[Qemu-devel] [PATCH v2 4/7] tcg: Enforce single page access in probe_write()

[David Hildenbrand <david@redhat.com>]

Let's enforce the interface restriction.

Signed-off-by: David Hildenbrand <david@redhat.com>
---
 accel/tcg/cputlb.c    | 2 ++
 accel/tcg/user-exec.c | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index 7fc7aa9482..09fe4cdcc4 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -1088,6 +1088,8 @@ void probe_write(CPUArchState *env, target_ulong addr, int size, int mmu_idx,
     CPUTLBEntry *entry = tlb_entry(env, mmu_idx, addr);
     target_ulong tlb_addr = tlb_addr_write(entry);
 
+    g_assert(-(addr | TARGET_PAGE_MASK) >= size);
+
     if (unlikely(!tlb_hit(tlb_addr, addr))) {
         if (!VICTIM_TLB_HIT(addr_write, addr)) {
             tlb_fill(env_cpu(env), addr, size, MMU_DATA_STORE,
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index 68f4425cbc..b25a342eaa 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -194,6 +194,8 @@ void probe_write(CPUArchState *env, target_ulong addr, int size, int mmu_idx,
     CPUState *cpu = env_cpu(env);
     CPUClass *cc;
 
+    g_assert(-(addr | TARGET_PAGE_MASK) >= size);
+
     if (!guest_addr_valid(addr) ||
         page_check_range(addr, size, PAGE_WRITE) < 0) {
         cc = CPU_GET_CLASS(cpu);
-- 
2.21.0