hw/watchdog: Add lower bound check for watchdogNumber
Add missing lower bound check for H_WATCHDOG H_CALL's watchdogNumber parameter as per PAPR documentation ver 12.10.00 section 14.15.5 'H_WATCHDOG'. Closes : https://gitlab.com/qemu-project/qemu/-/work_items/3600 Reviewed-by: Amit Machhiwal <amachhiw@linux.ibm.com> Reported-by: huntr bubble <bubblehuntr@gmail.com> Signed-off-by: Chinmay Rath <rathc@linux.ibm.com> Link: https://lore.kernel.org/qemu-devel/20260818104551.76023-1-rathc@linux.ibm.com [harshpb: corrected title prefix to hw/watchdog] Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Chinmay Rath committed
Aug 18, 2026 at 16:15 UTC
eea4de1bd8e8bdaa9a69b130a1a154f7c113979f
1 file changed
+11
-5
hw/watchdog/spapr_watchdog.c
+11
-5
@@ -127,6 +127,12 @@ static void watchdog_expired(void *pw)
127
}
128
}
129
130
+static inline bool watchdog_number_valid(target_ulong watchdogNumber,
131
+ SpaprMachineState *spapr)
132
+{
133
+ return watchdogNumber >= 1 && watchdogNumber <= ARRAY_SIZE(spapr->wds);
134
+}
135
+
136
static target_ulong h_watchdog(PowerPCCPU *cpu,
137
SpaprMachineState *spapr,
138
target_ulong opcode, target_ulong *args)
@@ -145,7 +151,7 @@ static target_ulong h_watchdog(PowerPCCPU *cpu,
151
152
switch (operation) {
153
case PSERIES_WDTF_OP_START:
148
- if (watchdogNumber > ARRAY_SIZE(spapr->wds)) {
154
+ if (!watchdog_number_valid(watchdogNumber, spapr)) {
155
return H_P2;
156
}
157
if (timeoutInMs <= WDT_MIN_TIMEOUT) {
@@ -170,11 +176,11 @@ static target_ulong h_watchdog(PowerPCCPU *cpu,
176
case PSERIES_WDTF_OP_STOP:
177
if (watchdogNumber == PSERIES_WDT_STOP_ALL) {
178
ret = watchdog_stop_all(spapr);
173
- } else if (watchdogNumber <= ARRAY_SIZE(spapr->wds)) {
179
+ } else if (!watchdog_number_valid(watchdogNumber, spapr)) {
180
+ return H_P2;
181
+ } else {
182
ret = watchdog_stop(watchdogNumber,
183
&spapr->wds[watchdogNumber - 1]);
176
- } else {
177
- return H_P2;
184
}
185
break;
186
case PSERIES_WDTF_OP_QUERY:
@@ -184,7 +190,7 @@ static target_ulong h_watchdog(PowerPCCPU *cpu,
190
trace_spapr_watchdog_query(args[0]);
191
break;
192
case PSERIES_WDTF_OP_QUERY_LPM:
187
- if (watchdogNumber > ARRAY_SIZE(spapr->wds)) {
193
+ if (!watchdog_number_valid(watchdogNumber, spapr)) {
194
return H_P2;
195
}
196
args[0] = PSERIES_WDTQL_QUERY_NOT_STOPPED;