In allwinner_h3_dramc_map_rows(), we take a row_bits count from a
register, and calculate (1 << (row_bits - 3)). If the guest programs
row_bits to less than 3 then this is undefined behaviour.
Treat overly small row_bits values as "doesn't match actual RAM
size".
Fixes: b71d0385e97e ("hw/arm/allwinner-h3: add SDRAM controller device")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4210
Signed-off-by: Peter Maydell <[email protected]>
---
hw/misc/allwinner-h3-dramc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/misc/allwinner-h3-dramc.c b/hw/misc/allwinner-h3-dramc.c
index 10d929a3039..2a4b33aa182 100644
--- a/hw/misc/allwinner-h3-dramc.c
+++ b/hw/misc/allwinner-h3-dramc.c
@@ -78,7 +78,7 @@ static void allwinner_h3_dramc_map_rows(AwH3DramCtlState *s,
uint8_t row_bits,
}
}
- if (s->ram_size == (1 << (row_bits - 3))) {
+ if (row_bits >= 3 && s->ram_size == (1 << (row_bits - 3))) {
/* When row bits is the expected value, remove the mirror */
memory_region_set_enabled(&s->row_mirror_alias, false);
trace_allwinner_h3_dramc_rowmirror_disable();
--
2.43.0
