diff options
| author | Richard Henderson <richard.henderson@linaro.org> | 2023-01-04 11:00:56 -0800 |
|---|---|---|
| committer | Peter Maydell <peter.maydell@linaro.org> | 2023-01-12 16:50:19 +0000 |
| commit | ce848378b999214777fa984a8a0a3e3deb1cf687 (patch) | |
| tree | e0b3d43535da0b22cce223fb32843eda9e939923 | |
| parent | 22bd244a1cf6fd95117f03004e8a1fc74a39311b (diff) | |
| download | qemu-ce848378b999214777fa984a8a0a3e3deb1cf687.zip qemu-ce848378b999214777fa984a8a0a3e3deb1cf687.tar.gz qemu-ce848378b999214777fa984a8a0a3e3deb1cf687.tar.bz2 | |
target/arm: Fix sve_probe_page
Don't dereference CPUTLBEntryFull until we verify that
the page is valid. Move the other user-only info field
updates after the valid check to match.
Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1412
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20230104190056.305143-1-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| -rw-r--r-- | target/arm/sve_helper.c | 14 |
1 files changed, 9 insertions, 5 deletions
diff --git a/target/arm/sve_helper.c b/target/arm/sve_helper.c index 1afeadf..521fc9b 100644 --- a/target/arm/sve_helper.c +++ b/target/arm/sve_helper.c @@ -5354,15 +5354,10 @@ bool sve_probe_page(SVEHostPage *info, bool nofault, CPUARMState *env, #ifdef CONFIG_USER_ONLY flags = probe_access_flags(env, addr, access_type, mmu_idx, nofault, &info->host, retaddr); - memset(&info->attrs, 0, sizeof(info->attrs)); - /* Require both ANON and MTE; see allocation_tag_mem(). */ - info->tagged = (flags & PAGE_ANON) && (flags & PAGE_MTE); #else CPUTLBEntryFull *full; flags = probe_access_full(env, addr, access_type, mmu_idx, nofault, &info->host, &full, retaddr); - info->attrs = full->attrs; - info->tagged = full->pte_attrs == 0xf0; #endif info->flags = flags; @@ -5371,6 +5366,15 @@ bool sve_probe_page(SVEHostPage *info, bool nofault, CPUARMState *env, return false; } +#ifdef CONFIG_USER_ONLY + memset(&info->attrs, 0, sizeof(info->attrs)); + /* Require both ANON and MTE; see allocation_tag_mem(). */ + info->tagged = (flags & PAGE_ANON) && (flags & PAGE_MTE); +#else + info->attrs = full->attrs; + info->tagged = full->pte_attrs == 0xf0; +#endif + /* Ensure that info->host[] is relative to addr, not addr + mem_off. */ info->host -= mem_off; return true; |