@samitouri / QOSamiQemu / commits / c7209c5671

hw/pci: Replace assert with bounds check and return

As reported in https://gitlab.com/qemu-project/qemu/-/work_items/3334, callers of 'pci_host_config_{read,write}_common' can pass length as 8, causing an assert failure The original issue with pnv_phb3 triggering the assert was fixed in a previous commit Instead of asserting on invalid length, check if the length is valid (<=4), otherwise return (with the failure error code in read) Reported-by: Zexiang Zhang <chan9yan9@gmail.com> Signed-off-by: Aditya Gupta <adityag@linux.ibm.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Message-Id: <20260326190438.734239-3-adityag@linux.ibm.com>

Aditya Gupta committed Mar 27, 2026 at 00:34 UTC c7209c56718107fefd5deae140a450954d31ff2b
1 file changed +12 -2
hw/pci/pci_host.c
+12 -2
@@ -81,7 +81,12 @@ void pci_host_config_write_common(PCIDevice *pci_dev, uint32_t addr,
81 return;
82 }
83
84 - assert(len <= 4);
84 + if (len > 4) {
85 + PCI_DPRINTF("%s: invalid length access: addr " HWADDR_FMT_plx " \
86 + len %d val %"PRIx32"\n", __func__, addr, len, val);
87 + return;
88 + }
89 +
90 /* non-zero functions are only exposed when function 0 is present,
91 * allowing direct removal of unexposed functions.
92 */
@@ -106,7 +111,12 @@ uint32_t pci_host_config_read_common(PCIDevice *pci_dev, uint32_t addr,
111 return ~0x0;
112 }
113
109 - assert(len <= 4);
114 + if (len > 4) {
115 + PCI_DPRINTF("%s: invalid length access: addr " HWADDR_FMT_plx " \
116 + len %d val %"PRIx32"\n", __func__, addr, len, val);
117 + return ~0x0;
118 + }
119 +
120 /* non-zero functions are only exposed when function 0 is present,
121 * allowing direct removal of unexposed functions.
122 */