aboutsummaryrefslogtreecommitdiff
path: root/hw
diff options
context:
space:
mode:
authorPeter Maydell <peter.maydell@linaro.org>2022-01-11 17:10:47 +0000
committerPeter Maydell <peter.maydell@linaro.org>2022-01-20 16:04:58 +0000
commitb13148d91805143aba3e0b4441e760b9bea03b8c (patch)
tree990b1c9f9c67e48d9448b27a1b98d469e65098db /hw
parentd050f80f8c9b4e535bf2f20d5a400c231e7a5838 (diff)
downloadqemu-b13148d91805143aba3e0b4441e760b9bea03b8c.zip
qemu-b13148d91805143aba3e0b4441e760b9bea03b8c.tar.gz
qemu-b13148d91805143aba3e0b4441e760b9bea03b8c.tar.bz2
hw/intc/arm_gicv3_its: Check indexes before use, not after
In a few places in the ITS command handling functions, we were doing the range-check of an event ID or device ID only after using it as a table index; move the checks to before the uses. This misordering wouldn't have very bad effects because the tables are in guest memory anyway. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 20220111171048.3545974-13-peter.maydell@linaro.org
Diffstat (limited to 'hw')
-rw-r--r--hw/intc/arm_gicv3_its.c42
1 files changed, 25 insertions, 17 deletions
diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c
index 985e316..ef6c0f5 100644
--- a/hw/intc/arm_gicv3_its.c
+++ b/hw/intc/arm_gicv3_its.c
@@ -255,6 +255,13 @@ static ItsCmdResult process_its_cmd(GICv3ITSState *s, uint64_t value,
eventid = (value & EVENTID_MASK);
+ if (devid >= s->dt.num_ids) {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "%s: invalid command attributes: devid %d>=%d",
+ __func__, devid, s->dt.num_ids);
+ return CMD_CONTINUE;
+ }
+
dte = get_dte(s, devid, &res);
if (res != MEMTX_OK) {
@@ -272,6 +279,14 @@ static ItsCmdResult process_its_cmd(GICv3ITSState *s, uint64_t value,
num_eventids = 1ULL << (FIELD_EX64(dte, DTE, SIZE) + 1);
+ if (eventid >= num_eventids) {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "%s: invalid command attributes: eventid %d >= %"
+ PRId64 "\n",
+ __func__, eventid, num_eventids);
+ return CMD_CONTINUE;
+ }
+
ite_valid = get_ite(s, eventid, dte, &icid, &pIntid, &res);
if (res != MEMTX_OK) {
return CMD_STALL;
@@ -296,20 +311,6 @@ static ItsCmdResult process_its_cmd(GICv3ITSState *s, uint64_t value,
return CMD_CONTINUE;
}
- if (devid >= s->dt.num_ids) {
- qemu_log_mask(LOG_GUEST_ERROR,
- "%s: invalid command attributes: devid %d>=%d",
- __func__, devid, s->dt.num_ids);
- return CMD_CONTINUE;
- }
- if (eventid >= num_eventids) {
- qemu_log_mask(LOG_GUEST_ERROR,
- "%s: invalid command attributes: eventid %d >= %"
- PRId64 "\n",
- __func__, eventid, num_eventids);
- return CMD_CONTINUE;
- }
-
/*
* Current implementation only supports rdbase == procnum
* Hence rdbase physical address is ignored
@@ -375,6 +376,13 @@ static ItsCmdResult process_mapti(GICv3ITSState *s, uint64_t value,
icid = value & ICID_MASK;
+ if (devid >= s->dt.num_ids) {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "%s: invalid command attributes: devid %d>=%d",
+ __func__, devid, s->dt.num_ids);
+ return CMD_CONTINUE;
+ }
+
dte = get_dte(s, devid, &res);
if (res != MEMTX_OK) {
@@ -384,14 +392,14 @@ static ItsCmdResult process_mapti(GICv3ITSState *s, uint64_t value,
num_eventids = 1ULL << (FIELD_EX64(dte, DTE, SIZE) + 1);
num_intids = 1ULL << (GICD_TYPER_IDBITS + 1);
- if ((devid >= s->dt.num_ids) || (icid >= s->ct.num_ids)
+ if ((icid >= s->ct.num_ids)
|| !dte_valid || (eventid >= num_eventids) ||
(((pIntid < GICV3_LPI_INTID_START) || (pIntid >= num_intids)) &&
(pIntid != INTID_SPURIOUS))) {
qemu_log_mask(LOG_GUEST_ERROR,
"%s: invalid command attributes "
- "devid %d or icid %d or eventid %d or pIntid %d or"
- "unmapped dte %d\n", __func__, devid, icid, eventid,
+ "icid %d or eventid %d or pIntid %d or"
+ "unmapped dte %d\n", __func__, icid, eventid,
pIntid, dte_valid);
/*
* in this implementation, in case of error