Commit f0a2786f7e for qemu.org

commit f0a2786f7edf85e8f3a1ef7d98bff10ac1675864
Author: Peter Maydell <peter.maydell@linaro.org>
Date:   Mon Jul 13 12:34:17 2026 +0100

    hw/misc/allwinner-r40-ccu.c: Correct handling of out of range accesses

    In allwinner_r40_ccu_write() we handle writes to a MemoryRegion of
    size AW_R40_CCU_IOSIZE, and the register array is sized accordingly
    at (AW_R40_CCU_IOSIZE / sizeof(uint32_t)).  However, one of the cases
    in the switch is a range up to AW_R40_CCU_IOSIZE, which makes
    Coverity think we might index off the end of the array. We also
    have a similar case in the read function, but since that returns
    early it doesn't have the same issue.

    Adjust the handling of out of range accesses:
     - use AW_R40_CCU_IOSIZE - 4 as the upper bound, as this is the
       largest value we will actually see
     - return early in the write case, as we do in the read case

    Coverity CID: 1663687
    Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
    Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
    Reviewed-by: Strahinja Jankovic <strahinja.p.jankovic@gmail.com>
    Message-id: 20260709104802.1989086-1-peter.maydell@linaro.org

diff --git a/hw/misc/allwinner-r40-ccu.c b/hw/misc/allwinner-r40-ccu.c
index 8ba4e7aa42..00840e9850 100644
--- a/hw/misc/allwinner-r40-ccu.c
+++ b/hw/misc/allwinner-r40-ccu.c
@@ -71,7 +71,7 @@ static uint64_t allwinner_r40_ccu_read(void *opaque, hwaddr offset,
     const uint32_t idx = REG_INDEX(offset);

     switch (offset) {
-    case 0x324 ... AW_R40_CCU_IOSIZE:
+    case 0x324 ... AW_R40_CCU_IOSIZE - 4:
         qemu_log_mask(LOG_GUEST_ERROR, "%s: out-of-bounds offset 0x%04x\n",
                       __func__, (uint32_t)offset);
         return 0;
@@ -113,10 +113,10 @@ static void allwinner_r40_ccu_write(void *opaque, hwaddr offset,
             val |= REG_PLL_LOCK;
         }
         break;
-    case 0x324 ... AW_R40_CCU_IOSIZE:
+    case 0x324 ... AW_R40_CCU_IOSIZE - 4:
         qemu_log_mask(LOG_GUEST_ERROR, "%s: out-of-bounds offset 0x%04x\n",
                       __func__, (uint32_t)offset);
-        break;
+        return;
     default:
         qemu_log_mask(LOG_UNIMP, "%s: unimplemented write offset 0x%04x\n",
                       __func__, (uint32_t)offset);