hw/arm/smmuv3: Fix possible overflow in strtab_base computation
In the linear stream table mode (FMT = 0), if the guest programs SMMU_STRTAB_BASE_CFG.LOG2SIZE (8 bits) to something bigger than 58, MAKE_64BIT_MASK() will overflow. So cap the mask length to 64. We still comply with the spec ADDR alignment computation: ADDR[LOG2SIZE + 5:0] = 0. In the 2 level stream table mode (FMT = 1), we don't have this risk anymore since SPLIT is sanitized and equals to 6 at minimum. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3632 Signed-off-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Shameer Kolothum <skolothumtho@nvidia.com> Message-id: 20260707085028.165557-4-eric.auger@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Eric Auger committed
Jul 13, 2026 at 12:34 UTC
312050b30267ac6a09b28a94fb916c30dda4814e
1 file changed
+1
hw/arm/smmuv3.c
+1
@@ -730,6 +730,7 @@ int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste, SMMUEventInfo *event)
730
addr = l2ptr + l2_ste_offset * sizeof(*ste);
731
} else {
732
strtab_size = log2size + STE_SIZE;
733
+ strtab_size = MIN(64, strtab_size);
734
strtab_base = s->strtab_base & SMMU_BASE_ADDR_MASK &
735
~MAKE_64BIT_MASK(0, strtab_size);
736
addr = strtab_base + sid * sizeof(*ste);