[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 37/38] hw/intc/arm_gicv3_its: Range-check ICID before indexing int
From: |
Peter Maydell |
Subject: |
[PULL 37/38] hw/intc/arm_gicv3_its: Range-check ICID before indexing into collection table |
Date: |
Thu, 20 Jan 2022 12:36:29 +0000 |
In process_its_cmd(), we read an ICID out of the interrupt table
entry, and then use it as an index into the collection table. Add a
check that it is within range for the collection table first.
This check is not strictly necessary, because:
* we range check the ICID from the guest before writing it into
the interrupt table entry, so the the only way to get an
out of range ICID in process_its_cmd() is if a badly-behaved
guest is writing directly to the interrupt table memory
* the collection table is in guest memory, so QEMU won't fall
over if we read off the end of it
However, it seems clearer to include the check.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20220111171048.3545974-14-peter.maydell@linaro.org
---
hw/intc/arm_gicv3_its.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c
index ef6c0f55ff9..b2f6a8c7f00 100644
--- a/hw/intc/arm_gicv3_its.c
+++ b/hw/intc/arm_gicv3_its.c
@@ -299,6 +299,13 @@ static ItsCmdResult process_its_cmd(GICv3ITSState *s,
uint64_t value,
return CMD_CONTINUE;
}
+ if (icid >= s->ct.num_ids) {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "%s: invalid ICID 0x%x in ITE (table corrupted?)\n",
+ __func__, icid);
+ return CMD_CONTINUE;
+ }
+
cte_valid = get_cte(s, icid, &cte, &res);
if (res != MEMTX_OK) {
return CMD_STALL;
--
2.25.1
- [PULL 24/38] hw/arm/aspeed: Add the i3c device to the AST2600 SoC, (continued)
- [PULL 24/38] hw/arm/aspeed: Add the i3c device to the AST2600 SoC, Peter Maydell, 2022/01/20
- [PULL 36/38] hw/intc/arm_gicv3_its: Check indexes before use, not after, Peter Maydell, 2022/01/20
- [PULL 28/38] hw/intc/arm_gicv3_its: Don't use data if reading command failed, Peter Maydell, 2022/01/20
- [PULL 30/38] hw/intc/arm_gicv3_its: Fix return codes in process_its_cmd(), Peter Maydell, 2022/01/20
- [PULL 19/38] hw/arm/virt: Use the PA range to compute the memory map, Peter Maydell, 2022/01/20
- [PULL 27/38] hw/intc/arm_gicv3_its: Fix handling of process_its_cmd() return value, Peter Maydell, 2022/01/20
- [PULL 25/38] hw/intc/arm_gicv3_its: Fix event ID bounds checks, Peter Maydell, 2022/01/20
- [PULL 26/38] hw/intc/arm_gicv3_its: Convert int ID check to num_intids convention, Peter Maydell, 2022/01/20
- [PULL 32/38] hw/intc/arm_gicv3_its: Fix return codes in process_mapti(), Peter Maydell, 2022/01/20
- [PULL 33/38] hw/intc/arm_gicv3_its: Fix return codes in process_mapc(), Peter Maydell, 2022/01/20
- [PULL 37/38] hw/intc/arm_gicv3_its: Range-check ICID before indexing into collection table,
Peter Maydell <=
- [PULL 38/38] hw/intc/arm_gicv3: Check for !MEMTX_OK instead of MEMTX_ERROR, Peter Maydell, 2022/01/20