@samitouri / QOSamiQemu / commits / 86abb10256

vfio/pci: reject invalid PCI_INTERRUPT_PIN values

qemu-kvm aborts a few seconds after starting a VM with a passed-through GPU whose PCI_INTERRUPT_PIN comes back as an out-of-range value: vfio_intx_enable() only guards against pin == 0 and stores vdev->intx.pin = pin - 1 with no upper-bound check. That value later reaches pci_irq_handler()'s assert(0 <= irq_num && irq_num < PCI_NUM_PINS) via pci_irq_deassert() -> pci_set_irq(), aborting the process. Legal PCI_INTERRUPT_PIN values are 0 (no legacy interrupt) or 1-PCI_NUM_PINS (INTA-INTD); reject anything else before it reaches vdev->intx.pin, whether the out-of-range value came from a read failure (now caught by the previous commit) or was handed back as data by the device itself. Signed-off-by: Denis V. Lunev <den@openvz.org> CC: Alex Williamson <alex@shazbot.org> CC: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20260717122232.468955-3-den@openvz.org Reviewed-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Signed-off-by: Cédric Le Goater <clg@redhat.com>

Denis V. Lunev committed Jul 17, 2026 at 14:22 UTC 86abb10256a58d50513d1f9c65652b7b6b7faafc

1 file changed +5

hw/vfio/pci.c

@@ -338,6 +338,11 @@ static bool vfio_intx_enable(VFIOPCIDevice *vdev, Error **errp)

338 return true;

339 }

340

341 + if (pin > PCI_NUM_PINS) {

342 + error_setg(errp, "invalid PCI interrupt pin %d", pin);

343 + return false;

344 + }

345 +

346 /*

347 * Do not alter interrupt state during vfio_realize and cpr load.

348 * The incoming state is cleared thereafter.