starred/qemu
1
0
Fork 0
mirror of https://github.com/qemu/qemu.git synced 2026-07-08 17:46:10 +00:00
Code Issues 380 Packages Projects Releases Wiki Activity

hw/pci: Replace assert with bounds check and return

Browse Source 
As reported in https://gitlab.com/qemu-project/qemu/-/work_items/3334,
callers of 'pci_host_config_{read,write}_common' can pass length as 8,
causing an assert failure

The original issue with pnv_phb3 triggering the assert was fixed in a
previous commit

Instead of asserting on invalid length, check if the length is valid
(<=4), otherwise return (with the failure error code in read)

Reported-by: Zexiang Zhang <chan9yan9@gmail.com>
Signed-off-by: Aditya Gupta <adityag@linux.ibm.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260326190438.734239-3-adityag@linux.ibm.com>
This commit is contained in:
Aditya Gupta
2026-03-27 00:34:38 +05:30
committed by Michael S. Tsirkin
parent 2181097812
commit c7209c5671
1 changed files with 12 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
hw/pci/pci_host.c
View File

@@ -81,7 +81,12 @@ void pci_host_config_write_common(PCIDevice *pci_dev, uint32_t addr,
return;
}
assert(len <= 4);
if (len > 4) {
PCI_DPRINTF("%s: invalid length access: addr " HWADDR_FMT_plx " \
len %d val %"PRIx32"\n", __func__, addr, len, val);
return;
}
/* non-zero functions are only exposed when function 0 is present,
* allowing direct removal of unexposed functions.
*/
@@ -106,7 +111,12 @@ uint32_t pci_host_config_read_common(PCIDevice *pci_dev, uint32_t addr,
return ~0x0;
}
assert(len <= 4);
if (len > 4) {
PCI_DPRINTF("%s: invalid length access: addr " HWADDR_FMT_plx " \
len %d val %"PRIx32"\n", __func__, addr, len, val);
return ~0x0;
}
/* non-zero functions are only exposed when function 0 is present,
* allowing direct removal of unexposed functions.
*/