From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:40545)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <aurelien@aurel32.net>) id 1ZKvtu-0005i0-DT
	for qemu-devel@nongnu.org; Thu, 30 Jul 2015 18:02:11 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <aurelien@aurel32.net>) id 1ZKvtt-0001Rd-DK
	for qemu-devel@nongnu.org; Thu, 30 Jul 2015 18:02:06 -0400
Received: from hall.aurel32.net ([2001:bc8:30d7:100::1]:40053)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <aurelien@aurel32.net>) id 1ZKvtt-0001Qi-8I
	for qemu-devel@nongnu.org; Thu, 30 Jul 2015 18:02:05 -0400
Date: Fri, 31 Jul 2015 00:02:01 +0200
From: Aurelien Jarno <aurelien@aurel32.net>
Message-ID: <20150730220201.GA4735@aurel32.net>
References: <1438270422-18018-1-git-send-email-peter.maydell@linaro.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <1438270422-18018-1-git-send-email-peter.maydell@linaro.org>
Subject: Re: [Qemu-devel] [PATCH] hw/pci-host/bonito: Avoid buffer overrun
 for bad LDMA/COP accesses
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Peter Maydell <peter.maydell@linaro.org>
Cc: Leon Alrae <leon.alrae@imgtec.com>, qemu-devel@nongnu.org, patches@linaro.org

On 2015-07-30 16:33, Peter Maydell wrote:
> The LDMA and COP memory regions represent four 32 bit registers
> each, but the memory regions themselves are 0x100 bytes large.
> Add guards to the read and write accessors so that bogus accesses
> beyond the four defined registers don't just run off the end of
> the bonldma and boncop structs and into whatever lies beyond.

Thanks for finding that. I don't know if it is better to reduce the
memory region or just ignore the access as in your patch. I haven't
found any documentation about the bonito northbridge, so I think it's
safer to go like in your patch.

> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
> ---
> I don't have a fulong2e image, so this is compile tested only...

I have just tested, it still boots fine with the change.

>  hw/pci-host/bonito.c | 16 ++++++++++++++++
>  1 file changed, 16 insertions(+)

Acked-by: Aurelien Jarno <aurelien@aurel32.net>

-- 
Aurelien Jarno                          GPG: 4096R/1DDD8C9B
aurelien@aurel32.net                 http://www.aurel32.net