diff options
| author | Alejandro Jimenez <alejandro.j.jimenez@oracle.com> | 2026-03-30 21:28:17 +0000 |
|---|---|---|
| committer | Michael Tokarev <mjt@tls.msk.ru> | 2026-06-16 19:16:26 +0300 |
| commit | 24666f2b911813041a23a12f6300913a9ded4c40 (patch) | |
| tree | 2446dd2979005d2ab5afbdc6a8f227e8fac10bf3 | |
| parent | 52908f2cc1a7a2169989983db3476cd773830ebf (diff) | |
| download | qemu-24666f2b911813041a23a12f6300913a9ded4c40.tar.gz qemu-24666f2b911813041a23a12f6300913a9ded4c40.zip | |
amd_iommu: Reject non-decreasing NextLevel in fetch_pte()
The AMD-Vi specification requires that the NextLevel field for a page table
entry must not be greater or equal to the current page table entry level.
Enforce this to avoid infinite page walk loops on corrupted or buggy guest
page tables.
The initial implementation of fetch_pte() did not implement this check, but
was not vulnerable since the page walk code explicitly decremented the level
instead of retrieving it from the page table entry.
Cc: qemu-stable@nongnu.org
Reviewed-by: Sairaj Kodilkar <sarunkod@amd.com>
Signed-off-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260330212817.992673-3-alejandro.j.jimenez@oracle.com>
(cherry picked from commit 291aa70ad254b6c48012dbfd16a4af0978ea1b84)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
| -rw-r--r-- | hw/i386/amd_iommu.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c index bc083d0073..99b05b2ab6 100644 --- a/hw/i386/amd_iommu.c +++ b/hw/i386/amd_iommu.c @@ -771,6 +771,10 @@ static uint64_t fetch_pte(AMDVIAddressSpace *as, hwaddr address, uint64_t dte, break; } + /* Next level must always be less than current level */ + if (pt_level <= next_pt_level) { + return -AMDVI_FR_PT_ENTRY_INV; + } pt_level = next_pt_level; /* |