Re: [Qemu-devel] [PATCH] Ignore pci unplug requests for unpluggable devices (CVE-2011-1751)

[Gerd Hoffmann <kraxel@redhat.com>]

   Hi,

>> diff --git a/hw/acpi_piix4.c b/hw/acpi_piix4.c
>> index 96f5222..6c908ff 100644
>> --- a/hw/acpi_piix4.c
>> +++ b/hw/acpi_piix4.c
>> @@ -471,11 +471,13 @@ static void pciej_write(void *opaque, uint32_t addr, uint32_t val)
>>       BusState *bus = opaque;
>>       DeviceState *qdev, *next;
>>       PCIDevice *dev;
>> +    PCIDeviceInfo *info;
>>       int slot = ffs(val) - 1;
>>
>>       QLIST_FOREACH_SAFE(qdev,&bus->children, sibling, next) {
>>           dev = DO_UPCAST(PCIDevice, qdev, qdev);
>> -        if (PCI_SLOT(dev->devfn) == slot) {
>> +        info = container_of(qdev->info, PCIDeviceInfo, qdev);
>> +        if (PCI_SLOT(dev->devfn) == slot&&  !info->no_hotplug) {
>>               qdev_free(qdev);
>>           }
>>       }
>
> Looks good, but what about pcie_cap_slot_hotplug()?

Dunno, didn't look at q35 yet.  I'd expect the root bus isn't 
hot-pluggable, so the guest wouldn't be able to rip out any essential 
chipset devices.  But having someone more familier with pcie + q35 
double-check would be good ...

cheers,
   Gerd