mirror of https://github.com/xemu-project/xemu.git
604927e357
r[id]tlb[01], [iw][id]tlb opcodes use TLB way index passed in a register
by the guest. The host uses 3 bits of the index for ITLB indexing and 4
bits for DTLB, but there's only 7 entries in the ITLB array and 10 in
the DTLB array, so a malicious guest may trigger out-of-bound access to
these arrays.
Change split_tlb_entry_spec return type to bool to indicate whether TLB
way passed to it is valid. Change get_tlb_entry to return NULL in case
invalid TLB way is requested. Add assertion to xtensa_tlb_get_entry that
requested TLB way and entry indices are valid. Add checks to the
[rwi]tlb helpers that requested TLB way is valid and return 0 or do
nothing when it's not.
Cc: qemu-stable@nongnu.org
Fixes:
|
||
|---|---|---|
| .. | ||
| core-dc232b | ||
| core-dc233c | ||
| core-de212 | ||
| core-de233_fpu | ||
| core-dsp3400 | ||
| core-fsf | ||
| core-lx106 | ||
| core-sample_controller | ||
| core-test_kc705_be | ||
| core-test_mmuhifi_c3 | ||
| Kconfig | ||
| core-dc232b.c | ||
| core-dc233c.c | ||
| core-de212.c | ||
| core-de233_fpu.c | ||
| core-dsp3400.c | ||
| core-fsf.c | ||
| core-lx106.c | ||
| core-sample_controller.c | ||
| core-test_kc705_be.c | ||
| core-test_mmuhifi_c3.c | ||
| cores.list | ||
| cpu-param.h | ||
| cpu-qom.h | ||
| cpu.c | ||
| cpu.h | ||
| dbg_helper.c | ||
| exc_helper.c | ||
| fpu_helper.c | ||
| gdbstub.c | ||
| helper.c | ||
| helper.h | ||
| import_core.sh | ||
| meson.build | ||
| mmu_helper.c | ||
| monitor.c | ||
| op_helper.c | ||
| overlay_tool.h | ||
| translate.c | ||
| win_helper.c | ||
| xtensa-isa-internal.h | ||
| xtensa-isa.c | ||
| xtensa-isa.h | ||
| xtensa-semi.c | ||