aboutsummaryrefslogtreecommitdiff
path: root/hw/acpi_piix4.c
diff options
context:
space:
mode:
authorGerd Hoffmann <kraxel@redhat.com>2011-04-27 11:05:34 +0200
committerGerd Hoffmann <kraxel@redhat.com>2011-05-19 11:06:49 +0200
commit505597e4476a6bc219d0ec1362b760d71cb4fdca (patch)
treecad818925eb5d7205cf33cfbf8a57a433eb5895c /hw/acpi_piix4.c
parent96d19bcbf5f679bbaaeab001b572c367fbfb2b03 (diff)
downloadqemu-505597e4476a6bc219d0ec1362b760d71cb4fdca.zip
qemu-505597e4476a6bc219d0ec1362b760d71cb4fdca.tar.gz
qemu-505597e4476a6bc219d0ec1362b760d71cb4fdca.tar.bz2
Ignore pci unplug requests for unpluggable devices (CVE-2011-1751)
This patch makes qemu ignore unplug requests from the guest for pci devices which are tagged as non-hotpluggable. Trouble spot is the piix4 chipset with the ISA bridge. Requests to unplug that one will make it go away together with all ISA bus devices, which are not prepared to be unplugged and thus don't cleanup, leaving active qemu timers behind in free'ed memory. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Diffstat (limited to 'hw/acpi_piix4.c')
-rw-r--r--hw/acpi_piix4.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/hw/acpi_piix4.c b/hw/acpi_piix4.c
index 96f5222..6c908ff 100644
--- a/hw/acpi_piix4.c
+++ b/hw/acpi_piix4.c
@@ -471,11 +471,13 @@ static void pciej_write(void *opaque, uint32_t addr, uint32_t val)
BusState *bus = opaque;
DeviceState *qdev, *next;
PCIDevice *dev;
+ PCIDeviceInfo *info;
int slot = ffs(val) - 1;
QLIST_FOREACH_SAFE(qdev, &bus->children, sibling, next) {
dev = DO_UPCAST(PCIDevice, qdev, qdev);
- if (PCI_SLOT(dev->devfn) == slot) {
+ info = container_of(qdev->info, PCIDeviceInfo, qdev);
+ if (PCI_SLOT(dev->devfn) == slot && !info->no_hotplug) {
qdev_free(qdev);
}
}