[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 36/38] hw/intc/arm_gicv3_its: Check indexes before use, not after
From: |
Peter Maydell |
Subject: |
[PULL 36/38] hw/intc/arm_gicv3_its: Check indexes before use, not after |
Date: |
Thu, 20 Jan 2022 12:36:28 +0000 |
In a few places in the ITS command handling functions, we were
doing the range-check of an event ID or device ID only after using
it as a table index; move the checks to before the uses.
This misordering wouldn't have very bad effects because the
tables are in guest memory anyway.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20220111171048.3545974-13-peter.maydell@linaro.org
---
hw/intc/arm_gicv3_its.c | 42 ++++++++++++++++++++++++-----------------
1 file changed, 25 insertions(+), 17 deletions(-)
diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c
index 985e316eda9..ef6c0f55ff9 100644
--- a/hw/intc/arm_gicv3_its.c
+++ b/hw/intc/arm_gicv3_its.c
@@ -255,6 +255,13 @@ static ItsCmdResult process_its_cmd(GICv3ITSState *s,
uint64_t value,
eventid = (value & EVENTID_MASK);
+ if (devid >= s->dt.num_ids) {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "%s: invalid command attributes: devid %d>=%d",
+ __func__, devid, s->dt.num_ids);
+ return CMD_CONTINUE;
+ }
+
dte = get_dte(s, devid, &res);
if (res != MEMTX_OK) {
@@ -272,6 +279,14 @@ static ItsCmdResult process_its_cmd(GICv3ITSState *s,
uint64_t value,
num_eventids = 1ULL << (FIELD_EX64(dte, DTE, SIZE) + 1);
+ if (eventid >= num_eventids) {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "%s: invalid command attributes: eventid %d >= %"
+ PRId64 "\n",
+ __func__, eventid, num_eventids);
+ return CMD_CONTINUE;
+ }
+
ite_valid = get_ite(s, eventid, dte, &icid, &pIntid, &res);
if (res != MEMTX_OK) {
return CMD_STALL;
@@ -296,20 +311,6 @@ static ItsCmdResult process_its_cmd(GICv3ITSState *s,
uint64_t value,
return CMD_CONTINUE;
}
- if (devid >= s->dt.num_ids) {
- qemu_log_mask(LOG_GUEST_ERROR,
- "%s: invalid command attributes: devid %d>=%d",
- __func__, devid, s->dt.num_ids);
- return CMD_CONTINUE;
- }
- if (eventid >= num_eventids) {
- qemu_log_mask(LOG_GUEST_ERROR,
- "%s: invalid command attributes: eventid %d >= %"
- PRId64 "\n",
- __func__, eventid, num_eventids);
- return CMD_CONTINUE;
- }
-
/*
* Current implementation only supports rdbase == procnum
* Hence rdbase physical address is ignored
@@ -375,6 +376,13 @@ static ItsCmdResult process_mapti(GICv3ITSState *s,
uint64_t value,
icid = value & ICID_MASK;
+ if (devid >= s->dt.num_ids) {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "%s: invalid command attributes: devid %d>=%d",
+ __func__, devid, s->dt.num_ids);
+ return CMD_CONTINUE;
+ }
+
dte = get_dte(s, devid, &res);
if (res != MEMTX_OK) {
@@ -384,14 +392,14 @@ static ItsCmdResult process_mapti(GICv3ITSState *s,
uint64_t value,
num_eventids = 1ULL << (FIELD_EX64(dte, DTE, SIZE) + 1);
num_intids = 1ULL << (GICD_TYPER_IDBITS + 1);
- if ((devid >= s->dt.num_ids) || (icid >= s->ct.num_ids)
+ if ((icid >= s->ct.num_ids)
|| !dte_valid || (eventid >= num_eventids) ||
(((pIntid < GICV3_LPI_INTID_START) || (pIntid >= num_intids)) &&
(pIntid != INTID_SPURIOUS))) {
qemu_log_mask(LOG_GUEST_ERROR,
"%s: invalid command attributes "
- "devid %d or icid %d or eventid %d or pIntid %d or"
- "unmapped dte %d\n", __func__, devid, icid, eventid,
+ "icid %d or eventid %d or pIntid %d or"
+ "unmapped dte %d\n", __func__, icid, eventid,
pIntid, dte_valid);
/*
* in this implementation, in case of error
--
2.25.1
- [PULL 06/38] hw/arm/virt: Support cluster level in DT cpu-map, (continued)
- [PULL 06/38] hw/arm/virt: Support cluster level in DT cpu-map, Peter Maydell, 2022/01/20
- [PULL 04/38] hw/net: Move MV88W8618 network device out of hw/arm/ directory, Peter Maydell, 2022/01/20
- [PULL 03/38] hw/arm/musicpal: Fix coding style of code related to MV88W8618 device, Peter Maydell, 2022/01/20
- [PULL 16/38] hw/arm/virt: Add a control for the the highmem PCIe MMIO, Peter Maydell, 2022/01/20
- [PULL 13/38] hw/arm/virt: Support for virtio-mem-pci, Peter Maydell, 2022/01/20
- [PULL 10/38] tests/acpi/bios-table-test: Update expected virt/PPTT file, Peter Maydell, 2022/01/20
- [PULL 11/38] docs/can: convert to restructuredText, Peter Maydell, 2022/01/20
- [PULL 15/38] hw/intc/arm_gic: Allow reset of the running priority, Peter Maydell, 2022/01/20
- [PULL 21/38] hw/arm/virt: Drop superfluous checks against highmem, Peter Maydell, 2022/01/20
- [PULL 24/38] hw/arm/aspeed: Add the i3c device to the AST2600 SoC, Peter Maydell, 2022/01/20
- [PULL 36/38] hw/intc/arm_gicv3_its: Check indexes before use, not after,
Peter Maydell <=
- [PULL 28/38] hw/intc/arm_gicv3_its: Don't use data if reading command failed, Peter Maydell, 2022/01/20
- [PULL 30/38] hw/intc/arm_gicv3_its: Fix return codes in process_its_cmd(), Peter Maydell, 2022/01/20
- [PULL 19/38] hw/arm/virt: Use the PA range to compute the memory map, Peter Maydell, 2022/01/20
- [PULL 27/38] hw/intc/arm_gicv3_its: Fix handling of process_its_cmd() return value, Peter Maydell, 2022/01/20
- [PULL 25/38] hw/intc/arm_gicv3_its: Fix event ID bounds checks, Peter Maydell, 2022/01/20
- [PULL 26/38] hw/intc/arm_gicv3_its: Convert int ID check to num_intids convention, Peter Maydell, 2022/01/20
- [PULL 32/38] hw/intc/arm_gicv3_its: Fix return codes in process_mapti(), Peter Maydell, 2022/01/20
- [PULL 33/38] hw/intc/arm_gicv3_its: Fix return codes in process_mapc(), Peter Maydell, 2022/01/20
- [PULL 37/38] hw/intc/arm_gicv3_its: Range-check ICID before indexing into collection table, Peter Maydell, 2022/01/20
- [PULL 38/38] hw/intc/arm_gicv3: Check for !MEMTX_OK instead of MEMTX_ERROR, Peter Maydell, 2022/01/20