From 7efb86afb17d4b143f047b54618121b5b2b086c1 Mon Sep 17 00:00:00 2001 From: Liu Long Date: Tue, 14 Jun 2022 10:10:32 +0800 Subject: [PATCH] DM: Add endpoint index value check in doorbell write Check max ep index in doorbell write function to avoid overwriting the pci_xhci_dev_emu->eps[XHCI_MAX_ENDPOINTS]. Tracked-On: #7759 Signed-off-by: Liu Long Acked-by: Wang, Yu1 --- devicemodel/hw/pci/xhci.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/devicemodel/hw/pci/xhci.c b/devicemodel/hw/pci/xhci.c index b5c1365ce..35a179987 100644 --- a/devicemodel/hw/pci/xhci.c +++ b/devicemodel/hw/pci/xhci.c @@ -3419,6 +3419,11 @@ pci_xhci_dbregs_write(struct pci_xhci_vdev *xdev, UPRINTF(LWRN, "pci_xhci: controller halted\r\n"); return; } + if (XHCI_DB_TARGET_GET(value) > XHCI_MAX_ENDPOINTS) { + UPRINTF(LWRN, "pci_xhci: invalid doorbell target %d!\n", + XHCI_DB_TARGET_GET(value)); + return; + } if (offset == 0) pci_xhci_complete_commands(xdev);