Add the endpint index value check in doorbell write function,
because the max index value is 32.

Signed-off-by: Liu Long <long.liu@...>
---
devicemodel/hw/pci/xhci.c | 4 ++++
1 file changed, 4 insertions(+)

diff --git a/devicemodel/hw/pci/xhci.c b/devicemodel/hw/pci/xhci.c
index b5c1365ce..eef4dee4a 100644
--- a/devicemodel/hw/pci/xhci.c
+++ b/devicemodel/hw/pci/xhci.c
@@ -3419,6 +3419,10 @@ pci_xhci_dbregs_write(struct pci_xhci_vdev *xdev,
UPRINTF(LWRN, "pci_xhci: controller halted\r\n");
return;
}
+ if (XHCI_DB_TARGET_GET(value) > XHCI_MAX_ENDPOINTS) {
+ UPRINTF(LWRN, "pci_xhci: endpoint index is not valid.\r\n");
+ return;
+ }

if (offset == 0)
pci_xhci_complete_commands(xdev);
--
2.25.1

On Tue, Jun 14, 2022 at 10:14:26AM +0800, Liu Long wrote:

Add the endpint index value check in doorbell write function,
because the max index value is 32.

Title: dm: xhci: Add max ep index checking in doorbell write emulation

Check max ep index in doorbell write function to avoid overwriting
the pci_xhci_dev_emu->eps[XHCI_MAX_ENDPOINTS].

Signed-off-by: Liu Long <long.liu@...>
---
devicemodel/hw/pci/xhci.c | 4 ++++
1 file changed, 4 insertions(+)

diff --git a/devicemodel/hw/pci/xhci.c b/devicemodel/hw/pci/xhci.c
index b5c1365ce..eef4dee4a 100644
--- a/devicemodel/hw/pci/xhci.c
+++ b/devicemodel/hw/pci/xhci.c
@@ -3419,6 +3419,10 @@ pci_xhci_dbregs_write(struct pci_xhci_vdev *xdev,
UPRINTF(LWRN, "pci_xhci: controller halted\r\n");
return;
}
+ if (XHCI_DB_TARGET_GET(value) > XHCI_MAX_ENDPOINTS) {
+ UPRINTF(LWRN, "pci_xhci: endpoint index is not valid.\r\n");

UPRINTF(LWRN, "pci_xhci: invalid doorbell target %d!\n", XHCI_DB_TARGET_GET(value));

Acked-by: Wang, Yu1 <yu1.wang@...>

+ return;
+ }

if (offset == 0)
pci_xhci_complete_commands(xdev);
--
2.25.1