ShuriZma
/
xemu
mirror of https://github.com/xemu-project/xemu.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

target/arm: Fix sve_probe_page 

Don't dereference CPUTLBEntryFull until we verify that
the page is valid.  Move the other user-only info field
updates after the valid check to match.

Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1412
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20230104190056.305143-1-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
(cherry picked from commit ce848378b9)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
This commit is contained in:
Richard Henderson 2023-01-04 11:00:56 -08:00 committed by Michael Tokarev
parent f549ee8c25
commit de605876eb
1 changed files with 9 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
target/arm/sve_helper.c
View File

@ -5354,15 +5354,10 @@ bool sve_probe_page(SVEHostPage *info, bool nofault, CPUARMState *env,
#ifdef CONFIG_USER_ONLY #ifdef CONFIG_USER_ONLY
flags = probe_access_flags(env, addr, access_type, mmu_idx, nofault, flags = probe_access_flags(env, addr, access_type, mmu_idx, nofault,
&info->host, retaddr); &info->host, retaddr);
memset(&info->attrs, 0, sizeof(info->attrs));
/* Require both ANON and MTE; see allocation_tag_mem(). */
info->tagged = (flags & PAGE_ANON) && (flags & PAGE_MTE);
#else #else
CPUTLBEntryFull *full; CPUTLBEntryFull *full;
flags = probe_access_full(env, addr, access_type, mmu_idx, nofault, flags = probe_access_full(env, addr, access_type, mmu_idx, nofault,
&info->host, &full, retaddr); &info->host, &full, retaddr);
info->attrs = full->attrs;
info->tagged = full->pte_attrs == 0xf0;
#endif #endif
info->flags = flags; info->flags = flags;
@ -5371,6 +5366,15 @@ bool sve_probe_page(SVEHostPage *info, bool nofault, CPUARMState *env,
return false; return false;
} }
#ifdef CONFIG_USER_ONLY
memset(&info->attrs, 0, sizeof(info->attrs));
/* Require both ANON and MTE; see allocation_tag_mem(). */
info->tagged = (flags & PAGE_ANON) && (flags & PAGE_MTE);
#else
info->attrs = full->attrs;
info->tagged = full->pte_attrs == 0xf0;
#endif
/* Ensure that info->host[] is relative to addr, not addr + mem_off. */ /* Ensure that info->host[] is relative to addr, not addr + mem_off. */
info->host -= mem_off; info->host -= mem_off;
return true; return true;