hw/arm/smmuv3: Check L1STD.SPAN
Span values above 11 are reserved and behave as 0. Also span must be within the range of 0 to (SMMU_STRTAB_BASE_CFG.SPLIT + 1), ie. it must stay within the bounds of the stream table split point. Signed-off-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Shameer Kolothum <skolothumtho@nvidia.com> Message-id: 20260707085028.165557-5-eric.auger@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Eric Auger committed
Jul 13, 2026 at 12:34 UTC
426a457d9b08141c35e63f3b01d7af402ee506d3
1 file changed
+11
-1
hw/arm/smmuv3.c
+11
-1
@@ -707,7 +707,7 @@ int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste, SMMUEventInfo *event)
707
708
span = L1STD_SPAN(&l1std);
709
710
- if (!span) {
710
+ if (!span || span > 11) {
711
/* l2ptr is not valid */
712
if (!event->inval_ste_allowed) {
713
qemu_log_mask(LOG_GUEST_ERROR,
@@ -716,6 +716,16 @@ int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste, SMMUEventInfo *event)
716
event->type = SMMU_EVT_C_BAD_STREAMID;
717
return -EINVAL;
718
}
719
+
720
+ if (span > s->sid_split + 1) {
721
+ if (!event->inval_ste_allowed) {
722
+ qemu_log_mask(LOG_GUEST_ERROR,
723
+ "invalid span (0x%x)\n", span);
724
+ }
725
+ event->type = SMMU_EVT_C_BAD_STREAMID;
726
+ return -EINVAL;
727
+ }
728
+
729
max_l2_ste = (1 << span) - 1;
730
l2ptr = l1std_l2ptr(&l1std);
731
trace_smmuv3_find_ste_2lvl(s->strtab_base, l1ptr, l1_ste_offset,