[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 15/21] hw/intc/arm_gic: Fix interrupt ID in GICD_SGIR register
From: |
Peter Maydell |
Subject: |
[PULL 15/21] hw/intc/arm_gic: Fix interrupt ID in GICD_SGIR register |
Date: |
Tue, 2 Feb 2021 17:55:11 +0000 |
From: Philippe Mathieu-Daudé <f4bug@amsat.org>
Per the ARM Generic Interrupt Controller Architecture specification
(document "ARM IHI 0048B.b (ID072613)"), the SGIINTID field is 4 bit,
not 10:
- 4.3 Distributor register descriptions
- 4.3.15 Software Generated Interrupt Register, GICD_SG
- Table 4-21 GICD_SGIR bit assignments
The Interrupt ID of the SGI to forward to the specified CPU
interfaces. The value of this field is the Interrupt ID, in
the range 0-15, for example a value of 0b0011 specifies
Interrupt ID 3.
Correct the irq mask to fix an undefined behavior (which eventually
lead to a heap-buffer-overflow, see [Buglink]):
$ echo 'writel 0x8000f00 0xff4affb0' | qemu-system-aarch64 -M
virt,accel=qtest -qtest stdio
[I 1612088147.116987] OPENED
[R +0.278293] writel 0x8000f00 0xff4affb0
../hw/intc/arm_gic.c:1498:13: runtime error: index 944 out of bounds for type
'uint8_t [16][8]'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior
../hw/intc/arm_gic.c:1498:13
This fixes a security issue when running with KVM on Arm with
kernel-irqchip=off. (The default is kernel-irqchip=on, which is
unaffected, and which is also the correct choice for performance.)
Cc: qemu-stable@nongnu.org
Fixes: 9ee6e8bb853 ("ARMv7 support.")
Buglink: https://bugs.launchpad.net/qemu/+bug/1913916
Buglink: https://bugs.launchpad.net/qemu/+bug/1913917
Reported-by: Alexander Bulekov <alxndr@bu.edu>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20210131103401.217160-1-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
hw/intc/arm_gic.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
index c33b1c8c4bc..a994b1f0245 100644
--- a/hw/intc/arm_gic.c
+++ b/hw/intc/arm_gic.c
@@ -1477,7 +1477,7 @@ static void gic_dist_writel(void *opaque, hwaddr offset,
int target_cpu;
cpu = gic_get_current_cpu(s);
- irq = value & 0x3ff;
+ irq = value & 0xf;
switch ((value >> 24) & 3) {
case 0:
mask = (value >> 16) & ALL_CPU_MASK;
--
2.20.1
- [PULL 02/21] hw/char/exynos4210_uart: Fix buffer size reporting with FIFO disabled, (continued)
- [PULL 02/21] hw/char/exynos4210_uart: Fix buffer size reporting with FIFO disabled, Peter Maydell, 2021/02/02
- [PULL 05/21] hw/ssi: imx_spi: Use a macro for number of chip selects supported, Peter Maydell, 2021/02/02
- [PULL 11/21] hw/ssi: imx_spi: Disable chip selects when controller is disabled, Peter Maydell, 2021/02/02
- [PULL 08/21] hw/ssi: imx_spi: Rework imx_spi_reset() to keep CONREG register value, Peter Maydell, 2021/02/02
- [PULL 07/21] hw/ssi: imx_spi: Remove pointless variable initialization, Peter Maydell, 2021/02/02
- [PULL 01/21] hw/intc/arm_gic: Allow to use QTest without crashing, Peter Maydell, 2021/02/02
- [PULL 04/21] hw/arm/smmuv3: Fix addr_mask for range-based invalidation, Peter Maydell, 2021/02/02
- [PULL 09/21] hw/ssi: imx_spi: Rework imx_spi_read() to handle block disabled, Peter Maydell, 2021/02/02
- [PULL 13/21] hw/ssi: imx_spi: Correct the burst length > 32 bit transfer logic, Peter Maydell, 2021/02/02
- [PULL 16/21] hw/arm/stm32f405_soc: Add missing dependency on OR_IRQ, Peter Maydell, 2021/02/02
- [PULL 15/21] hw/intc/arm_gic: Fix interrupt ID in GICD_SGIR register,
Peter Maydell <=
- [PULL 12/21] hw/ssi: imx_spi: Round up the burst length to be multiple of 8, Peter Maydell, 2021/02/02
- [PULL 17/21] hw/arm/exynos4210: Add missing dependency on OR_IRQ, Peter Maydell, 2021/02/02
- [PULL 18/21] hw/arm/xlnx-versal: Versal SoC requires ZDMA, Peter Maydell, 2021/02/02
- [PULL 20/21] hw/net/can: ZynqMP CAN device requires PTIMER, Peter Maydell, 2021/02/02
- [PULL 06/21] hw/ssi: imx_spi: Remove imx_spi_update_irq() in imx_spi_reset(), Peter Maydell, 2021/02/02
- [PULL 10/21] hw/ssi: imx_spi: Rework imx_spi_write() to handle block disabled, Peter Maydell, 2021/02/02
- [PULL 14/21] hw/ssi: imx_spi: Correct tx and rx fifo endianness, Peter Maydell, 2021/02/02
- [PULL 21/21] hw/arm: Display CPU type in machine description, Peter Maydell, 2021/02/02
- [PULL 19/21] hw/arm/xlnx-versal: Versal SoC requires ZynqMP peripherals, Peter Maydell, 2021/02/02
- Re: [PULL 00/21] target-arm queue, Philippe Mathieu-Daudé, 2021/02/03