1*4882a593SmuzhiyunFrom a0b64c6d078acb9bcfae600e22bf99a9a7deca7c Mon Sep 17 00:00:00 2001 2*4882a593SmuzhiyunFrom: "Michael S. Tsirkin" <mst@redhat.com> 3*4882a593SmuzhiyunDate: Tue, 21 Dec 2021 09:45:44 -0500 4*4882a593SmuzhiyunSubject: [PATCH] acpi: validate hotplug selector on access 5*4882a593SmuzhiyunMIME-Version: 1.0 6*4882a593SmuzhiyunContent-Type: text/plain; charset=UTF-8 7*4882a593SmuzhiyunContent-Transfer-Encoding: 8bit 8*4882a593Smuzhiyun 9*4882a593SmuzhiyunWhen bus is looked up on a pci write, we didn't 10*4882a593Smuzhiyunvalidate that the lookup succeeded. 11*4882a593SmuzhiyunFuzzers thus can trigger QEMU crash by dereferencing the NULL 12*4882a593Smuzhiyunbus pointer. 13*4882a593Smuzhiyun 14*4882a593SmuzhiyunFixes: b32bd763a1 ("pci: introduce acpi-index property for PCI device") 15*4882a593SmuzhiyunFixes: CVE-2021-4158 16*4882a593SmuzhiyunCc: "Igor Mammedov" <imammedo@redhat.com> 17*4882a593SmuzhiyunFixes: https://gitlab.com/qemu-project/qemu/-/issues/770 18*4882a593SmuzhiyunSigned-off-by: Michael S. Tsirkin <mst@redhat.com> 19*4882a593SmuzhiyunReviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> 20*4882a593SmuzhiyunReviewed-by: Ani Sinha <ani@anisinha.ca> 21*4882a593Smuzhiyun 22*4882a593SmuzhiyunUpstream-Status: Backport [9bd6565ccee68f72d5012e24646e12a1c662827e] 23*4882a593SmuzhiyunCVE: CVE-2021-4158 24*4882a593Smuzhiyun 25*4882a593SmuzhiyunSigned-off-by: Sakib Sajal <sakib.sajal@windriver.com> 26*4882a593Smuzhiyun--- 27*4882a593Smuzhiyun hw/acpi/pcihp.c | 3 +++ 28*4882a593Smuzhiyun 1 file changed, 3 insertions(+) 29*4882a593Smuzhiyun 30*4882a593Smuzhiyundiff --git a/hw/acpi/pcihp.c b/hw/acpi/pcihp.c 31*4882a593Smuzhiyunindex 30405b511..a5e182dd3 100644 32*4882a593Smuzhiyun--- a/hw/acpi/pcihp.c 33*4882a593Smuzhiyun+++ b/hw/acpi/pcihp.c 34*4882a593Smuzhiyun@@ -491,6 +491,9 @@ static void pci_write(void *opaque, hwaddr addr, uint64_t data, 35*4882a593Smuzhiyun } 36*4882a593Smuzhiyun 37*4882a593Smuzhiyun bus = acpi_pcihp_find_hotplug_bus(s, s->hotplug_select); 38*4882a593Smuzhiyun+ if (!bus) { 39*4882a593Smuzhiyun+ break; 40*4882a593Smuzhiyun+ } 41*4882a593Smuzhiyun QTAILQ_FOREACH_SAFE(kid, &bus->qbus.children, sibling, next) { 42*4882a593Smuzhiyun Object *o = OBJECT(kid->child); 43*4882a593Smuzhiyun PCIDevice *dev = PCI_DEVICE(o); 44*4882a593Smuzhiyun-- 45*4882a593Smuzhiyun2.33.0 46*4882a593Smuzhiyun 47