[qemu-xen staging] hw/arm/armsse: Assert info->num_cpus is in-bounds in armsse_realize()

[patchbot@xxxxxxx]

commit 3f410039b79c0468e18142c6ddfede6f6f7b0427
Author:     Peter Maydell <peter.maydell@xxxxxxxxxx>
AuthorDate: Mon Jul 13 15:37:16 2020 +0100
Commit:     Peter Maydell <peter.maydell@xxxxxxxxxx>
CommitDate: Mon Jul 20 11:35:17 2020 +0100

    hw/arm/armsse: Assert info->num_cpus is in-bounds in armsse_realize()
    
    In armsse_realize() we have a loop over [0, info->num_cpus), which
    indexes into various fixed-size arrays in the ARMSSE struct.  This
    confuses Coverity, which warns that we might overrun those arrays
    (CID 1430326, 1430337, 1430371, 1430414, 1430430).  This can't
    actually happen, because the info struct is always one of the entries
    in the armsse_variants[] array and num_cpus is either 1 or 2; we also
    already assert in armsse_init() that num_cpus is not too large.
    However, adding an assert to armsse_realize() like the one in
    armsse_init() should help Coverity figure out that these code paths
    aren't possible.
    
    Signed-off-by: Peter Maydell <peter.maydell@xxxxxxxxxx>
    Reviewed-by: Philippe Mathieu-Daudé <f4bug@xxxxxxxxx>
    Message-id: 20200713143716.9881-1-peter.maydell@xxxxxxxxxx
---
 hw/arm/armsse.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
index 64fcab895f..dcbff9bd8f 100644
--- a/hw/arm/armsse.c
+++ b/hw/arm/armsse.c
@@ -452,6 +452,8 @@ static void armsse_realize(DeviceState *dev, Error **errp)
         return;
     }
 
+    assert(info->num_cpus <= SSE_MAX_CPUS);
+
     /* max SRAM_ADDR_WIDTH: 24 - log2(SRAM_NUM_BANK) */
     assert(is_power_of_2(info->sram_banks));
     addr_width_max = 24 - ctz32(info->sram_banks);
--
generated by git-patchbot for /home/xen/git/qemu-xen.git#staging