From: Junjie Cao <[email protected]>
A buggy or malicious guest can program a committed HDM decoder with a
reserved Interleave Ways encoding (e.g. 0x5-0x7, 0xb-0xf). Two call
sites pass &error_fatal to cxl_interleave_ways_dec(), which calls
exit(1) on the reserved encoding before the subsequent decoded_iw == 0
guards can run:
- cxl-host.c update_non_interleaved(): called at commit time from
hdm_decoder_commit() via cfmws_update_non_interleaved(), so a guest
writing COMMIT with a reserved IW terminates QEMU immediately. This
is the primary trigger on the current tree.
- cxl_type3.c cxl_type3_dpa(): called on memory access while iterating
past committed decoders to accumulate dpa_base. Once the commit-time
exit is removed, the decoder stays committed with the reserved
encoding, so a later guest access outside that decoder's range would
otherwise hit this second &error_fatal; both are fixed here.
Pass NULL instead of &error_fatal at both sites so that the reserved
encoding returns zero and the existing guards handle it gracefully.
This can be reproduced by writing the HDM Decoder 0 Control register
with a reserved IW encoding and the COMMIT bit set (e.g. IW=0x5,
COMMIT=1).
Cc: [email protected]
Fixes: 680935c9a6ff ("hw/cxl: Add a performant (and correct) path for the non
interleaved cases")
Fixes: 48461825af1b ("hw/mem/cxl_type3: Fix potential divide by zero reported
by coverity")
Signed-off-by: Junjie Cao <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Message-ID: <[email protected]>
(cherry picked from commit 713e7e85a2b43e9d4e58d91643aef230d2c30b07)
(Mjt: drop changes to hw/cxl/cxl-host.c for code introduced in
v11.0.0-1291-g680935c9a6ff "hw/cxl: Add a performant (and correct) path for
the non interleaved cases")
Signed-off-by: Michael Tokarev <[email protected]>
diff --git a/hw/mem/cxl_type3.c b/hw/mem/cxl_type3.c
index b06f2ed32aa..df2a2fa6345 100644
--- a/hw/mem/cxl_type3.c
+++ b/hw/mem/cxl_type3.c
@@ -1093,7 +1093,7 @@ static bool cxl_type3_dpa(CXLType3Dev *ct3d, hwaddr
host_addr, uint64_t *dpa)
}
if (((uint64_t)host_addr < decoder_base) ||
(hpa_offset >= decoder_size)) {
- int decoded_iw = cxl_interleave_ways_dec(iw, &error_fatal);
+ int decoded_iw = cxl_interleave_ways_dec(iw, NULL);
if (decoded_iw == 0) {
return false;
--
2.47.3
