From 4177b062fc58dd250667415e487618ac59393d04 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Fri, 17 Jul 2020 17:17:05 +0200 Subject: hw/isa/lpc_ich9: Ignore reserved/invalid SCI IRQ MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit libFuzzer triggered the following assertion: cat << EOF | qemu-system-i386 -M pc-q35-5.0 \ -nographic -monitor none -serial none \ -qtest stdio -d guest_errors -trace pci\* outl 0xcf8 0x8400f841 outl 0xcfc 0xebed205d outl 0x5d02 0xedf82049 EOF pci_cfg_write ICH9-LPC 31:0 @0x41 <- 0xebed205d hw/pci/pci.c:268: int pci_bus_get_irq_level(PCIBus *, int): Assertion `irq_num < bus->nirq' failed. This is because ich9_lpc_sci_irq() returns -1 for reserved (illegal) values, but ich9_lpc_pmbase_sci_update() considers it valid and store it in a 8-bit unsigned type. Then the 255 value is used as GSI IRQ, resulting in a PIRQ value of 247, more than ICH9_LPC_NB_PIRQS (8). Fix by simply ignoring the invalid access (and reporting it): pci_cfg_write ICH9-LPC 31:0 @0x41 <- 0xebed205d ICH9 LPC: SCI IRQ SEL #3 is reserved pci_cfg_read mch 00:0 @0x0 -> 0x8086 pci_cfg_read mch 00:0 @0x0 -> 0x29c08086 ... Cc: qemu-stable@nongnu.org Reported-by: Alexander Bulekov Fixes: 8f242cb724 ("ich9: implement SCI_IRQ_SEL register") BugLink: https://bugs.launchpad.net/qemu/+bug/1878642 Signed-off-by: Philippe Mathieu-Daudé Message-Id: <20200717151705.18611-1-f4bug@amsat.org> Signed-off-by: Paolo Bonzini --- include/hw/i386/ich9.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/hw/i386/ich9.h b/include/hw/i386/ich9.h index 294024be5f..d1ea000d3d 100644 --- a/include/hw/i386/ich9.h +++ b/include/hw/i386/ich9.h @@ -144,6 +144,7 @@ struct ICH9LPCState { #define ICH9_LPC_PMBASE_BASE_ADDRESS_MASK Q35_MASK(32, 15, 7) #define ICH9_LPC_PMBASE_RTE 0x1 #define ICH9_LPC_PMBASE_DEFAULT 0x1 + #define ICH9_LPC_ACPI_CTRL 0x44 #define ICH9_LPC_ACPI_CTRL_ACPI_EN 0x80 #define ICH9_LPC_ACPI_CTRL_SCI_IRQ_SEL_MASK Q35_MASK(8, 2, 0) -- cgit v1.2.3