From 426a457d9b08141c35e63f3b01d7af402ee506d3 Mon Sep 17 00:00:00 2001 From: Eric Auger Date: Mon, 13 Jul 2026 12:34:17 +0100 Subject: [PATCH] hw/arm/smmuv3: Check L1STD.SPAN Span values above 11 are reserved and behave as 0. Also span must be within the range of 0 to (SMMU_STRTAB_BASE_CFG.SPLIT + 1), ie. it must stay within the bounds of the stream table split point. Signed-off-by: Eric Auger Reviewed-by: Shameer Kolothum Message-id: 20260707085028.165557-5-eric.auger@redhat.com Signed-off-by: Peter Maydell --- hw/arm/smmuv3.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c index 3fd1dd7cf8..9008ba7acd 100644 --- a/hw/arm/smmuv3.c +++ b/hw/arm/smmuv3.c @@ -707,7 +707,7 @@ int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste, SMMUEventInfo *event) span = L1STD_SPAN(&l1std); - if (!span) { + if (!span || span > 11) { /* l2ptr is not valid */ if (!event->inval_ste_allowed) { qemu_log_mask(LOG_GUEST_ERROR, @@ -716,6 +716,16 @@ int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste, SMMUEventInfo *event) event->type = SMMU_EVT_C_BAD_STREAMID; return -EINVAL; } + + if (span > s->sid_split + 1) { + if (!event->inval_ste_allowed) { + qemu_log_mask(LOG_GUEST_ERROR, + "invalid span (0x%x)\n", span); + } + event->type = SMMU_EVT_C_BAD_STREAMID; + return -EINVAL; + } + max_l2_ste = (1 << span) - 1; l2ptr = l1std_l2ptr(&l1std); trace_smmuv3_find_ste_2lvl(s->strtab_base, l1ptr, l1_ste_offset,