intel_iommu: Check address mask before using it in pasid-based iotlb invalidation
Prevent a buggy driver to execute malformed invalidation operations. Add the same assert as in vtd_iotlb_page_invalidate. Link: https://gitlab.com/qemu-project/qemu/-/work_items/3619 Fixes: 6ebe6cf2a066 ("intel_iommu: Process PASID-based iotlb invalidation") Reported-by: huntr bubble <bubblehuntr@gmail.com> Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@bull.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Message-ID: <20260724111424.376680-1-clement.mathieu--drif@bull.com>
Clément MATHIEU--DRIF committed
Jul 24, 2026 at 11:15 UTC
0691bb257a7cbfd62127208b49988705bfa2dfe8
1 file changed
+9
hw/i386/intel_iommu.c
+9
@@ -3021,6 +3021,8 @@ static void vtd_piotlb_page_invalidate(IntelIOMMUState *s, uint16_t domain_id,
3021
{
3022
VTDIOTLBPageInvInfo info;
3023
3024
+ assert(am <= VTD_MAMV);
3025
+
3026
info.domain_id = domain_id;
3027
info.pasid = pasid;
3028
info.addr = addr;
@@ -3060,6 +3062,13 @@ static bool vtd_process_piotlb_desc(IntelIOMMUState *s,
3062
3063
case VTD_INV_DESC_PIOTLB_PSI_IN_PASID:
3064
am = VTD_INV_DESC_PIOTLB_AM(inv_desc->val[1]);
3065
+ if (am > VTD_MAMV) {
3066
+ error_report_once("%s: invalid piotlb inv desc: hi=0x%"PRIx64
3067
+ ", lo=0x%"PRIx64" (am=%u > VTD_MAMV=%llu)",
3068
+ __func__, inv_desc->val[1], inv_desc->val[0],
3069
+ am, VTD_MAMV);
3070
+ return false;
3071
+ }
3072
addr = (hwaddr) VTD_INV_DESC_PIOTLB_ADDR(inv_desc->val[1]);
3073
vtd_piotlb_page_invalidate(s, domain_id, pasid, addr, am,
3074
VTD_INV_DESC_PIOTLB_IH(inv_desc));