mirror of https://github.com/proxmox/mirror_qemu
9c49c83e4b
The while statement in question only checked if tx_burst is not 0. tx_burst is a signed int, which is assigned the value put by the guest driver in ECSPI_CONREG. The burst length can be anywhere between 1 and 4096, and since tx_burst is always decremented by 8 it could possibly underflow, causing an infinite loop. Signed-off-by: Eden Mikitas <e.mikitas@gmail.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> |
||
|---|---|---|
| .. | ||
| Kconfig | ||
| Makefile.objs | ||
| aspeed_smc.c | ||
| imx_spi.c | ||
| mss-spi.c | ||
| omap_spi.c | ||
| pl022.c | ||
| ssi.c | ||
| stm32f2xx_spi.c | ||
| trace-events | ||
| xilinx_spi.c | ||
| xilinx_spips.c | ||