OpenE2K/qemu-e2k
13
4
Fork 0
Code Issues 4 Pull Requests Projects 2 Releases Activity

hw/intc/arm_gicv3_its: Check indexes before use, not after

Browse Source 
In a few places in the ITS command handling functions, we were
doing the range-check of an event ID or device ID only after using
it as a table index; move the checks to before the uses.

This misordering wouldn't have very bad effects because the
tables are in guest memory anyway.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20220111171048.3545974-13-peter.maydell@linaro.org
This commit is contained in:
Peter Maydell 2022-01-11 17:10:47 +00:00
parent d050f80f8c
commit b13148d918
1 changed files with 25 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

42
hw/intc/arm_gicv3_its.c
View File

@ -255,6 +255,13 @@ static ItsCmdResult process_its_cmd(GICv3ITSState *s, uint64_t value,
eventid = (value & EVENTID_MASK); eventid = (value & EVENTID_MASK);
if (devid >= s->dt.num_ids) {
qemu_log_mask(LOG_GUEST_ERROR,
"%s: invalid command attributes: devid %d>=%d",
__func__, devid, s->dt.num_ids);
return CMD_CONTINUE;
}
dte = get_dte(s, devid, &res); dte = get_dte(s, devid, &res);
if (res != MEMTX_OK) { if (res != MEMTX_OK) {
@ -272,6 +279,14 @@ static ItsCmdResult process_its_cmd(GICv3ITSState *s, uint64_t value,
num_eventids = 1ULL << (FIELD_EX64(dte, DTE, SIZE) + 1); num_eventids = 1ULL << (FIELD_EX64(dte, DTE, SIZE) + 1);
if (eventid >= num_eventids) {
qemu_log_mask(LOG_GUEST_ERROR,
"%s: invalid command attributes: eventid %d >= %"
PRId64 "\n",
__func__, eventid, num_eventids);
return CMD_CONTINUE;
}
ite_valid = get_ite(s, eventid, dte, &icid, &pIntid, &res); ite_valid = get_ite(s, eventid, dte, &icid, &pIntid, &res);
if (res != MEMTX_OK) { if (res != MEMTX_OK) {
return CMD_STALL; return CMD_STALL;
@ -296,20 +311,6 @@ static ItsCmdResult process_its_cmd(GICv3ITSState *s, uint64_t value,
return CMD_CONTINUE; return CMD_CONTINUE;
} }
if (devid >= s->dt.num_ids) {
qemu_log_mask(LOG_GUEST_ERROR,
"%s: invalid command attributes: devid %d>=%d",
__func__, devid, s->dt.num_ids);
return CMD_CONTINUE;
}
if (eventid >= num_eventids) {
qemu_log_mask(LOG_GUEST_ERROR,
"%s: invalid command attributes: eventid %d >= %"
PRId64 "\n",
__func__, eventid, num_eventids);
return CMD_CONTINUE;
}
/* /*
* Current implementation only supports rdbase == procnum * Current implementation only supports rdbase == procnum
* Hence rdbase physical address is ignored * Hence rdbase physical address is ignored
@ -375,6 +376,13 @@ static ItsCmdResult process_mapti(GICv3ITSState *s, uint64_t value,
icid = value & ICID_MASK; icid = value & ICID_MASK;
if (devid >= s->dt.num_ids) {
qemu_log_mask(LOG_GUEST_ERROR,
"%s: invalid command attributes: devid %d>=%d",
__func__, devid, s->dt.num_ids);
return CMD_CONTINUE;
}
dte = get_dte(s, devid, &res); dte = get_dte(s, devid, &res);
if (res != MEMTX_OK) { if (res != MEMTX_OK) {
@ -384,14 +392,14 @@ static ItsCmdResult process_mapti(GICv3ITSState *s, uint64_t value,
num_eventids = 1ULL << (FIELD_EX64(dte, DTE, SIZE) + 1); num_eventids = 1ULL << (FIELD_EX64(dte, DTE, SIZE) + 1);
num_intids = 1ULL << (GICD_TYPER_IDBITS + 1); num_intids = 1ULL << (GICD_TYPER_IDBITS + 1);
if ((devid >= s->dt.num_ids) || (icid >= s->ct.num_ids) if ((icid >= s->ct.num_ids)
|| !dte_valid || (eventid >= num_eventids) || || !dte_valid || (eventid >= num_eventids) ||
(((pIntid < GICV3_LPI_INTID_START) || (pIntid >= num_intids)) && (((pIntid < GICV3_LPI_INTID_START) || (pIntid >= num_intids)) &&
(pIntid != INTID_SPURIOUS))) { (pIntid != INTID_SPURIOUS))) {
qemu_log_mask(LOG_GUEST_ERROR, qemu_log_mask(LOG_GUEST_ERROR,
"%s: invalid command attributes " "%s: invalid command attributes "
"devid %d or icid %d or eventid %d or pIntid %d or" "icid %d or eventid %d or pIntid %d or"
"unmapped dte %d\n", __func__, devid, icid, eventid, "unmapped dte %d\n", __func__, icid, eventid,
pIntid, dte_valid); pIntid, dte_valid);
/* /*
* in this implementation, in case of error * in this implementation, in case of error