hw/usb/imx: Fix out of bounds access in imx_usbphy_read()
authorGuenter Roeck <linux@roeck-us.net>
Thu, 16 Mar 2023 23:49:26 +0000 (16:49 -0700)
committerPeter Maydell <peter.maydell@linaro.org>
Tue, 21 Mar 2023 13:19:07 +0000 (13:19 +0000)
commit3202b2628b470a2e44f3cc7b9582c724fe654bd1
tree9edd6864dcd2635c25606a2d92f2476a63b404d7
parentd399d6b179f07b9904de0e76d06c77a3d0a66b51
hw/usb/imx: Fix out of bounds access in imx_usbphy_read()

The i.MX USB Phy driver does not check register ranges, resulting in out of
bounds accesses if an attempt is made to access non-existing PHY registers.
Add range check and conditionally report bad accesses to fix the problem.

While at it, also conditionally log attempted writes to non-existing or
read-only registers.

Reported-by: Qiang Liu <cyruscyliu@gmail.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Qiang Liu <cyruscyliu@gmail.com>
Message-id: 20230316234926.208874-1-linux@roeck-us.net
Link: https://gitlab.com/qemu-project/qemu/-/issues/1408
Fixes: 0701a5efa015 ("hw/usb: Add basic i.MX USB Phy support")
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
hw/usb/imx-usb-phy.c