diff options
| author | Aditya Gupta <adityag@linux.ibm.com> | 2026-03-27 00:34:38 +0530 |
|---|---|---|
| committer | Michael Tokarev <mjt@tls.msk.ru> | 2026-06-24 16:34:52 +0300 |
| commit | eb6e366ec97b463f475eb54f8feb18a862e959ac (patch) | |
| tree | 0676d1d28ceb05a9b8439575f480185cc59c8422 | |
| parent | 2fbc7d3258a1d435563b0062720379bef41dce4e (diff) | |
| download | qemu-eb6e366ec97b463f475eb54f8feb18a862e959ac.tar.gz qemu-eb6e366ec97b463f475eb54f8feb18a862e959ac.zip | |
hw/pci: Replace assert with bounds check and return
As reported in https://gitlab.com/qemu-project/qemu/-/work_items/3334,
callers of 'pci_host_config_{read,write}_common' can pass length as 8,
causing an assert failure
The original issue with pnv_phb3 triggering the assert was fixed in a
previous commit
Instead of asserting on invalid length, check if the length is valid
(<=4), otherwise return (with the failure error code in read)
Reported-by: Zexiang Zhang <chan9yan9@gmail.com>
Signed-off-by: Aditya Gupta <adityag@linux.ibm.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260326190438.734239-3-adityag@linux.ibm.com>
(cherry picked from commit c7209c56718107fefd5deae140a450954d31ff2b)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
| -rw-r--r-- | hw/pci/pci_host.c | 14 |
1 files changed, 12 insertions, 2 deletions
diff --git a/hw/pci/pci_host.c b/hw/pci/pci_host.c index 91e3885c7f..2a7fdfa563 100644 --- a/hw/pci/pci_host.c +++ b/hw/pci/pci_host.c @@ -81,7 +81,12 @@ void pci_host_config_write_common(PCIDevice *pci_dev, uint32_t addr, return; } - assert(len <= 4); + if (len > 4) { + PCI_DPRINTF("%s: invalid length access: addr " HWADDR_FMT_plx " \ + len %d val %"PRIx32"\n", __func__, addr, len, val); + return; + } + /* non-zero functions are only exposed when function 0 is present, * allowing direct removal of unexposed functions. */ @@ -106,7 +111,12 @@ uint32_t pci_host_config_read_common(PCIDevice *pci_dev, uint32_t addr, return ~0x0; } - assert(len <= 4); + if (len > 4) { + PCI_DPRINTF("%s: invalid length access: addr " HWADDR_FMT_plx " \ + len %d val %"PRIx32"\n", __func__, addr, len, val); + return ~0x0; + } + /* non-zero functions are only exposed when function 0 is present, * allowing direct removal of unexposed functions. */ |