@samitouri / QOSamiQemu / commits / eea4de1bd8

hw/watchdog: Add lower bound check for watchdogNumber

Add missing lower bound check for H_WATCHDOG H_CALL's watchdogNumber parameter as per PAPR documentation ver 12.10.00 section 14.15.5 'H_WATCHDOG'. Closes : https://gitlab.com/qemu-project/qemu/-/work_items/3600 Reviewed-by: Amit Machhiwal <amachhiw@linux.ibm.com> Reported-by: huntr bubble <bubblehuntr@gmail.com> Signed-off-by: Chinmay Rath <rathc@linux.ibm.com> Link: https://lore.kernel.org/qemu-devel/20260818104551.76023-1-rathc@linux.ibm.com [harshpb: corrected title prefix to hw/watchdog] Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>

Chinmay Rath committed Aug 18, 2026 at 16:15 UTC eea4de1bd8e8bdaa9a69b130a1a154f7c113979f
1 file changed +11 -5
hw/watchdog/spapr_watchdog.c
+11 -5
@@ -127,6 +127,12 @@ static void watchdog_expired(void *pw)
127 }
128 }
129
130 +static inline bool watchdog_number_valid(target_ulong watchdogNumber,
131 + SpaprMachineState *spapr)
132 +{
133 + return watchdogNumber >= 1 && watchdogNumber <= ARRAY_SIZE(spapr->wds);
134 +}
135 +
136 static target_ulong h_watchdog(PowerPCCPU *cpu,
137 SpaprMachineState *spapr,
138 target_ulong opcode, target_ulong *args)
@@ -145,7 +151,7 @@ static target_ulong h_watchdog(PowerPCCPU *cpu,
151
152 switch (operation) {
153 case PSERIES_WDTF_OP_START:
148 - if (watchdogNumber > ARRAY_SIZE(spapr->wds)) {
154 + if (!watchdog_number_valid(watchdogNumber, spapr)) {
155 return H_P2;
156 }
157 if (timeoutInMs <= WDT_MIN_TIMEOUT) {
@@ -170,11 +176,11 @@ static target_ulong h_watchdog(PowerPCCPU *cpu,
176 case PSERIES_WDTF_OP_STOP:
177 if (watchdogNumber == PSERIES_WDT_STOP_ALL) {
178 ret = watchdog_stop_all(spapr);
173 - } else if (watchdogNumber <= ARRAY_SIZE(spapr->wds)) {
179 + } else if (!watchdog_number_valid(watchdogNumber, spapr)) {
180 + return H_P2;
181 + } else {
182 ret = watchdog_stop(watchdogNumber,
183 &spapr->wds[watchdogNumber - 1]);
176 - } else {
177 - return H_P2;
184 }
185 break;
186 case PSERIES_WDTF_OP_QUERY:
@@ -184,7 +190,7 @@ static target_ulong h_watchdog(PowerPCCPU *cpu,
190 trace_spapr_watchdog_query(args[0]);
191 break;
192 case PSERIES_WDTF_OP_QUERY_LPM:
187 - if (watchdogNumber > ARRAY_SIZE(spapr->wds)) {
193 + if (!watchdog_number_valid(watchdogNumber, spapr)) {
194 return H_P2;
195 }
196 args[0] = PSERIES_WDTQL_QUERY_NOT_STOPPED;