@samitouri / QOSamiQemu / commits / 291aa70ad2

amd_iommu: Reject non-decreasing NextLevel in fetch_pte()

The AMD-Vi specification requires that the NextLevel field for a page table entry must not be greater or equal to the current page table entry level. Enforce this to avoid infinite page walk loops on corrupted or buggy guest page tables. The initial implementation of fetch_pte() did not implement this check, but was not vulnerable since the page walk code explicitly decremented the level instead of retrieving it from the page table entry. Cc: qemu-stable@nongnu.org Reviewed-by: Sairaj Kodilkar <sarunkod@amd.com> Signed-off-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Message-Id: <20260330212817.992673-3-alejandro.j.jimenez@oracle.com>

Alejandro Jimenez committed Mar 30, 2026 at 21:28 UTC 291aa70ad254b6c48012dbfd16a4af0978ea1b84

1 file changed +4

hw/i386/amd_iommu.c

@@ -771,6 +771,10 @@ static uint64_t fetch_pte(AMDVIAddressSpace *as, hwaddr address, uint64_t dte,

771 break;

772 }

773

774 + /* Next level must always be less than current level */

775 + if (pt_level <= next_pt_level) {

776 + return -AMDVI_FR_PT_ENTRY_INV;

777 + }

778 pt_level = next_pt_level;

779

780 /*