From: Eric Auger <[email protected]> Span values above 11 are reserved and behave as 0.
Also span must be within the range of 0 to (SMMU_STRTAB_BASE_CFG.SPLIT + 1), ie. it must stay within the bounds of the stream table split point. Signed-off-by: Eric Auger <[email protected]> Reviewed-by: Shameer Kolothum <[email protected]> Message-id: [email protected] Signed-off-by: Peter Maydell <[email protected]> --- hw/arm/smmuv3.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c index 3fd1dd7cf81..9008ba7acd9 100644 --- a/hw/arm/smmuv3.c +++ b/hw/arm/smmuv3.c @@ -707,7 +707,7 @@ int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste, SMMUEventInfo *event) span = L1STD_SPAN(&l1std); - if (!span) { + if (!span || span > 11) { /* l2ptr is not valid */ if (!event->inval_ste_allowed) { qemu_log_mask(LOG_GUEST_ERROR, @@ -716,6 +716,16 @@ int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste, SMMUEventInfo *event) event->type = SMMU_EVT_C_BAD_STREAMID; return -EINVAL; } + + if (span > s->sid_split + 1) { + if (!event->inval_ste_allowed) { + qemu_log_mask(LOG_GUEST_ERROR, + "invalid span (0x%x)\n", span); + } + event->type = SMMU_EVT_C_BAD_STREAMID; + return -EINVAL; + } + max_l2_ste = (1 << span) - 1; l2ptr = l1std_l2ptr(&l1std); trace_smmuv3_find_ste_2lvl(s->strtab_base, l1ptr, l1_ste_offset, -- 2.43.0
