From: Clément MATHIEU--DRIF <[email protected]> Prevent a buggy driver to execute malformed invalidation operations.
Add the same assert as in vtd_iotlb_page_invalidate. Link: https://gitlab.com/qemu-project/qemu/-/work_items/3619 Fixes: 6ebe6cf2a066 ("intel_iommu: Process PASID-based iotlb invalidation") Reported-by: huntr bubble <[email protected]> Signed-off-by: Clement Mathieu--Drif <[email protected]> Reviewed-by: Philippe Mathieu-Daudé <[email protected]> Reviewed-by: Zhenzhong Duan <[email protected]> Reviewed-by: Michael S. Tsirkin <[email protected]> Signed-off-by: Michael S. Tsirkin <[email protected]> Message-ID: <[email protected]> (cherry picked from commit 0691bb257a7cbfd62127208b49988705bfa2dfe8) Signed-off-by: Michael Tokarev <[email protected]> diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c index a117a0b6b10..23b6cdef649 100644 --- a/hw/i386/intel_iommu.c +++ b/hw/i386/intel_iommu.c @@ -2999,6 +2999,8 @@ static void vtd_piotlb_page_invalidate(IntelIOMMUState *s, uint16_t domain_id, { VTDIOTLBPageInvInfo info; + assert(am <= VTD_MAMV); + info.domain_id = domain_id; info.pasid = pasid; info.addr = addr; @@ -3037,6 +3039,13 @@ static bool vtd_process_piotlb_desc(IntelIOMMUState *s, case VTD_INV_DESC_PIOTLB_PSI_IN_PASID: am = VTD_INV_DESC_PIOTLB_AM(inv_desc->val[1]); + if (am > VTD_MAMV) { + error_report_once("%s: invalid piotlb inv desc: hi=0x%"PRIx64 + ", lo=0x%"PRIx64" (am=%u > VTD_MAMV=%llu)", + __func__, inv_desc->val[1], inv_desc->val[0], + am, VTD_MAMV); + return false; + } addr = (hwaddr) VTD_INV_DESC_PIOTLB_ADDR(inv_desc->val[1]); vtd_piotlb_page_invalidate(s, domain_id, pasid, addr, am); break; -- 2.47.3
