OSDN Git Service

acpi: validate hotplug selector on access
authorMichael S. Tsirkin <mst@redhat.com>
Tue, 21 Dec 2021 14:45:44 +0000 (09:45 -0500)
committerMichael S. Tsirkin <mst@redhat.com>
Thu, 6 Jan 2022 11:11:38 +0000 (06:11 -0500)
commit9bd6565ccee68f72d5012e24646e12a1c662827e
treed4759ce3d001818e49cfe7adf0d22c220fa28d69
parent7656d9ce09cb1d6d76eeb2081f164a920361d1d3
acpi: validate hotplug selector on access

When bus is looked up on a pci write, we didn't
validate that the lookup succeeded.
Fuzzers thus can trigger QEMU crash by dereferencing the NULL
bus pointer.

Fixes: b32bd763a1 ("pci: introduce acpi-index property for PCI device")
Fixes: CVE-2021-4158
Cc: "Igor Mammedov" <imammedo@redhat.com>
Fixes: https://gitlab.com/qemu-project/qemu/-/issues/770
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Ani Sinha <ani@anisinha.ca>
hw/acpi/pcihp.c