From 8bc5ae046d15fcd3e5de65225d5d3a8f1a5a6413 Mon Sep 17 00:00:00 2001 From: =?utf8?q?C=C3=A9dric=20Le=20Goater?= Date: Thu, 9 Nov 2023 18:15:25 +0100 Subject: [PATCH] ppc/pnv: Fix potential overflow in I2C model MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit Coverity warns that "i2c_bus_busy(i2c->busses[i]) << i" might overflow because the expression is evaluated using 32-bit arithmetic and then used in a context expecting a uint64_t. While we are at it, introduce a PNV_I2C_MAX_BUSSES constant and check the number of busses at realize time. Fixes: Coverity CID 1523918 Cc: Glenn Miles Reviewed-by: Philippe Mathieu-Daudé Reviewed-by: Glenn Miles Signed-off-by: Cédric Le Goater --- hw/ppc/pnv_i2c.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/hw/ppc/pnv_i2c.c b/hw/ppc/pnv_i2c.c index f75e59e709..483d91d15a 100644 --- a/hw/ppc/pnv_i2c.c +++ b/hw/ppc/pnv_i2c.c @@ -151,6 +151,7 @@ #define I2C_RESET_S_SDA_REG 0x11 #define PNV_I2C_FIFO_SIZE 8 +#define PNV_I2C_MAX_BUSSES 64 static I2CBus *pnv_i2c_get_bus(PnvI2C *i2c) { @@ -437,7 +438,7 @@ static uint64_t pnv_i2c_xscom_read(void *opaque, hwaddr addr, case I2C_PORT_BUSY_REG: /* compute busy bit for each port */ val = 0; for (i = 0; i < i2c->num_busses; i++) { - val |= i2c_bus_busy(i2c->busses[i]) << i; + val |= (uint64_t)i2c_bus_busy(i2c->busses[i]) << i; } break; @@ -641,6 +642,11 @@ static void pnv_i2c_realize(DeviceState *dev, Error **errp) assert(i2c->chip); + if (i2c->num_busses > PNV_I2C_MAX_BUSSES) { + error_setg(errp, "Invalid number of busses: %u", i2c->num_busses); + return; + } + pnv_xscom_region_init(&i2c->xscom_regs, OBJECT(i2c), &pnv_i2c_xscom_ops, i2c, "xscom-i2c", PNV9_XSCOM_I2CM_SIZE); -- 2.11.4.GIT