qemu/include/hw/net at d444e348b11b3f06a2cbbc19281095a9433355bd - qemu

Files

Peter Maydell 550391c713 hw/net/npcm_gmac: Catch accesses off the end of the register array

In the npcm_gmac device, we create the iomem MemoryRegion with
a size of 8KB, but NPCM_GMAC_NR_REGS is only 0x1060 / 4. This
means there's a range of offsets that the guest can access
that don't have gmac->regs[] entries. We weren't catching this,
so the guest could get us to index off the end of the regs array.

Catch and log these invalid accesses.

Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3316
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20260306154016.2194091-1-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>

2026-03-09 16:45:24 +01:00

allwinner_emac.h

include: move hw/sysbus.h to hw/core/

2025-12-27 10:11:08 +01:00

allwinner-sun8i-emac.h

include: move hw/sysbus.h to hw/core/

2025-12-27 10:11:08 +01:00

cadence_gem.h

include: move hw/sysbus.h to hw/core/

2025-12-27 10:11:08 +01:00

dp8393x.h

include: move hw/sysbus.h to hw/core/