# Issue Body ## Host environment - Operating system: `Ubuntu 22.04` - OS/kernel version: `Linux 6.8.0 x86_64` - Architecture: `x86_64` - QEMU flavor: Upstream code issue - QEMU version: `v11.0.2` (also verified on v10.1.2 and v10.2.2; confirmed present in current master) ## Description of problem The `htmsi_vector` array is guest-writable via MMIO (each element is a uint8 with value range 0–255), and its elements are used directly as indices into the `parent_irq` array, which has a fixed size of 64 (`qemu_irq parent_irq[64]`). No bounds check is performed before the indexing operation. A guest that writes `htmsi_vector[irq] = 255` and then triggers the corresponding interrupt causes `parent_irq[255]` to be accessed — reading a pointer from 191 slots beyond the array boundary and passing it to `qemu_set_irq()`. The vulnerable code at `hw/intc/loongarch_pch_pic.c:28`: ```c qemu_set_irq(s->parent_irq[s->htmsi_vector[irq]], 1); /* ^^^^^^^^^^^^^^^^^^^^ * htmsi_vector[irq]: guest-controlled uint8 (0..255) * parent_irq[]: fixed size 64 → OOB when value >= 64 */ ``` The `htmsi_vector` array is populated through the guest-writable MMIO register range `PCH_PIC_HTMSI_VEC` (write handler at line 176). No validation constrains the stored value to be less than `irq_num` (64). UBSan output from a clean v11.0.2 build: ``` hw/intc/loongarch_pch_pic.c:28:39: runtime error: index 255 out of bounds for type 'IRQState *[64]' #0 pch_pic_update_irq hw/intc/loongarch_pch_pic.c:28 #1 pch_pic_irq_handler hw/intc/loongarch_pch_pic.c:78 ``` In non-sanitizer builds, the out-of-bounds read fetches a pointer from beyond the `parent_irq` array. The most likely outcome is a SIGSEGV when `qemu_set_irq()` dereferences the garbage pointer, crashing the host QEMU process (guest-triggerable DoS). ## Steps to reproduce 1. Clone/extract QEMU v11.0.2 source 2. Build with UBSan: ``` mkdir build && cd build ../configure --target-list=loongarch64-softmmu --enable-debug \ --extra-cflags="-O1 -g -fsanitize=address,undefined -fno-omit-frame-pointer" \ --extra-ldflags="-fsanitize=address,undefined" ninja qemu-system-loongarch64 ``` 3. Run with the attached trigger binary: ``` ./build/qemu-system-loongarch64 -machine virt -m 256M -nographic -no-reboot \ -bios poc_pch_pic_oob_trigger.bin ``` 4. After 2 seconds, send newlines to stdin (to trigger UART RX interrupt on IRQ 2) 5. Observe UBSan `index 255 out of bounds for type 'IRQState *[64]'` ## Additional information - The attached `poc_pch_pic_oob_trigger.S` is bare-metal LoongArch assembly (no guest OS required). A pre-assembled binary is also included. - The trigger writes `htmsi_vector[2] = 0xFF` via MMIO, then waits for UART RX interrupt. - Verified on three consecutive stable releases (10.1.2, 10.2.2, 11.0.2) — all affected. - Suggested fix: add `if (s->htmsi_vector[irq] >= s->irq_num) return;` before the `qemu_set_irq()` call. [crash.log](/uploads/0e6d0c3fd7c4488e8892ad31bc44e03c/crash.log) [poc_pch_pic_oob_trigger.bin](/uploads/c06c2a3d050b47266f581ffe9e112b2e/poc_pch_pic_oob_trigger.bin) [poc_pch_pic_oob_trigger.S](/uploads/3b8da148aa94234cbe4057bfe52fd320/poc_pch_pic_oob_trigger.S)