From nobody Mon Aug 24 09:09:05 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1779486643; cv=none; d=zohomail.com; s=zohoarc; b=oB8CRCe29N5Vg7MHKIvuMSesM2F1hc9LYZHcFmY8uxViVFtcGZ+sMq/ZejWGLBJ5xHqIcZ+TzYTAYFo+5JNdFo52BPrikDhnzHfzHk39Calemq0VU0Z89NcebqkZAiMbEN10aDcQYeA780yWAIfnoSWOVeJrIPmXip6RmJwqHzE= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1779486643; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=oBf0dKLpOHO2N/FOOXM53zLFh/Sx20CKTYkNpOBoKhY=; b=LE6zlFLxCaJwZ2cu9vHYlth0X3351rb4/uWRt5t633fTSIsAG3RpMXTCGOPerwqeESiEaXirNW7UE7/2LMkfSAAn38GqJ/TlQP1l3TFn7xGvbRaqdQKaCshU7Uyq66gblKSl1ZTchvmk5/x14DPSMoj4qKZJig4fVGsDLoKzc/U= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1779486643655451.18016047615754; Fri, 22 May 2026 14:50:43 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wQXlC-000834-AV; Fri, 22 May 2026 17:50:26 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wQXkN-0006lG-Pu; Fri, 22 May 2026 17:49:36 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wQXkL-0002Sj-Ng; Fri, 22 May 2026 17:49:35 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 361D91AFB5D; Sat, 23 May 2026 00:49:19 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 585D53B71AC; Sat, 23 May 2026 00:49:23 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1779486559; bh=/18hG5HPoAxJTkndAlIldyOwxO4KKwlIeNPw3UW0GrU=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=hFebCMamVq7vPmX2lhk5mIHGmeu08iQd8alzcDo31u+EliWJlgS770XMuijssZXrp wgx6GIlCq0b9zLZL/ACOkOhgnCgtL7Dfoqxq7jJxE26O6ANv46IS+E8bY4olP/MBcS MUsIkT99nJtFNjGsifUGCDyoKFfUT78zfaYJSPfM9njwvmmL6Es/ml2e3rZA+q/RiK jfBDHjOW+8gr7T5UxYj7+IuXgWV/0hIOhuDWFY4TfOJqner2+NHsbD8bqb7DqWuPcY Q5btWKKExevUPO7p7dmhQVii8CA2vUqfeBLILnxRl2K2W5bPepQXGOlAcVqr1+fYAp /0MiPZYoP3qOw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, kiki , Zexiang Zhang , Gautam Menghani , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Harsh Prateek Bora , Michael Tokarev Subject: [Stable-10.2.3 103/149] hw/intc/xics: Add a check for an invalid server id Date: Sat, 23 May 2026 00:48:35 +0300 Message-ID: <20260522214923.807017-4-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1779486644561154100 From: kiki A malformed IVE value can result in an invalid server field being passed to icp_irq(). The function assumes the server id is valid and may access invalid state otherwise, potentially leading to a crash. Fix this by validating the server id before using it and ignoring invalid values. Reported-by: Zexiang Zhang Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3324 Signed-off-by: Zexiang Zhang Signed-off-by: Gautam Menghani Reviewed-by: Philippe Mathieu-Daud=C3=A9 Link: https://lore.kernel.org/qemu-devel/20260428103645.50617-1-Gautam.Meng= hani@ibm.com Signed-off-by: Harsh Prateek Bora (cherry picked from commit 1aee8067fce95d15061eca8fbb6772d8a90ea699) Signed-off-by: Michael Tokarev diff --git a/hw/intc/xics.c b/hw/intc/xics.c index 200710eb6c..c7312d166f 100644 --- a/hw/intc/xics.c +++ b/hw/intc/xics.c @@ -26,6 +26,7 @@ */ =20 #include "qemu/osdep.h" +#include "qemu/log.h" #include "qapi/error.h" #include "trace.h" #include "qemu/timer.h" @@ -222,6 +223,13 @@ void icp_irq(ICSState *ics, int server, int nr, uint8_= t priority) =20 trace_xics_icp_irq(server, nr, priority); =20 + if (!icp) { + qemu_log_mask(LOG_GUEST_ERROR, "XICS: invalid server %d for IRQ 0x= %x\n", + server, nr); + ics_reject(ics, nr); + return; + } + if ((priority >=3D CPPR(icp)) || (XISR(icp) && (icp->pending_priority <=3D priority))) { ics_reject(ics, nr); --=20 2.47.3