mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
e27bd49876
qemu/hw
History
Philippe Mathieu-Daudé 4177b062fc hw/isa/lpc_ich9: Ignore reserved/invalid SCI IRQ 
libFuzzer triggered the following assertion:

  cat << EOF | qemu-system-i386 -M pc-q35-5.0 \
    -nographic -monitor none -serial none \
    -qtest stdio -d guest_errors -trace pci\*
  outl 0xcf8 0x8400f841
  outl 0xcfc 0xebed205d
  outl 0x5d02 0xedf82049
  EOF
  pci_cfg_write ICH9-LPC 31:0 @0x41 <- 0xebed205d
  hw/pci/pci.c:268: int pci_bus_get_irq_level(PCIBus *, int): Assertion `irq_num < bus->nirq' failed.

This is because ich9_lpc_sci_irq() returns -1 for reserved
(illegal) values, but ich9_lpc_pmbase_sci_update() considers
it valid and store it in a 8-bit unsigned type. Then the 255
value is used as GSI IRQ, resulting in a PIRQ value of 247,
more than ICH9_LPC_NB_PIRQS (8).

Fix by simply ignoring the invalid access (and reporting it):

  pci_cfg_write ICH9-LPC 31:0 @0x41 <- 0xebed205d
  ICH9 LPC: SCI IRQ SEL #3 is reserved
  pci_cfg_read mch 00:0 @0x0 -> 0x8086
  pci_cfg_read mch 00:0 @0x0 -> 0x29c08086
  ...

Cc: qemu-stable@nongnu.org
Reported-by: Alexander Bulekov <alxndr@bu.edu>
Fixes: 8f242cb724 ("ich9: implement SCI_IRQ_SEL register")
BugLink: https://bugs.launchpad.net/qemu/+bug/1878642
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20200717151705.18611-1-f4bug@amsat.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-11-03 09:42:53 -05:00
..
9pfs 9pfs: suppress performance warnings on qtest runs 2020-10-19 14:25:40 +02:00
acpi acpi: add aml builder stubs 2020-10-21 11:36:19 +02:00
adc meson: convert hw/adc 2020-08-21 06:30:32 -04:00
alpha load_elf: Remove unused address variables from callers 2020-09-25 16:52:08 -07:00
arm hw/arm/boot: fix SVE for EL3 direct kernel boot 2020-11-02 16:52:16 +00:00
audio Use OBJECT_DECLARE_SIMPLE_TYPE when possible 2020-09-18 14:12:32 -04:00
avr Use DECLARE_*CHECKER* macros 2020-09-09 09:27:09 -04:00
block nvme pull 2 Nov 2020 2020-11-02 17:17:29 +00:00
char hw/char/pl011: add a clock input 2020-10-27 11:10:44 +00:00
core nvme pull 2 Nov 2020 2020-11-02 17:17:29 +00:00
cpu cpu/core: Register core-id and nr-threads as class properties 2020-09-22 16:48:29 -04:00
cris load_elf: Remove unused address variables from callers 2020-09-25 16:52:08 -07:00
display hw/display/exynos4210_fimd: Fix potential NULL pointer dereference 2020-11-02 16:52:17 +00:00
dma sparc32-ledma: don't reference nd_table directly within the device 2020-10-28 07:59:25 +00:00
gpio hw/gpio: Add GPIO model for Nuvoton NPCM7xx 2020-10-27 11:10:32 +00:00
hppa Use OBJECT_DECLARE_SIMPLE_TYPE when possible 2020-09-18 14:12:32 -04:00
hyperv qemu/atomic.h: rename atomic_ to qatomic_ 2020-09-23 16:07:44 +01:00
i2c microbit_i2c: Fix coredump when dump-vmstate 2020-10-20 16:12:00 +01:00
i386 pc,pci,vhost,virtio: misc fixes 2020-11-01 14:02:19 +00:00
ide xen: rework pci_piix3_xen_ide_unplug 2020-11-02 11:56:55 +00:00
input Use OBJECT_DECLARE_SIMPLE_TYPE when possible 2020-09-18 14:12:32 -04:00
intc hw/intc/arm_gicv3_cpuif: Make GIC maintenance interrupts work 2020-11-02 16:52:17 +00:00
ipack Use OBJECT_DECLARE_SIMPLE_TYPE when possible 2020-09-18 14:12:32 -04:00
ipmi Use OBJECT_DECLARE_SIMPLE_TYPE when possible 2020-09-18 14:12:32 -04:00
isa hw/isa/lpc_ich9: Ignore reserved/invalid SCI IRQ 2020-11-03 09:42:53 -05:00
lm32 hw/sd/milkymist: Do not create SD card within the SD host controller 2020-08-21 16:22:43 +02:00
m68k Use OBJECT_DECLARE_SIMPLE_TYPE when possible 2020-09-18 14:12:32 -04:00
mem pc-dimm: Drop @errp argument of pc_dimm_plug() 2020-10-28 01:08:53 +11:00
microblaze load_elf: Remove unused address variables from callers 2020-09-25 16:52:08 -07:00
mips hw/mips: Remove exit(1) in case of missing ROM 2020-10-17 13:59:40 +02:00
misc target-arm queue: 2020-10-29 11:40:04 +00:00
moxie load_elf: Remove unused address variables from callers 2020-09-25 16:52:08 -07:00
net hw/net: move allocation to the heap due to very large stack frame 2020-10-28 01:08:53 +11:00
nios2 load_elf: Remove unused address variables from callers 2020-09-25 16:52:08 -07:00
nubus meson: convert hw/nubus 2020-08-21 06:30:25 -04:00
nvram hw/nvram: Always register FW_CFG_DATA_GENERATOR_INTERFACE 2020-10-12 11:50:20 -04:00
openrisc meson: convert hw/arch* 2020-08-21 06:30:33 -04:00
pci pci: Disallow improper BAR registration for type 1 2020-10-30 06:48:53 -04:00
pci-bridge Use OBJECT_DECLARE_SIMPLE_TYPE when possible 2020-09-18 14:12:32 -04:00
pci-host hw/pci-host/sabre: Simplify code initializing variable once 2020-10-28 07:59:26 +00:00
pcmcia pxa2xx: Move QOM macros to header 2020-08-27 14:04:55 -04:00
ppc spapr: Improve spapr_reallocate_hpt() error reporting 2020-10-28 01:08:53 +11:00
rdma qemu/atomic.h: rename atomic_ to qatomic_ 2020-09-23 16:07:44 +01:00
riscv hw/riscv: Load the kernel after the firmware 2020-10-22 12:00:22 -07:00
rtc m48t59: remove legacy m48t59_init() function 2020-10-18 16:21:42 +01:00
rx Use DECLARE_*CHECKER* macros 2020-09-09 09:27:09 -04:00
s390x s390x/pci: get zPCI function info from host 2020-11-01 12:30:52 -07:00
scsi scsi/scsi_bus: fix races in REPORT LUNS 2020-10-12 11:50:51 -04:00
sd hw/sd/sdcard: Zero out function selection fields before being populated 2020-10-26 09:23:47 +01:00
semihosting meson: convert hw/semihosting 2020-08-21 06:30:25 -04:00
sh4 Use OBJECT_DECLARE_SIMPLE_TYPE when possible 2020-09-18 14:12:32 -04:00
smbios hw/smbios: report error if table size is too large 2020-09-29 02:15:24 -04:00
sparc sparc32-ledma: don't reference nd_table directly within the device 2020-10-28 07:59:25 +00:00
sparc64 sabre: don't call sysbus_mmio_map() in sabre_realize() 2020-10-28 07:59:25 +00:00
ssi hw/ssi/npcm7xx_fiu: Fix handling of unsigned integer 2020-10-08 15:24:32 +01:00
timer target-arm queue: 2020-10-29 11:40:04 +00:00
tpm Use OBJECT_DECLARE_SIMPLE_TYPE when possible 2020-09-18 14:12:32 -04:00
tricore meson: convert hw/arch* 2020-08-21 06:30:33 -04:00
unicore32 meson: convert hw/arch* 2020-08-21 06:30:33 -04:00
usb hw/arm/npcm7xx: Add EHCI and OHCI controllers 2020-10-27 11:10:21 +00:00
vfio vfio: fix incorrect print type 2020-11-01 12:30:52 -07:00
virtio virtio: skip guest index check on device load 2020-10-30 06:48:53 -04:00
watchdog hw/watchdog: Implement SBSA watchdog device 2020-10-27 11:10:44 +00:00
xen xen-bus: reduce scope of backend watch 2020-10-19 16:32:41 +01:00
xenpv meson: convert hw/arch* 2020-08-21 06:30:33 -04:00
xtensa load_elf: Remove unused address variables from callers 2020-09-25 16:52:08 -07:00
Kconfig hw/avr: Add limited support for some Arduino boards 2020-07-11 11:02:05 +02:00
meson.build meson: convert hw/arch* 2020-08-21 06:30:33 -04:00