On 7/17/26 15:22, Denis V. Lunev wrote:
qemu-kvm aborts a few seconds after starting a VM with a
passed-through GPU whose PCI_INTERRUPT_PIN comes back as an
out-of-range value: vfio_intx_enable() only guards against pin == 0
and stores vdev->intx.pin = pin - 1 with no upper-bound check. That
value later reaches pci_irq_handler()'s
assert(0 <= irq_num && irq_num < PCI_NUM_PINS) via
pci_irq_deassert() -> pci_set_irq(), aborting the process.
Legal PCI_INTERRUPT_PIN values are 0 (no legacy interrupt) or
1-PCI_NUM_PINS (INTA-INTD); reject anything else before it reaches
vdev->intx.pin, whether the out-of-range value came from a read
failure (now caught by the previous commit) or was handed back as
data by the device itself.
Signed-off-by: Denis V. Lunev <[email protected]>
CC: Alex Williamson <[email protected]>
CC: "Cédric Le Goater" <[email protected]>
And this one too, feels like it should go to qemu-stable.
I'm picking it up (with context fixup for 10.0.x),
please let me know if I should not.
Thanks,
/mjt
