The gpio array is declared as a dense array:
qemu_irq gpios[ASPEED_GPIO_NR_PINS];
(AST2500 has 228, AST2400 has 216, AST2600 has 208)
However, this array is used like a matrix of GPIO sets
(e.g. gpio[NR_SETS][NR_PINS_PER_SET] = gpio[8][32])
size_t offset = set * GPIOS_PER_SET + gpio;
qemu_set_irq(s->gpios[offset], !!(new & mask));
This can result in an out-of-bounds access to "s->gpios" because the
gpio sets do _not_ have the same length. Some of the groups (e.g.
GPIOAB) only have 4 pins. 228 != 8 * 32 == 256.
To fix this, I converted the gpio array from dense to sparse, to that
match both the hardware layout and this existing indexing code.
Fixes:
|
||
---|---|---|
.. | ||
aspeed_gpio.c | ||
bcm2835_gpio.c | ||
gpio_key.c | ||
gpio_pwr.c | ||
imx_gpio.c | ||
Kconfig | ||
max7310.c | ||
meson.build | ||
mpc8xxx.c | ||
npcm7xx_gpio.c | ||
nrf51_gpio.c | ||
omap_gpio.c | ||
pl061.c | ||
sifive_gpio.c | ||
trace-events | ||
trace.h | ||
zaurus.c |