qemu-kvm aborts a few seconds after starting a VM with a passed-through GPU whose PCI_INTERRUPT_PIN comes back as an out-of-range value: vfio_intx_enable() only guards against pin == 0 and stores vdev->intx.pin = pin - 1 with no upper-bound check. That value reaches pci_irq_handler()'s assert(0 <= irq_num && irq_num < PCI_NUM_PINS) via pci_irq_deassert() -> pci_set_irq(), aborting the whole process instead of just failing the device.
v1 -> v2: * original submission was wrongly ported patch from downstream. Fixed * added checks for narrowed values Signed-off-by: Denis V. Lunev <[email protected]> CC: Alex Williamson <[email protected]> CC: "Cédric Le Goater" <[email protected]> Denis V. Lunev (2): vfio/pci: don't narrow a failed config read to a plausible value vfio/pci: reject invalid PCI_INTERRUPT_PIN values hw/vfio/pci.c | 37 ++++++++++++++++++++++++++++++------- 1 file changed, 30 insertions(+), 7 deletions(-) -- 2.53.0
