15d7b2a4ea
fix CVE-2020-15469 Add spapr msi mmio read method to avoid NULL pointer dereference issue. Reported-by: Lei Sun <slei.casper@gmail.com> Acked-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Li Qiang <liq3ea@gmail.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Jiajie Li <lijiajie11@huawei.com>
62 lines
1.8 KiB
Diff
62 lines
1.8 KiB
Diff
From cbbcd56e090a59d0eaa4e35ed0efb24d6dd1003e Mon Sep 17 00:00:00 2001
|
|
From: Prasad J Pandit <pjp@fedoraproject.org>
|
|
Date: Thu, 25 Mar 2021 17:23:24 +0800
|
|
Subject: [PATCH] spapr_pci: add spapr msi read method
|
|
|
|
fix CVE-2020-15469
|
|
|
|
Add spapr msi mmio read method to avoid NULL pointer dereference
|
|
issue.
|
|
|
|
Reported-by: Lei Sun <slei.casper@gmail.com>
|
|
Acked-by: David Gibson <david@gibson.dropbear.id.au>
|
|
Reviewed-by: Li Qiang <liq3ea@gmail.com>
|
|
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
|
|
|
|
Signed-off-by: Jiajie Li <lijiajie11@huawei.com>
|
|
---
|
|
hw/ppc/spapr_pci.c | 13 +++++++++++--
|
|
1 file changed, 11 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/hw/ppc/spapr_pci.c b/hw/ppc/spapr_pci.c
|
|
index 9003fe9010..1571e049ab 100644
|
|
--- a/hw/ppc/spapr_pci.c
|
|
+++ b/hw/ppc/spapr_pci.c
|
|
@@ -50,6 +50,7 @@
|
|
#include "sysemu/kvm.h"
|
|
#include "sysemu/hostmem.h"
|
|
#include "sysemu/numa.h"
|
|
+#include "qemu/log.h"
|
|
|
|
/* Copied from the kernel arch/powerpc/platforms/pseries/msi.c */
|
|
#define RTAS_QUERY_FN 0
|
|
@@ -743,6 +744,12 @@ static PCIINTxRoute spapr_route_intx_pin_to_irq(void *opaque, int pin)
|
|
return route;
|
|
}
|
|
|
|
+static uint64_t spapr_msi_read(void *opaque, hwaddr addr, unsigned size)
|
|
+{
|
|
+ qemu_log_mask(LOG_UNIMP, "%s not implemented\n", __func__);
|
|
+ return 0;
|
|
+}
|
|
+
|
|
/*
|
|
* MSI/MSIX memory region implementation.
|
|
* The handler handles both MSI and MSIX.
|
|
@@ -760,8 +767,10 @@ static void spapr_msi_write(void *opaque, hwaddr addr,
|
|
}
|
|
|
|
static const MemoryRegionOps spapr_msi_ops = {
|
|
- /* There is no .read as the read result is undefined by PCI spec */
|
|
- .read = NULL,
|
|
+ /* .read result is undefined by PCI spec
|
|
+ * define .read method to avoid assert failure in memory_region_init_io
|
|
+ */
|
|
+ .read = spapr_msi_read,
|
|
.write = spapr_msi_write,
|
|
.endianness = DEVICE_LITTLE_ENDIAN
|
|
};
|
|
--
|
|
2.27.0
|
|
|