diff options
| author | Peter Maydell <peter.maydell@linaro.org> | 2026-03-06 15:40:16 +0000 |
|---|---|---|
| committer | Michael Tokarev <mjt@tls.msk.ru> | 2026-03-11 16:41:49 +0300 |
| commit | 92a24cdbcca3a6bbaf9c5b39f0eebf687169745b (patch) | |
| tree | a5a9a1f9ccfff71581cc26f1a1725424b8eae298 | |
| parent | 3308cb1fcece1bb3472c0e7bc7d360c7c8467726 (diff) | |
| download | qemu-92a24cdbcca3a6bbaf9c5b39f0eebf687169745b.tar.gz qemu-92a24cdbcca3a6bbaf9c5b39f0eebf687169745b.zip | |
hw/net/npcm_gmac: Catch accesses off the end of the register array
In the npcm_gmac device, we create the iomem MemoryRegion with
a size of 8KB, but NPCM_GMAC_NR_REGS is only 0x1060 / 4. This
means there's a range of offsets that the guest can access
that don't have gmac->regs[] entries. We weren't catching this,
so the guest could get us to index off the end of the regs array.
Catch and log these invalid accesses.
Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3316
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20260306154016.2194091-1-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
(cherry picked from commit 550391c7134d295d73b2b0e7a1111a922b78c13c)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
| -rw-r--r-- | hw/net/npcm_gmac.c | 14 | ||||
| -rw-r--r-- | include/hw/net/npcm_gmac.h | 3 |
2 files changed, 16 insertions, 1 deletions
diff --git a/hw/net/npcm_gmac.c b/hw/net/npcm_gmac.c index 5e32cd3edf..176cd604d8 100644 --- a/hw/net/npcm_gmac.c +++ b/hw/net/npcm_gmac.c @@ -700,6 +700,13 @@ static uint64_t npcm_gmac_read(void *opaque, hwaddr offset, unsigned size) NPCMGMACState *gmac = opaque; uint32_t v = 0; + if (offset >= NPCM_GMAC_REG_SIZE) { + qemu_log_mask(LOG_GUEST_ERROR, + "%s: invalid register offset: 0x%04" HWADDR_PRIx"\n", + DEVICE(gmac)->canonical_path, offset); + return v; + } + switch (offset) { /* Write only registers */ case A_NPCM_DMA_XMT_POLL_DEMAND: @@ -724,6 +731,13 @@ static void npcm_gmac_write(void *opaque, hwaddr offset, trace_npcm_gmac_reg_write(DEVICE(gmac)->canonical_path, offset, v); + if (offset >= NPCM_GMAC_REG_SIZE) { + qemu_log_mask(LOG_GUEST_ERROR, + "%s: invalid register offset: 0x%04" HWADDR_PRIx"\n", + DEVICE(gmac)->canonical_path, offset); + return; + } + switch (offset) { /* Read only registers */ case A_NPCM_GMAC_VERSION: diff --git a/include/hw/net/npcm_gmac.h b/include/hw/net/npcm_gmac.h index 6340ffe92c..0c21b25a82 100644 --- a/include/hw/net/npcm_gmac.h +++ b/include/hw/net/npcm_gmac.h @@ -24,7 +24,8 @@ #include "hw/sysbus.h" #include "net/net.h" -#define NPCM_GMAC_NR_REGS (0x1060 / sizeof(uint32_t)) +#define NPCM_GMAC_REG_SIZE 0x1060 +#define NPCM_GMAC_NR_REGS (NPCM_GMAC_REG_SIZE / sizeof(uint32_t)) #define NPCM_GMAC_MAX_PHYS 32 #define NPCM_GMAC_MAX_PHY_REGS 32 |