* [PATCH v3] target/ppc: Add lower bound check for watchdogNumber
@ 2026-08-18 10:45 Chinmay Rath
2026-08-18 11:41 ` Chinmay Rath
0 siblings, 1 reply; 4+ messages in thread
From: Chinmay Rath @ 2026-08-18 10:45 UTC (permalink / raw)
To: qemu-ppc, qemu-devel; +Cc: npiggin, harshpb, aik, amachhiw, Chinmay Rath
Add missing lower bound check for H_WATCHDOG H_CALL's watchdogNumber parameter
as per PAPR documentation ver 12.10.00 section 14.15.5 'H_WATCHDOG'.
Closes : https://gitlab.com/qemu-project/qemu/-/work_items/3600
Reviewed-by: Amit Machhiwal <amachhiw@linux.ibm.com>
Signed-off-by: Chinmay Rath <rathc@linux.ibm.com>
---
Changes from v2:
Renamed watchdogNumber_valid to watchdog_number_valid - Amit
Retained Amit's Reviewed-by
hw/watchdog/spapr_watchdog.c | 16 +++++++++++-----
1 file changed, 11 insertions(+), 5 deletions(-)
diff --git a/hw/watchdog/spapr_watchdog.c b/hw/watchdog/spapr_watchdog.c
index 5b3f50de3a..5a72896066 100644
--- a/hw/watchdog/spapr_watchdog.c
+++ b/hw/watchdog/spapr_watchdog.c
@@ -127,6 +127,12 @@ static void watchdog_expired(void *pw)
}
}
+static inline bool watchdog_number_valid(target_ulong watchdogNumber,
+ SpaprMachineState *spapr)
+{
+ return watchdogNumber >= 1 && watchdogNumber <= ARRAY_SIZE(spapr->wds);
+}
+
static target_ulong h_watchdog(PowerPCCPU *cpu,
SpaprMachineState *spapr,
target_ulong opcode, target_ulong *args)
@@ -145,7 +151,7 @@ static target_ulong h_watchdog(PowerPCCPU *cpu,
switch (operation) {
case PSERIES_WDTF_OP_START:
- if (watchdogNumber > ARRAY_SIZE(spapr->wds)) {
+ if (!watchdog_number_valid(watchdogNumber, spapr)) {
return H_P2;
}
if (timeoutInMs <= WDT_MIN_TIMEOUT) {
@@ -170,11 +176,11 @@ static target_ulong h_watchdog(PowerPCCPU *cpu,
case PSERIES_WDTF_OP_STOP:
if (watchdogNumber == PSERIES_WDT_STOP_ALL) {
ret = watchdog_stop_all(spapr);
- } else if (watchdogNumber <= ARRAY_SIZE(spapr->wds)) {
+ } else if (!watchdog_number_valid(watchdogNumber, spapr)) {
+ return H_P2;
+ } else {
ret = watchdog_stop(watchdogNumber,
&spapr->wds[watchdogNumber - 1]);
- } else {
- return H_P2;
}
break;
case PSERIES_WDTF_OP_QUERY:
@@ -184,7 +190,7 @@ static target_ulong h_watchdog(PowerPCCPU *cpu,
trace_spapr_watchdog_query(args[0]);
break;
case PSERIES_WDTF_OP_QUERY_LPM:
- if (watchdogNumber > ARRAY_SIZE(spapr->wds)) {
+ if (!watchdog_number_valid(watchdogNumber, spapr)) {
return H_P2;
}
args[0] = PSERIES_WDTQL_QUERY_NOT_STOPPED;
--
2.55.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH v3] target/ppc: Add lower bound check for watchdogNumber
2026-08-18 10:45 [PATCH v3] target/ppc: Add lower bound check for watchdogNumber Chinmay Rath
@ 2026-08-18 11:41 ` Chinmay Rath
2026-08-19 10:04 ` Chinmay Rath
0 siblings, 1 reply; 4+ messages in thread
From: Chinmay Rath @ 2026-08-18 11:41 UTC (permalink / raw)
To: qemu-ppc, qemu-devel; +Cc: npiggin, harshpb, aik, amachhiw
On 8/18/26 16:15, Chinmay Rath wrote:
> Add missing lower bound check for H_WATCHDOG H_CALL's watchdogNumber parameter
> as per PAPR documentation ver 12.10.00 section 14.15.5 'H_WATCHDOG'.
>
> Closes : https://gitlab.com/qemu-project/qemu/-/work_items/3600
> Reviewed-by: Amit Machhiwal <amachhiw@linux.ibm.com>
Reported-by: huntr bubble <bubblehuntr@gmail.com>
> Signed-off-by: Chinmay Rath <rathc@linux.ibm.com>
> ---
>
> Changes from v2:
> Renamed watchdogNumber_valid to watchdog_number_valid - Amit
> Retained Amit's Reviewed-by
>
> hw/watchdog/spapr_watchdog.c | 16 +++++++++++-----
> 1 file changed, 11 insertions(+), 5 deletions(-)
>
> diff --git a/hw/watchdog/spapr_watchdog.c b/hw/watchdog/spapr_watchdog.c
> index 5b3f50de3a..5a72896066 100644
> --- a/hw/watchdog/spapr_watchdog.c
> +++ b/hw/watchdog/spapr_watchdog.c
> @@ -127,6 +127,12 @@ static void watchdog_expired(void *pw)
> }
> }
>
> +static inline bool watchdog_number_valid(target_ulong watchdogNumber,
> + SpaprMachineState *spapr)
> +{
> + return watchdogNumber >= 1 && watchdogNumber <= ARRAY_SIZE(spapr->wds);
> +}
> +
> static target_ulong h_watchdog(PowerPCCPU *cpu,
> SpaprMachineState *spapr,
> target_ulong opcode, target_ulong *args)
> @@ -145,7 +151,7 @@ static target_ulong h_watchdog(PowerPCCPU *cpu,
>
> switch (operation) {
> case PSERIES_WDTF_OP_START:
> - if (watchdogNumber > ARRAY_SIZE(spapr->wds)) {
> + if (!watchdog_number_valid(watchdogNumber, spapr)) {
> return H_P2;
> }
> if (timeoutInMs <= WDT_MIN_TIMEOUT) {
> @@ -170,11 +176,11 @@ static target_ulong h_watchdog(PowerPCCPU *cpu,
> case PSERIES_WDTF_OP_STOP:
> if (watchdogNumber == PSERIES_WDT_STOP_ALL) {
> ret = watchdog_stop_all(spapr);
> - } else if (watchdogNumber <= ARRAY_SIZE(spapr->wds)) {
> + } else if (!watchdog_number_valid(watchdogNumber, spapr)) {
> + return H_P2;
> + } else {
> ret = watchdog_stop(watchdogNumber,
> &spapr->wds[watchdogNumber - 1]);
> - } else {
> - return H_P2;
> }
> break;
> case PSERIES_WDTF_OP_QUERY:
> @@ -184,7 +190,7 @@ static target_ulong h_watchdog(PowerPCCPU *cpu,
> trace_spapr_watchdog_query(args[0]);
> break;
> case PSERIES_WDTF_OP_QUERY_LPM:
> - if (watchdogNumber > ARRAY_SIZE(spapr->wds)) {
> + if (!watchdog_number_valid(watchdogNumber, spapr)) {
> return H_P2;
> }
> args[0] = PSERIES_WDTQL_QUERY_NOT_STOPPED;
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH v3] target/ppc: Add lower bound check for watchdogNumber
2026-08-18 11:41 ` Chinmay Rath
@ 2026-08-19 10:04 ` Chinmay Rath
2026-08-23 6:08 ` Harsh Prateek Bora
0 siblings, 1 reply; 4+ messages in thread
From: Chinmay Rath @ 2026-08-19 10:04 UTC (permalink / raw)
To: qemu-ppc, qemu-devel; +Cc: harshpb
On 8/18/26 17:11, Chinmay Rath wrote:
>
> On 8/18/26 16:15, Chinmay Rath wrote:
>> Add missing lower bound check for H_WATCHDOG H_CALL's watchdogNumber
>> parameter
>> as per PAPR documentation ver 12.10.00 section 14.15.5 'H_WATCHDOG'.
>>
>> Closes : https://gitlab.com/qemu-project/qemu/-/work_items/3600
>> Reviewed-by: Amit Machhiwal <amachhiw@linux.ibm.com>
> Reported-by: huntr bubble <bubblehuntr@gmail.com>
Hi Harsh,
I missed adding the correct commit message header here. Should have use
hw/watchdog instead of target/ppc.
If possible please correct this while you pull in the patch along with
the extra Reported-by tag.
Lemme know if that works.
TIA,
Chinmay
>> Signed-off-by: Chinmay Rath <rathc@linux.ibm.com>
>> ---
>>
>> Changes from v2:
>> Renamed watchdogNumber_valid to watchdog_number_valid - Amit
>> Retained Amit's Reviewed-by
>>
>> hw/watchdog/spapr_watchdog.c | 16 +++++++++++-----
>> 1 file changed, 11 insertions(+), 5 deletions(-)
>>
>> diff --git a/hw/watchdog/spapr_watchdog.c b/hw/watchdog/spapr_watchdog.c
>> index 5b3f50de3a..5a72896066 100644
>> --- a/hw/watchdog/spapr_watchdog.c
>> +++ b/hw/watchdog/spapr_watchdog.c
>> @@ -127,6 +127,12 @@ static void watchdog_expired(void *pw)
>> }
>> }
>> +static inline bool watchdog_number_valid(target_ulong watchdogNumber,
>> + SpaprMachineState *spapr)
>> +{
>> + return watchdogNumber >= 1 && watchdogNumber <=
>> ARRAY_SIZE(spapr->wds);
>> +}
>> +
>> static target_ulong h_watchdog(PowerPCCPU *cpu,
>> SpaprMachineState *spapr,
>> target_ulong opcode, target_ulong
>> *args)
>> @@ -145,7 +151,7 @@ static target_ulong h_watchdog(PowerPCCPU *cpu,
>> switch (operation) {
>> case PSERIES_WDTF_OP_START:
>> - if (watchdogNumber > ARRAY_SIZE(spapr->wds)) {
>> + if (!watchdog_number_valid(watchdogNumber, spapr)) {
>> return H_P2;
>> }
>> if (timeoutInMs <= WDT_MIN_TIMEOUT) {
>> @@ -170,11 +176,11 @@ static target_ulong h_watchdog(PowerPCCPU *cpu,
>> case PSERIES_WDTF_OP_STOP:
>> if (watchdogNumber == PSERIES_WDT_STOP_ALL) {
>> ret = watchdog_stop_all(spapr);
>> - } else if (watchdogNumber <= ARRAY_SIZE(spapr->wds)) {
>> + } else if (!watchdog_number_valid(watchdogNumber, spapr)) {
>> + return H_P2;
>> + } else {
>> ret = watchdog_stop(watchdogNumber,
>> &spapr->wds[watchdogNumber - 1]);
>> - } else {
>> - return H_P2;
>> }
>> break;
>> case PSERIES_WDTF_OP_QUERY:
>> @@ -184,7 +190,7 @@ static target_ulong h_watchdog(PowerPCCPU *cpu,
>> trace_spapr_watchdog_query(args[0]);
>> break;
>> case PSERIES_WDTF_OP_QUERY_LPM:
>> - if (watchdogNumber > ARRAY_SIZE(spapr->wds)) {
>> + if (!watchdog_number_valid(watchdogNumber, spapr)) {
>> return H_P2;
>> }
>> args[0] = PSERIES_WDTQL_QUERY_NOT_STOPPED;
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH v3] target/ppc: Add lower bound check for watchdogNumber
2026-08-19 10:04 ` Chinmay Rath
@ 2026-08-23 6:08 ` Harsh Prateek Bora
0 siblings, 0 replies; 4+ messages in thread
From: Harsh Prateek Bora @ 2026-08-23 6:08 UTC (permalink / raw)
To: Chinmay Rath, qemu-ppc, qemu-devel, bubblehuntr
On 19/08/26 3:34 pm, Chinmay Rath wrote:
>
> On 8/18/26 17:11, Chinmay Rath wrote:
>>
>> On 8/18/26 16:15, Chinmay Rath wrote:
>>> Add missing lower bound check for H_WATCHDOG H_CALL's watchdogNumber
>>> parameter
>>> as per PAPR documentation ver 12.10.00 section 14.15.5 'H_WATCHDOG'.
>>>
>>> Closes : https://gitlab.com/qemu-project/qemu/-/work_items/3600
>>> Reviewed-by: Amit Machhiwal <amachhiw@linux.ibm.com>
>> Reported-by: huntr bubble <bubblehuntr@gmail.com>
> Hi Harsh,
> I missed adding the correct commit message header here. Should have use
> hw/watchdog instead of target/ppc.
> If possible please correct this while you pull in the patch along with
> the extra Reported-by tag.
> Lemme know if that works.
Taken care, queued for 11.2, thanks.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-08-23 6:09 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-18 10:45 [PATCH v3] target/ppc: Add lower bound check for watchdogNumber Chinmay Rath
2026-08-18 11:41 ` Chinmay Rath
2026-08-19 10:04 ` Chinmay Rath
2026-08-23 6:08 ` Harsh Prateek Bora
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.