hw/intc/xics: Add a check for an invalid server id
A malformed IVE value can result in an invalid server field being passed to icp_irq(). The function assumes the server id is valid and may access invalid state otherwise, potentially leading to a crash. Fix this by validating the server id before using it and ignoring invalid values. Reported-by: Zexiang Zhang <chan9yan9@gmail.com> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3324 Signed-off-by: Zexiang Zhang <chan9yan9@gmail.com> Signed-off-by: Gautam Menghani <gautam@linux.ibm.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Link: https://lore.kernel.org/qemu-devel/20260428103645.50617-1-Gautam.Menghani@ibm.com Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
kiki committed
Apr 28, 2026 at 16:06 UTC
1aee8067fce95d15061eca8fbb6772d8a90ea699
1 file changed
+8
hw/intc/xics.c
+8
@@ -26,6 +26,7 @@
26
*/
27
28
#include "qemu/osdep.h"
29
+#include "qemu/log.h"
30
#include "qapi/error.h"
31
#include "trace.h"
32
#include "qemu/timer.h"
@@ -222,6 +223,13 @@ void icp_irq(ICSState *ics, int server, int nr, uint8_t priority)
223
224
trace_xics_icp_irq(server, nr, priority);
225
226
+ if (!icp) {
227
+ qemu_log_mask(LOG_GUEST_ERROR, "XICS: invalid server %d for IRQ 0x%x\n",
228
+ server, nr);
229
+ ics_reject(ics, nr);
230
+ return;
231
+ }
232
+
233
if ((priority >= CPPR(icp))
234
|| (XISR(icp) && (icp->pending_priority <= priority))) {
235
ics_reject(ics, nr);