diff options
| author | Michael S. Tsirkin <mst@redhat.com> | 2021-12-21 09:45:44 -0500 |
|---|---|---|
| committer | Michael S. Tsirkin <mst@redhat.com> | 2022-01-06 06:11:38 -0500 |
| commit | 9bd6565ccee68f72d5012e24646e12a1c662827e (patch) | |
| tree | d4759ce3d001818e49cfe7adf0d22c220fa28d69 | |
| parent | 7656d9ce09cb1d6d76eeb2081f164a920361d1d3 (diff) | |
acpi: validate hotplug selector on access
When bus is looked up on a pci write, we didn't
validate that the lookup succeeded.
Fuzzers thus can trigger QEMU crash by dereferencing the NULL
bus pointer.
Fixes: b32bd763a1 ("pci: introduce acpi-index property for PCI device")
Fixes: CVE-2021-4158
Cc: "Igor Mammedov" <imammedo@redhat.com>
Fixes: https://gitlab.com/qemu-project/qemu/-/issues/770
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Ani Sinha <ani@anisinha.ca>
| -rw-r--r-- | hw/acpi/pcihp.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/hw/acpi/pcihp.c b/hw/acpi/pcihp.c index 30405b5113..a5e182dd3a 100644 --- a/hw/acpi/pcihp.c +++ b/hw/acpi/pcihp.c @@ -491,6 +491,9 @@ static void pci_write(void *opaque, hwaddr addr, uint64_t data, } bus = acpi_pcihp_find_hotplug_bus(s, s->hotplug_select); + if (!bus) { + break; + } QTAILQ_FOREACH_SAFE(kid, &bus->qbus.children, sibling, next) { Object *o = OBJECT(kid->child); PCIDevice *dev = PCI_DEVICE(o); |