hw/pci: Replace assert with bounds check and return
As reported in https://gitlab.com/qemu-project/qemu/-/work_items/3334, callers of 'pci_host_config_{read,write}_common' can pass length as 8, causing an assert failure The original issue with pnv_phb3 triggering the assert was fixed in a previous commit Instead of asserting on invalid length, check if the length is valid (<=4), otherwise return (with the failure error code in read) Reported-by: Zexiang Zhang <chan9yan9@gmail.com> Signed-off-by: Aditya Gupta <adityag@linux.ibm.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Message-Id: <20260326190438.734239-3-adityag@linux.ibm.com>
Aditya Gupta committed
Mar 27, 2026 at 00:34 UTC
c7209c56718107fefd5deae140a450954d31ff2b
1 file changed
+12
-2
hw/pci/pci_host.c
+12
-2
@@ -81,7 +81,12 @@ void pci_host_config_write_common(PCIDevice *pci_dev, uint32_t addr,
81
return;
82
}
83
84
- assert(len <= 4);
84
+ if (len > 4) {
85
+ PCI_DPRINTF("%s: invalid length access: addr " HWADDR_FMT_plx " \
86
+ len %d val %"PRIx32"\n", __func__, addr, len, val);
87
+ return;
88
+ }
89
+
90
/* non-zero functions are only exposed when function 0 is present,
91
* allowing direct removal of unexposed functions.
92
*/
@@ -106,7 +111,12 @@ uint32_t pci_host_config_read_common(PCIDevice *pci_dev, uint32_t addr,
111
return ~0x0;
112
}
113
109
- assert(len <= 4);
114
+ if (len > 4) {
115
+ PCI_DPRINTF("%s: invalid length access: addr " HWADDR_FMT_plx " \
116
+ len %d val %"PRIx32"\n", __func__, addr, len, val);
117
+ return ~0x0;
118
+ }
119
+
120
/* non-zero functions are only exposed when function 0 is present,
121
* allowing direct removal of unexposed functions.
122
*/