[PATCH] pcie_aer: fix pci_set_long overflow into PCI_EXP_LNKCAP

[lirongqing]

From: Li RongQing <lirongq...@baidu.com>

pcie_aer_inject_uncor_error() wrote inj->devsta (a uint16_t) into
PCI_EXP_DEVSTA using pci_set_long(), which writes 4 bytes. PCI_EXP_DEVSTA
is a 16-bit register at offset 0x0a; the extra 2 bytes written by
pci_set_long() land at offset 0x0c, the low half of PCI_EXP_LNKCAP,
zeroing the link speed/width capability fields on every uncorrectable
error injection.

Use pci_set_word() instead, matching the correctable error path in
pcie_aer_inject_cor_error().

Fixes: 34e65944c0351 ("pcie/aer: helper functions for pcie aer capability")
Signed-off-by: Li RongQing <lirongq...@baidu.com>
---
 hw/pci/pcie_aer.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/pci/pcie_aer.c b/hw/pci/pcie_aer.c
index 22497b1..43b14c1 100644
--- a/hw/pci/pcie_aer.c
+++ b/hw/pci/pcie_aer.c
@@ -589,7 +589,7 @@ static bool pcie_aer_inject_uncor_error(PCIEAERInject *inj, 
bool is_fatal)
     if (inj->unsupported_request) {
         inj->devsta |= PCI_EXP_DEVSTA_URD;
     }
-    pci_set_long(dev->config + dev->exp.exp_cap + PCI_EXP_DEVSTA, inj->devsta);
+    pci_set_word(dev->config + dev->exp.exp_cap + PCI_EXP_DEVSTA, inj->devsta);
 
     if (inj->aer_cap) {
         uint32_t mask = pci_get_long(inj->aer_cap + PCI_ERR_UNCOR_MASK);
-- 
2.9.4