diff mbox

usb: ehci: add capability mmio write function

Message ID 1454072434-16045-1-git-send-email-ppandit@redhat.com (mailing list archive)
State New, archived
Headers show

Commit Message

Prasad Pandit Jan. 29, 2016, 1 p.m. UTC 
From: Prasad J Pandit <pjp@fedoraproject.org>

USB Ehci emulation supports host controller capability registers.
But its mmio '.write' function was missing, which lead to a null
pointer dereference issue. Add a do nothing 'ehci_caps_write'
definition to avoid it; Do nothing because capability registers
are Read Only(RO).

Reported-by: Zuozhi Fzz <zuozhi.fzz@alibaba-inc.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
---
 hw/usb/hcd-ehci.c | 6 ++++++
 1 file changed, 6 insertions(+)

Comments

Gerd Hoffman Jan. 29, 2016, 1:45 p.m. UTC | #1 
On Fr, 2016-01-29 at 18:30 +0530, P J P wrote:
> From: Prasad J Pandit <pjp@fedoraproject.org>
> 
> USB Ehci emulation supports host controller capability registers.
> But its mmio '.write' function was missing, which lead to a null
> pointer dereference issue. Add a do nothing 'ehci_caps_write'
> definition to avoid it; Do nothing because capability registers
> are Read Only(RO).

Surely makes sense, xhci does the same, I'll pick it up.

Maybe we should have a generic nop_write function somewhere.  Not that
there can much go wrong by cut&pasting here, but still ...

cheers,
  Gerd
Prasad Pandit Jan. 29, 2016, 4:48 p.m. UTC | #2 
Hello Gerd,

+-- On Fri, 29 Jan 2016, Gerd Hoffmann wrote --+
| On Fr, 2016-01-29 at 18:30 +0530, P J P wrote:
| > pointer dereference issue. Add a do nothing 'ehci_caps_write'
| > definition to avoid it; Do nothing because capability registers
| > are Read Only(RO).
| 
| Surely makes sense, xhci does the same, I'll pick it up.

  Cool! Thank you.
 
| Maybe we should have a generic nop_write function somewhere.  Not that there

  True. Would one nop_write function serve them all? I mean do they share the 
same prototype/syntax?

--
Prasad J Pandit / Red Hat Product Security Team
47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F
diff mbox

Patch

diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index c40013e..b08ff62 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -893,6 +893,11 @@  static uint64_t ehci_caps_read(void *ptr, hwaddr addr,
     return s->caps[addr];
 }
 
+static void ehci_caps_write(void *ptr, hwaddr addr,
+                             uint64_t val, unsigned size)
+{
+}
+
 static uint64_t ehci_opreg_read(void *ptr, hwaddr addr,
                                 unsigned size)
 {
@@ -2313,6 +2318,7 @@  static void ehci_frame_timer(void *opaque)
 
 static const MemoryRegionOps ehci_mmio_caps_ops = {
     .read = ehci_caps_read,
+    .write = ehci_caps_write,
     .valid.min_access_size = 1,
     .valid.max_access_size = 4,
     .impl.min_access_size = 1,