@samitouri / QOSamiQemu / commits / 2181097812

ppc/pnv_phb3: Error out on invalid config access

PHB in Power8 supports 8 byte registers, and hence the ops structure allows accessing of 8 bytes in 'pnv_phb3_reg_ops' Both 'pnv_phb3_reg_read' & 'pnv_phb3_reg_write' pass the arguments as is to 'pnv_phb3_config_{read,write}', if offset is PHB_CONFIG_DATA. This when called with size as 8, causes following assert failure in 'pci_host_config_read_common' & 'pci_host_config_write_common': assert(len <= 4); Validate that size is <=4, before jumping to pci_host_config_{read,write}_common Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3334 Reported-by: Zexiang Zhang <chan9yan9@gmail.com> Fixes: 9ae1329ee2fe ("ppc/pnv: Add models for POWER8 PHB3 PCIe Host bridge") Signed-off-by: Aditya Gupta <adityag@linux.ibm.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Message-Id: <20260326190438.734239-2-adityag@linux.ibm.com>

Aditya Gupta committed Mar 27, 2026 at 00:34 UTC 218109781209f9d77242b2cdf743acac8bc3b893

1 file changed +10

hw/pci-host/pnv_phb3.c

+10

@@ -475,6 +475,11 @@ void pnv_phb3_reg_write(void *opaque, hwaddr off, uint64_t val, unsigned size)

475

476 /* Special case configuration data */

477 if ((off & 0xfffc) == PHB_CONFIG_DATA) {

478 + if (size > 4) {

479 + phb3_error(phb, "Invalid config access, offset: 0x%"PRIx64" size: %d",

480 + off, size);

481 + return;

482 + }

483 pnv_phb3_config_write(phb, off & 0x3, size, val);

484 return;

485 }

@@ -597,6 +602,11 @@ uint64_t pnv_phb3_reg_read(void *opaque, hwaddr off, unsigned size)

602 uint64_t val;

603

604 if ((off & 0xfffc) == PHB_CONFIG_DATA) {

605 + if (size > 4) {

606 + phb3_error(phb, "Invalid config access, offset: 0x%"PRIx64" size: %d",

607 + off, size);

608 + return ~0ull;

609 + }

610 return pnv_phb3_config_read(phb, off & 0x3, size);

611 }

612