:p
atchew
Login
Prevent a buggy driver to execute malformed invalidation operations. Add the same assert as in vtd_iotlb_page_invalidate. Link: https://gitlab.com/qemu-project/qemu/-/work_items/3619 Fixes: 6ebe6cf2a066 ("intel_iommu: Process PASID-based iotlb invalidation") Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@bull.com> --- hw/i386/intel_iommu.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c index XXXXXXX..XXXXXXX 100644 --- a/hw/i386/intel_iommu.c +++ b/hw/i386/intel_iommu.c @@ -XXX,XX +XXX,XX @@ static void vtd_piotlb_page_invalidate(IntelIOMMUState *s, uint16_t domain_id, { VTDIOTLBPageInvInfo info; + assert(am <= VTD_MAMV); + info.domain_id = domain_id; info.pasid = pasid; info.addr = addr; @@ -XXX,XX +XXX,XX @@ static bool vtd_process_piotlb_desc(IntelIOMMUState *s, case VTD_INV_DESC_PIOTLB_PSI_IN_PASID: am = VTD_INV_DESC_PIOTLB_AM(inv_desc->val[1]); + if (am > VTD_MAMV) { + error_report_once("%s: invalid piotlb inv desc: hi=0x%"PRIx64 + ", lo=0x%"PRIx64" (am=%u > VTD_MAMV=%u)", + __func__, inv_desc->val[1], inv_desc->val[0], + am, (unsigned)VTD_MAMV); + return false; + } addr = (hwaddr) VTD_INV_DESC_PIOTLB_ADDR(inv_desc->val[1]); vtd_piotlb_page_invalidate(s, domain_id, pasid, addr, am, VTD_INV_DESC_PIOTLB_IH(inv_desc)); -- 2.54.0
Prevent a buggy driver to execute malformed invalidation operations. Add the same assert as in vtd_iotlb_page_invalidate. Link: https://gitlab.com/qemu-project/qemu/-/work_items/3619 Fixes: 6ebe6cf2a066 ("intel_iommu: Process PASID-based iotlb invalidation") Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@bull.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com> --- hw/i386/intel_iommu.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c index XXXXXXX..XXXXXXX 100644 --- a/hw/i386/intel_iommu.c +++ b/hw/i386/intel_iommu.c @@ -XXX,XX +XXX,XX @@ static void vtd_piotlb_page_invalidate(IntelIOMMUState *s, uint16_t domain_id, { VTDIOTLBPageInvInfo info; + assert(am <= VTD_MAMV); + info.domain_id = domain_id; info.pasid = pasid; info.addr = addr; @@ -XXX,XX +XXX,XX @@ static bool vtd_process_piotlb_desc(IntelIOMMUState *s, case VTD_INV_DESC_PIOTLB_PSI_IN_PASID: am = VTD_INV_DESC_PIOTLB_AM(inv_desc->val[1]); + if (am > VTD_MAMV) { + error_report_once("%s: invalid piotlb inv desc: hi=0x%"PRIx64 + ", lo=0x%"PRIx64" (am=%u > VTD_MAMV=%llu)", + __func__, inv_desc->val[1], inv_desc->val[0], + am, VTD_MAMV); + return false; + } addr = (hwaddr) VTD_INV_DESC_PIOTLB_ADDR(inv_desc->val[1]); vtd_piotlb_page_invalidate(s, domain_id, pasid, addr, am, VTD_INV_DESC_PIOTLB_IH(inv_desc)); -- 2.54.0