From 1aee8067fce95d15061eca8fbb6772d8a90ea699 Mon Sep 17 00:00:00 2001 From: kiki Date: Tue, 28 Apr 2026 16:06:44 +0530 Subject: [PATCH] hw/intc/xics: Add a check for an invalid server id MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A malformed IVE value can result in an invalid server field being passed to icp_irq(). The function assumes the server id is valid and may access invalid state otherwise, potentially leading to a crash. Fix this by validating the server id before using it and ignoring invalid values. Reported-by: Zexiang Zhang Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3324 Signed-off-by: Zexiang Zhang Signed-off-by: Gautam Menghani Reviewed-by: Philippe Mathieu-Daudé Link: https://lore.kernel.org/qemu-devel/20260428103645.50617-1-Gautam.Menghani@ibm.com Signed-off-by: Harsh Prateek Bora --- hw/intc/xics.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/hw/intc/xics.c b/hw/intc/xics.c index c0a252d051..e32984e9fc 100644 --- a/hw/intc/xics.c +++ b/hw/intc/xics.c @@ -26,6 +26,7 @@ */ #include "qemu/osdep.h" +#include "qemu/log.h" #include "qapi/error.h" #include "trace.h" #include "qemu/timer.h" @@ -222,6 +223,13 @@ void icp_irq(ICSState *ics, int server, int nr, uint8_t priority) trace_xics_icp_irq(server, nr, priority); + if (!icp) { + qemu_log_mask(LOG_GUEST_ERROR, "XICS: invalid server %d for IRQ 0x%x\n", + server, nr); + ics_reject(ics, nr); + return; + } + if ((priority >= CPPR(icp)) || (XISR(icp) && (icp->pending_priority <= priority))) { ics_reject(ics, nr);