Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/2217904/?format=api
{ "id": 2217904, "url": "http://patchwork.ozlabs.org/api/patches/2217904/?format=api", "web_url": "http://patchwork.ozlabs.org/project/qemu-devel/patch/20260330212817.992673-3-alejandro.j.jimenez@oracle.com/", "project": { "id": 14, "url": "http://patchwork.ozlabs.org/api/projects/14/?format=api", "name": "QEMU Development", "link_name": "qemu-devel", "list_id": "qemu-devel.nongnu.org", "list_email": "qemu-devel@nongnu.org", "web_url": "", "scm_url": "", "webscm_url": "", "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<20260330212817.992673-3-alejandro.j.jimenez@oracle.com>", "list_archive_url": null, "date": "2026-03-30T21:28:17", "name": "[for-11.0,2/2] amd_iommu: Reject non-decreasing NextLevel in fetch_pte()", "commit_ref": null, "pull_url": null, "state": "new", "archived": false, "hash": "bbb2b9877429e4b984ef8460b07f4a5ccc0a4637", "submitter": { "id": 80257, "url": "http://patchwork.ozlabs.org/api/people/80257/?format=api", "name": "Alejandro Jimenez", "email": "alejandro.j.jimenez@oracle.com" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/qemu-devel/patch/20260330212817.992673-3-alejandro.j.jimenez@oracle.com/mbox/", "series": [ { "id": 498099, "url": "http://patchwork.ozlabs.org/api/series/498099/?format=api", "web_url": "http://patchwork.ozlabs.org/project/qemu-devel/list/?series=498099", "date": "2026-03-30T21:28:15", "name": "[for-11.0,1/2] amd_iommu: Follow root pointer before page walk and use 1-based levels", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/498099/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2217904/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2217904/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "<qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org>", "X-Original-To": "incoming@patchwork.ozlabs.org", "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=oracle.com header.i=@oracle.com header.a=rsa-sha256\n header.s=corp-2025-04-25 header.b=e8IozFdE;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=nongnu.org\n (client-ip=209.51.188.17; helo=lists.gnu.org;\n envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org;\n receiver=patchwork.ozlabs.org)" ], "Received": [ "from lists.gnu.org (lists.gnu.org [209.51.188.17])\n\t(using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fl4Bp5XSqz1yHC\n\tfor <incoming@patchwork.ozlabs.org>; Tue, 31 Mar 2026 08:29:21 +1100 (AEDT)", "from localhost ([::1] helo=lists1p.gnu.org)\n\tby lists.gnu.org with esmtp (Exim 4.90_1)\n\t(envelope-from <qemu-devel-bounces@nongnu.org>)\n\tid 1w7K9z-0007u5-DK; Mon, 30 Mar 2026 17:28:35 -0400", "from eggs.gnu.org ([2001:470:142:3::10])\n by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)\n (Exim 4.90_1) (envelope-from <alejandro.j.jimenez@oracle.com>)\n id 1w7K9t-0007tX-Qr\n for qemu-devel@nongnu.org; Mon, 30 Mar 2026 17:28:31 -0400", "from mx0a-00069f02.pphosted.com ([205.220.165.32])\n by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)\n (Exim 4.90_1) (envelope-from <alejandro.j.jimenez@oracle.com>)\n id 1w7K9r-0006FJ-AU\n for qemu-devel@nongnu.org; Mon, 30 Mar 2026 17:28:29 -0400", "from pps.filterd (m0246629.ppops.net [127.0.0.1])\n by mx0b-00069f02.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id\n 62UDE4rN2688916; Mon, 30 Mar 2026 21:28:20 GMT", "from iadpaimrmta03.imrmtpd1.prodappiadaev1.oraclevcn.com\n (iadpaimrmta03.appoci.oracle.com [130.35.103.27])\n by mx0b-00069f02.pphosted.com (PPS) with ESMTPS id 4d66v5k3en-1\n (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK);\n Mon, 30 Mar 2026 21:28:20 +0000 (GMT)", "from pps.filterd\n (iadpaimrmta03.imrmtpd1.prodappiadaev1.oraclevcn.com [127.0.0.1])\n by iadpaimrmta03.imrmtpd1.prodappiadaev1.oraclevcn.com (8.18.1.2/8.18.1.2)\n with ESMTP id 62UK8468036391; Mon, 30 Mar 2026 21:28:19 GMT", "from pps.reinject (localhost [127.0.0.1])\n by iadpaimrmta03.imrmtpd1.prodappiadaev1.oraclevcn.com (PPS) with ESMTPS id\n 4d65efn547-1\n (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK);\n Mon, 30 Mar 2026 21:28:19 +0000", "from iadpaimrmta03.imrmtpd1.prodappiadaev1.oraclevcn.com\n (iadpaimrmta03.imrmtpd1.prodappiadaev1.oraclevcn.com [127.0.0.1])\n by pps.reinject (8.17.1.5/8.17.1.5) with ESMTP id 62ULSIT1018888;\n Mon, 30 Mar 2026 21:28:18 GMT", "from alaljime-e5-test-20240903-1847.osdevelopmeniad.oraclevcn.com\n (alaljime-e5-test-20240903-1847.allregionaliads.osdevelopmeniad.oraclevcn.com\n [100.100.250.206])\n by iadpaimrmta03.imrmtpd1.prodappiadaev1.oraclevcn.com (PPS) with ESMTP id\n 4d65efn53s-3; Mon, 30 Mar 2026 21:28:18 +0000" ], "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=cc\n :content-transfer-encoding:date:from:in-reply-to:message-id\n :mime-version:references:subject:to; s=corp-2025-04-25; bh=PUBDt\n J6AfZbEHbQfS8h18N/UDHSyrsuMjYLAhmKpNQM=; b=e8IozFdEgIGIktsQXCc5C\n HuNKVnUw29NZKQJYs0pmfDgORMmyRV35AkAoV71I3/fJXSOD/NhQF+7j7qSAB86c\n XBgLY2EOlH60RTq6biDE4OreIuO4xC3fPU3RbqCskv9jB/TDDdHaVfSRKII+EGOe\n RUIZc6WH2lXzMluxTa9cMwf+t/QeRZ0EoufnZ5m+l/NKbTrnEfQGNAGOBtJHinKk\n a3s3tDLwbnA2Qw5yXV5eLvkEQjvQ9HJa1UGpHNpQF0LWk8RYMd3yEAJG2PWfo0n9\n /Jf26B8KdIDNVwW2SBMnxO+OXu/2LvYDeuSKqgT1FecEg/OSR4p1qt7Aerfnng/O\n w==", "From": "Alejandro Jimenez <alejandro.j.jimenez@oracle.com>", "To": "mst@redhat.com, sarunkod@amd.com, qemu@demindiro.com,\n qemu-devel@nongnu.org", "Cc": "alejandro.j.jimenez@oracle.com", "Subject": "[PATCH for-11.0 2/2] amd_iommu: Reject non-decreasing NextLevel in\n fetch_pte()", "Date": "Mon, 30 Mar 2026 21:28:17 +0000", "Message-ID": "<20260330212817.992673-3-alejandro.j.jimenez@oracle.com>", "X-Mailer": "git-send-email 2.47.3", "In-Reply-To": "<20260330212817.992673-1-alejandro.j.jimenez@oracle.com>", "References": "<20260330212817.992673-1-alejandro.j.jimenez@oracle.com>", "MIME-Version": "1.0", "Content-Transfer-Encoding": "8bit", "X-Proofpoint-Virus-Version": "vendor=baseguard\n engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.51,FMLib:17.12.100.49\n definitions=2026-03-30_01,2026-03-28_01,2025-10-01_01", "X-Proofpoint-Spam-Details": "rule=notspam policy=default score=0 mlxlogscore=999\n mlxscore=0 adultscore=0\n bulkscore=0 phishscore=0 suspectscore=0 malwarescore=0 spamscore=0\n classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2603050001\n definitions=main-2603300182", "X-Proofpoint-GUID": "93S0iHTJ_2KG967CT-dWA0_fFxS7C-Li", "X-Authority-Analysis": "v=2.4 cv=G7cR0tk5 c=1 sm=1 tr=0 ts=69caeaf4 b=1 cx=c_pps\n a=qoll8+KPOyaMroiJ2sR5sw==:117\n a=qoll8+KPOyaMroiJ2sR5sw==:17\n a=Yq5XynenixoA:10 a=VkNPw1HP01LnGYTKEx00:22 a=jiCTI4zE5U7BLdzWsZGv:22\n a=EIcjfB9IiI4px24ztqRk:22 a=69wJf7TsAAAA:8 a=zd2uoN0lAAAA:8 a=yPCof4ZbAAAA:8\n a=-NnEBHSy68KfNGN4co4A:9 a=Fg1AiH1G6rFz08G2ETeA:22 cc=ntf awl=host:12276", "X-Proofpoint-ORIG-GUID": "93S0iHTJ_2KG967CT-dWA0_fFxS7C-Li", "X-Proofpoint-Spam-Details-Enc": "AW1haW4tMjYwMzMwMDE4MiBTYWx0ZWRfX6MdBkpAgDwY2\n 09QFsxs3H/Src6HuLPHJvK7EUovIexMUgBNn+1/qxNyricjf0LECjvtoKFciKo5BFHQU4FuNXQR\n S/V4o1ENRqROLW5WkbgQ6lXWN6GOG19I55EK/kAWPTypzMFaAKxBSpnTkD4F6Q30/vW7QOMEVH+\n ehONb/LbLoJtOI0lzPGZix8F7HuBpHoOLGIkBEj+d5kUpWG0j6G48RGPa35ITlj6H5aS+Ky+pCr\n hGD3yOCQEdZGasa8CJExbtGhUJDHMHRcI+n0oo4coB5WLzK3JKcsHfkZNw3Ds2x3phSyDf/jGQg\n 7OJ66NfbRhtZhicXhSAErNnhqEohQBA0CA+oxcZqlvI07vJsg2IoNWyDwy/v8X/qhJfmE6uTQsY\n 7aSdGl5gnC7Jz4VP44RopcGqoxglfxIox5wwkZY1uMocNspd9WwePoB351eFunph4nXvgaxwcNV\n ILiSMuj2ls9/1ymUuasgSB1zyMpuGTkzolaxJo+o=", "Received-SPF": "pass client-ip=205.220.165.32;\n envelope-from=alejandro.j.jimenez@oracle.com; helo=mx0a-00069f02.pphosted.com", "X-Spam_score_int": "-7", "X-Spam_score": "-0.8", "X-Spam_bar": "/", "X-Spam_report": "(-0.8 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_MED=-0.001,\n DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1,\n RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01,\n RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=1, RCVD_IN_VALIDITY_RPBL_BLOCKED=1,\n SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no", "X-Spam_action": "no action", "X-BeenThere": "qemu-devel@nongnu.org", "X-Mailman-Version": "2.1.29", "Precedence": "list", "List-Id": "qemu development <qemu-devel.nongnu.org>", "List-Unsubscribe": "<https://lists.nongnu.org/mailman/options/qemu-devel>,\n <mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>", "List-Archive": "<https://lists.nongnu.org/archive/html/qemu-devel>", "List-Post": "<mailto:qemu-devel@nongnu.org>", "List-Help": "<mailto:qemu-devel-request@nongnu.org?subject=help>", "List-Subscribe": "<https://lists.nongnu.org/mailman/listinfo/qemu-devel>,\n <mailto:qemu-devel-request@nongnu.org?subject=subscribe>", "Errors-To": "qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org", "Sender": "qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org" }, "content": "The AMD-Vi specification requires that the NextLevel field for a page table\nentry must not be greater or equal to the current page table entry level.\nEnforce this to avoid infinite page walk loops on corrupted or buggy guest\npage tables.\n\nThe initial implementation of fetch_pte() did not implement this check, but\nwas not vulnerable since the page walk code explicitly decremented the level\ninstead of retrieving it from the page table entry.\n\nCc: qemu-stable@nongnu.org\nReviewed-by: Sairaj Kodilkar <sarunkod@amd.com>\nSigned-off-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>\n---\n hw/i386/amd_iommu.c | 4 ++++\n 1 file changed, 4 insertions(+)", "diff": "diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c\nindex 04acfa645f..603fb91004 100644\n--- a/hw/i386/amd_iommu.c\n+++ b/hw/i386/amd_iommu.c\n@@ -771,6 +771,10 @@ static uint64_t fetch_pte(AMDVIAddressSpace *as, hwaddr address, uint64_t dte,\n break;\n }\n \n+ /* Next level must always be less than current level */\n+ if (pt_level <= next_pt_level) {\n+ return -AMDVI_FR_PT_ENTRY_INV;\n+ }\n pt_level = next_pt_level;\n \n /*\n", "prefixes": [ "for-11.0", "2/2" ] }