Direction registers */ - s->dir = value; + s->dir = value & 0x0fffffff; strongarm_gpio_handler_update(s); break; case GPSR: /* GPIO Pin-Output Set registers */ - s->olevel |= value; + s->olevel |= value & 0x0fffffff; strongarm_gpio_handler_update(s); break; -- 2.17.2
