> -----Original Message-----
> From: Eric Auger <[email protected]>
> Sent: 01 July 2026 10:12
> To: [email protected]; [email protected]; qemu-
> [email protected]; [email protected]; [email protected];
> [email protected]; Shameer Kolothum Thodi
> <[email protected]>; Nicolin Chen <[email protected]>; Nathan
> Chen <[email protected]>
> Subject: [PATCH v2 3/5] hw/arm/smmuv3: Sanitize
> SMMU_S_STRTAB_BASE_CFG.LOG2SIZE
>
> External email: Use caution opening links or attachments
>
>
> STRTAB_BASE_CFG.LOG2SIZE is programmed by the guest through the
> emulated SMMUv3 MMIO register interface. Currently the value is
> not checked and used directly in smmu_find_ste() for strtab_base
> alignment computation with risk that MAKE_64BIT_MASK() runs out
> of bounds. On FMT==1 the strtab_size cannot be greater than 64 after
> the SPLIT being at minimum 6 (log2size is max 64).
>
> However on FMT=0 path, strtab_size= log2size + 6 can potentially
> exceed 64. Let's abort in that case.
>
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3632
> Signed-off-by: Eric Auger <[email protected]>
> ---
> hw/arm/smmuv3.c | 8 ++++++++
> 1 file changed, 8 insertions(+)
>
> diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
> index 285e6164a07..5ec3700d0d5 100644
> --- a/hw/arm/smmuv3.c
> +++ b/hw/arm/smmuv3.c
> @@ -1696,6 +1696,14 @@ static MemTxResult smmu_writel(SMMUv3State
> *s, hwaddr offset,
> s->sid_split = 6;
> }
> s->features |= SMMU_FEATURE_2LVL_STE;
> + } else {
> + uint32_t log2size = FIELD_EX32(data, STRTAB_BASE_CFG, LOG2SIZE);
> +
> + if (log2size + 6 > 64) {
> + qemu_log_mask(LOG_GUEST_ERROR,
> + "Invalid STRTAB_BASE_CFG.LOG2SIZE: %d",
> log2size);
> + g_assert_not_reached();
Ah..this will address the bound check issue I mentioned in patch #1 I guess.
But this will terminate the Guest. If we limit the strtab_size =
MIN(strtab_size, 64)
in patch #1 and patch #2 sanitises the SPLIT, do we need this patch now?
Thanks,
Shameer
> + }
> }
> break;
> case A_CMDQ_BASE: /* 64b */
> --
> 2.53.0
