1 Commits

Author SHA1 Message Date
Prasad J Pandit
9daa72fa9d pci: check bus pointer before dereference
fix CVE-2020-25742

patch link: https://lists.nongnu.org/archive/html/qemu-devel/2020-09/msg05294.html

While mapping IRQ level in pci_change_irq_level() routine,
it does not check if pci_get_bus() returned a valid pointer.
It may lead to a NULL pointer dereference issue. Add check to
avoid it.

  -> https://ruhr-uni-bochum.sciebo.de/s/NNWP2GfwzYKeKwE?path=%2Flsi_nullptr1
     ==1183858==Hint: address points to the zero page.
     #0 pci_change_irq_level hw/pci/pci.c:259
     #1 pci_irq_handler hw/pci/pci.c:1445
     #2 pci_set_irq hw/pci/pci.c:1463
     #3 lsi_set_irq hw/scsi/lsi53c895a.c:488
     #4 lsi_update_irq hw/scsi/lsi53c895a.c:523
     #5 lsi_script_scsi_interrupt hw/scsi/lsi53c895a.c:554
     #6 lsi_execute_script hw/scsi/lsi53c895a.c:1149
     #7 lsi_reg_writeb hw/scsi/lsi53c895a.c:1984
     #8 lsi_io_write hw/scsi/lsi53c895a.c:2146
     ...

Reported-by: Ruhr-University <bugs-syssec@rub.de>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
2020-10-22 16:29:39 +08:00