hw/display/sm501: Fix various error-checks

[PATCH 0/3] hw/display/sm501: Fix various error-checks

Posted by Peter Maydell 2 weeks, 4 days ago

This set of patches fixes three bugs discovered recently in the sm501
device. They're all of the form "guest can misprogram registers in a
way that defeats the bounds-checks on the 2D graphics ops".

thanks
-- PMM

Peter Maydell (3):
  hw/display/sm501: Catch bad coordinates for RTL operations
  hw/display/sm501: Avoid overflow problems in bounds check calculations
  hw/display/sm501: Don't allow guest to set ram size larger than it is

 hw/display/sm501.c | 64 +++++++++++++++++++++++++++++++++++++++-------
 1 file changed, 55 insertions(+), 9 deletions(-)

-- 
2.43.0

Re: [PATCH 0/3] hw/display/sm501: Fix various error-checks

Posted by BALATON Zoltan 2 weeks, 2 days ago

On Tue, 7 Jul 2026, Peter Maydell wrote:
> This set of patches fixes three bugs discovered recently in the sm501
> device. They're all of the form "guest can misprogram registers in a
> way that defeats the bounds-checks on the 2D graphics ops".
>
> thanks
> -- PMM
>
> Peter Maydell (3):
>  hw/display/sm501: Catch bad coordinates for RTL operations
>  hw/display/sm501: Avoid overflow problems in bounds check calculations
>  hw/display/sm501: Don't allow guest to set ram size larger than it is
>
> hw/display/sm501.c | 64 +++++++++++++++++++++++++++++++++++++++-------
> 1 file changed, 55 insertions(+), 9 deletions(-)

Thank you for fixing these.

Series:
Tested-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: BALATON Zoltan <balaton@eik.bme.hu>

I think patch 2 should have:
"Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3584" instead 
of work_items/3920.

Regards,
BALATON Zoltan

Re: [PATCH 0/3] hw/display/sm501: Fix various error-checks

Posted by Peter Maydell 2 weeks, 2 days ago

On Thu, 9 Jul 2026 at 21:35, BALATON Zoltan <balaton@eik.bme.hu> wrote:
>
> On Tue, 7 Jul 2026, Peter Maydell wrote:
> > This set of patches fixes three bugs discovered recently in the sm501
> > device. They're all of the form "guest can misprogram registers in a
> > way that defeats the bounds-checks on the 2D graphics ops".
> >
> > thanks
> > -- PMM
> >
> > Peter Maydell (3):
> >  hw/display/sm501: Catch bad coordinates for RTL operations
> >  hw/display/sm501: Avoid overflow problems in bounds check calculations
> >  hw/display/sm501: Don't allow guest to set ram size larger than it is
> >
> > hw/display/sm501.c | 64 +++++++++++++++++++++++++++++++++++++++-------
> > 1 file changed, 55 insertions(+), 9 deletions(-)
>
> Thank you for fixing these.
>
> Series:
> Tested-by: BALATON Zoltan <balaton@eik.bme.hu>
> Reviewed-by: BALATON Zoltan <balaton@eik.bme.hu>
>
> I think patch 2 should have:
> "Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3584" instead
> of work_items/3920.

Yes, thanks for that catch and for the testing; I cut and pasted
the wrong URL there.

-- PMM

Re: [PATCH 0/3] hw/display/sm501: Fix various error-checks

Posted by Peter Maydell 1 week, 5 days ago

On Fri, 10 Jul 2026 at 09:56, Peter Maydell <peter.maydell@linaro.org> wrote:
>
> On Thu, 9 Jul 2026 at 21:35, BALATON Zoltan <balaton@eik.bme.hu> wrote:
> >
> > On Tue, 7 Jul 2026, Peter Maydell wrote:
> > > This set of patches fixes three bugs discovered recently in the sm501
> > > device. They're all of the form "guest can misprogram registers in a
> > > way that defeats the bounds-checks on the 2D graphics ops".
> > >
> > > thanks
> > > -- PMM
> > >
> > > Peter Maydell (3):
> > >  hw/display/sm501: Catch bad coordinates for RTL operations
> > >  hw/display/sm501: Avoid overflow problems in bounds check calculations
> > >  hw/display/sm501: Don't allow guest to set ram size larger than it is
> > >
> > > hw/display/sm501.c | 64 +++++++++++++++++++++++++++++++++++++++-------
> > > 1 file changed, 55 insertions(+), 9 deletions(-)
> >
> > Thank you for fixing these.
> >
> > Series:
> > Tested-by: BALATON Zoltan <balaton@eik.bme.hu>
> > Reviewed-by: BALATON Zoltan <balaton@eik.bme.hu>
> >
> > I think patch 2 should have:
> > "Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3584" instead
> > of work_items/3920.
>
> Yes, thanks for that catch and for the testing; I cut and pasted
> the wrong URL there.

As I'm putting together a target-arm pullreq, I'll take these
patches through that, unless somebody from the ppc side would
prefer to take them via another route.

-- PMM