Prasad J Pandit 9daa72fa9d pci: check bus pointer before dereference
fix CVE-2020-25742

patch link: https://lists.nongnu.org/archive/html/qemu-devel/2020-09/msg05294.html

While mapping IRQ level in pci_change_irq_level() routine,
it does not check if pci_get_bus() returned a valid pointer.
It may lead to a NULL pointer dereference issue. Add check to
avoid it.

  -> https://ruhr-uni-bochum.sciebo.de/s/NNWP2GfwzYKeKwE?path=%2Flsi_nullptr1
     ==1183858==Hint: address points to the zero page.
     #0 pci_change_irq_level hw/pci/pci.c:259
     #1 pci_irq_handler hw/pci/pci.c:1445
     #2 pci_set_irq hw/pci/pci.c:1463
     #3 lsi_set_irq hw/scsi/lsi53c895a.c:488
     #4 lsi_update_irq hw/scsi/lsi53c895a.c:523
     #5 lsi_script_scsi_interrupt hw/scsi/lsi53c895a.c:554
     #6 lsi_execute_script hw/scsi/lsi53c895a.c:1149
     #7 lsi_reg_writeb hw/scsi/lsi53c895a.c:1984
     #8 lsi_io_write hw/scsi/lsi53c895a.c:2146
     ...

Reported-by: Ruhr-University <bugs-syssec@rub.de>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
2020-10-22 16:29:39 +08:00
2019-11-06 19:50:55 +08:00
2019-09-30 11:15:46 -04:00
2019-09-30 11:15:46 -04:00
2020-06-01 09:13:38 +00:00
2020-09-28 15:29:50 +08:00
Description
No description provided
401 MiB
Languages
Markdown 100%