$NetBSD: patch-CVE-2015-5166,v 1.1 2015/08/23 16:17:12 spz Exp $ patch for CVE-2015-5166 aka XSA-139 from http://xenbits.xen.org/xsa/xsa139-qemuu-4.5.patch --- qemu-xen/hw/ide/piix.c.orig 2013-10-10 14:15:47.000000000 +0000 +++ qemu-xen/hw/ide/piix.c @@ -170,6 +170,7 @@ static int pci_piix3_xen_ide_unplug(Devi PCIIDEState *pci_ide; DriveInfo *di; int i = 0; + IDEDevice *idedev; pci_dev = DO_UPCAST(PCIDevice, qdev, dev); pci_ide = DO_UPCAST(PCIIDEState, dev, pci_dev); @@ -183,6 +184,12 @@ static int pci_piix3_xen_ide_unplug(Devi } bdrv_close(di->bdrv); pci_ide->bus[di->bus].ifs[di->unit].bs = NULL; + if (!(i % 2)) { + idedev = pci_ide->bus[di->bus].master; + } else { + idedev = pci_ide->bus[di->bus].slave; + } + idedev->conf.bs = NULL; drive_put_ref(di); } }