diff options
| author | Aditya Gupta <adityag@linux.ibm.com> | 2026-03-27 00:34:37 +0530 |
|---|---|---|
| committer | Michael Tokarev <mjt@tls.msk.ru> | 2026-06-24 16:35:22 +0300 |
| commit | 7f9d07e21793cad61379ac8ade34dee77bd14366 (patch) | |
| tree | 1e3de5cc5b4dccfc85a28877e66aea452c2bc472 | |
| parent | bceecd60f404c7347936ad91a63c7178aad1ca90 (diff) | |
| download | qemu-7f9d07e21793cad61379ac8ade34dee77bd14366.tar.gz qemu-7f9d07e21793cad61379ac8ade34dee77bd14366.zip | |
ppc/pnv_phb3: Error out on invalid config access
PHB in Power8 supports 8 byte registers, and hence the ops structure
allows accessing of 8 bytes in 'pnv_phb3_reg_ops'
Both 'pnv_phb3_reg_read' & 'pnv_phb3_reg_write' pass the arguments as is
to 'pnv_phb3_config_{read,write}', if offset is PHB_CONFIG_DATA.
This when called with size as 8, causes following assert failure in
'pci_host_config_read_common' & 'pci_host_config_write_common':
assert(len <= 4);
Validate that size is <=4, before jumping to pci_host_config_{read,write}_common
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3334
Reported-by: Zexiang Zhang <chan9yan9@gmail.com>
Fixes: 9ae1329ee2fe ("ppc/pnv: Add models for POWER8 PHB3 PCIe Host bridge")
Signed-off-by: Aditya Gupta <adityag@linux.ibm.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260326190438.734239-2-adityag@linux.ibm.com>
(cherry picked from commit 218109781209f9d77242b2cdf743acac8bc3b893)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
| -rw-r--r-- | hw/pci-host/pnv_phb3.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/hw/pci-host/pnv_phb3.c b/hw/pci-host/pnv_phb3.c index 5d8383fac3..6cd66e705f 100644 --- a/hw/pci-host/pnv_phb3.c +++ b/hw/pci-host/pnv_phb3.c @@ -475,6 +475,11 @@ void pnv_phb3_reg_write(void *opaque, hwaddr off, uint64_t val, unsigned size) /* Special case configuration data */ if ((off & 0xfffc) == PHB_CONFIG_DATA) { + if (size > 4) { + phb3_error(phb, "Invalid config access, offset: 0x%"PRIx64" size: %d", + off, size); + return; + } pnv_phb3_config_write(phb, off & 0x3, size, val); return; } @@ -597,6 +602,11 @@ uint64_t pnv_phb3_reg_read(void *opaque, hwaddr off, unsigned size) uint64_t val; if ((off & 0xfffc) == PHB_CONFIG_DATA) { + if (size > 4) { + phb3_error(phb, "Invalid config access, offset: 0x%"PRIx64" size: %d", + off, size); + return ~0ull; + } return pnv_phb3_config_read(phb, off & 0x3, size); } |