From nobody Thu Dec 18 22:20:20 2025 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1507824600251511.185366145024; Thu, 12 Oct 2017 09:10:00 -0700 (PDT) Received: from localhost ([::1]:46373 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1e2g3Y-00086Z-CF for importer@patchew.org; Thu, 12 Oct 2017 12:09:56 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:44208) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1e2fxU-0003Ka-Q9 for qemu-devel@nongnu.org; Thu, 12 Oct 2017 12:03:41 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1e2fxU-0004dV-1j for qemu-devel@nongnu.org; Thu, 12 Oct 2017 12:03:40 -0400 Received: from orth.archaic.org.uk ([2001:8b0:1d0::2]:37906) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1e2fxT-0004d0-RV for qemu-devel@nongnu.org; Thu, 12 Oct 2017 12:03:39 -0400 Received: from pm215 by orth.archaic.org.uk with local (Exim 4.89) (envelope-from ) id 1e2fxS-0000hJ-Qv for qemu-devel@nongnu.org; Thu, 12 Oct 2017 17:03:38 +0100 From: Peter Maydell To: qemu-devel@nongnu.org Date: Thu, 12 Oct 2017 17:03:36 +0100 Message-Id: <1507824216-29058-14-git-send-email-peter.maydell@linaro.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1507824216-29058-1-git-send-email-peter.maydell@linaro.org> References: <1507824216-29058-1-git-send-email-peter.maydell@linaro.org> X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 2001:8b0:1d0::2 Subject: [Qemu-devel] [PULL 13/13] nvic: Fix miscalculation of offsets into ITNS array X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" This calculation of the first exception vector in the ITNS register being accessed: int startvec =3D 32 * (offset - 0x380) + NVIC_FIRST_IRQ; is incorrect, because offset is in bytes, so we only want to multiply by 8. Spotted by Coverity (CID 1381484, CID 1381488), though it is not correct that it actually overflows the buffer, because we have a 'startvec + i < s->num_irq' guard. Signed-off-by: Peter Maydell Reviewed-by: Richard Henderson Message-id: 1507650856-11718-1-git-send-email-peter.maydell@linaro.org --- hw/intc/armv7m_nvic.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c index a42961c..be46639 100644 --- a/hw/intc/armv7m_nvic.c +++ b/hw/intc/armv7m_nvic.c @@ -698,7 +698,7 @@ static uint32_t nvic_readl(NVICState *s, uint32_t offse= t, MemTxAttrs attrs) return ((s->num_irq - NVIC_FIRST_IRQ) / 32) - 1; case 0x380 ... 0x3bf: /* NVIC_ITNS */ { - int startvec =3D 32 * (offset - 0x380) + NVIC_FIRST_IRQ; + int startvec =3D 8 * (offset - 0x380) + NVIC_FIRST_IRQ; int i; =20 if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) { @@ -1102,7 +1102,7 @@ static void nvic_writel(NVICState *s, uint32_t offset= , uint32_t value, switch (offset) { case 0x380 ... 0x3bf: /* NVIC_ITNS */ { - int startvec =3D 32 * (offset - 0x380) + NVIC_FIRST_IRQ; + int startvec =3D 8 * (offset - 0x380) + NVIC_FIRST_IRQ; int i; =20 if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) { --=20 2.7.4