diff mbox series

[for-5.2,v3,4/4] hw/net/can/ctucan_core: Use stl_le_p to write to tx_buffers

Message ID 7951c8ad9a0ad6b5faf7ec7569f255fa45259590.1605044619.git.pisa@cmp.felk.cvut.cz
State New
Headers show
Series [for-5.2,v3,1/4] hw/net/can/ctucan: Don't allow guest to write off end of tx_buffer | expand

Commit Message

Pavel Pisa Nov. 10, 2020, 9:52 p.m. UTC 
From: Peter Maydell <peter.maydell@linaro.org>


Instead of casting an address within a uint8_t array to a
uint32_t*, use stl_le_p(). This handles possibly misaligned
addresses which would otherwise crash on some hosts.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Pavel Pisa <pisa@cmp.felk.cvut.cz>

Tested-by: Pavel Pisa <pisa@cmp.felk.cvut.cz>

---
 hw/net/can/ctucan_core.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

-- 
2.20.1
diff mbox series

Patch

diff --git a/hw/net/can/ctucan_core.c b/hw/net/can/ctucan_core.c
index f49c76261c..d171c372e0 100644
--- a/hw/net/can/ctucan_core.c
+++ b/hw/net/can/ctucan_core.c
@@ -303,11 +303,9 @@  void ctucan_mem_write(CtuCanCoreState *s, hwaddr addr, uint64_t val,
         addr -= CTU_CAN_FD_TXTB1_DATA_1;
         buff_num = addr / CTUCAN_CORE_TXBUFF_SPAN;
         addr %= CTUCAN_CORE_TXBUFF_SPAN;
-        addr &= ~3;
         if ((buff_num < CTUCAN_CORE_TXBUF_NUM) &&
-            (addr < sizeof(s->tx_buffer[buff_num].data))) {
-            uint32_t *bufp = (uint32_t *)(s->tx_buffer[buff_num].data + addr);
-            *bufp = cpu_to_le32(val);
+            ((addr + size) <= sizeof(s->tx_buffer[buff_num].data))) {
+            stn_le_p(s->tx_buffer[buff_num].data + addr, size, val);
         }
     } else {
         switch (addr & ~3) {