Commit 86abb10256 for qemu.org

commit 86abb10256a58d50513d1f9c65652b7b6b7faafc
Author: Denis V. Lunev <den@openvz.org>
Date:   Fri Jul 17 14:22:30 2026 +0200

    vfio/pci: reject invalid PCI_INTERRUPT_PIN values

    qemu-kvm aborts a few seconds after starting a VM with a
    passed-through GPU whose PCI_INTERRUPT_PIN comes back as an
    out-of-range value: vfio_intx_enable() only guards against pin == 0
    and stores vdev->intx.pin = pin - 1 with no upper-bound check. That
    value later reaches pci_irq_handler()'s
    assert(0 <= irq_num && irq_num < PCI_NUM_PINS) via
    pci_irq_deassert() -> pci_set_irq(), aborting the process.

    Legal PCI_INTERRUPT_PIN values are 0 (no legacy interrupt) or
    1-PCI_NUM_PINS (INTA-INTD); reject anything else before it reaches
    vdev->intx.pin, whether the out-of-range value came from a read
    failure (now caught by the previous commit) or was handed back as
    data by the device itself.

    Signed-off-by: Denis V. Lunev <den@openvz.org>
    CC: Alex Williamson <alex@shazbot.org>
    CC: Cédric Le Goater <clg@redhat.com>
    Link: https://lore.kernel.org/qemu-devel/20260717122232.468955-3-den@openvz.org
    Reviewed-by: Cédric Le Goater <clg@redhat.com>
    Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
    Signed-off-by: Cédric Le Goater <clg@redhat.com>

diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index b8c937d4be..380dd8c15f 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -338,6 +338,11 @@ static bool vfio_intx_enable(VFIOPCIDevice *vdev, Error **errp)
         return true;
     }

+    if (pin > PCI_NUM_PINS) {
+        error_setg(errp, "invalid PCI interrupt pin %d", pin);
+        return false;
+    }
+
     /*
      * Do not alter interrupt state during vfio_realize and cpr load.
      * The incoming state is cleared thereafter.