Commit 4905143ef8 for qemu.org

commit 4905143ef8d29886c64daa8b78094c4f8d5aa9cc
Author: Li RongQing <lirongqing@baidu.com>
Date:   Tue Sep 15 15:29:08 2026 +0800

    pcie_aer: fix pci_set_long overflow into PCI_EXP_LNKCAP

    pcie_aer_inject_uncor_error() wrote inj->devsta (a uint16_t) into
    PCI_EXP_DEVSTA using pci_set_long(), which writes 4 bytes. PCI_EXP_DEVSTA
    is a 16-bit register at offset 0x0a; the extra 2 bytes written by
    pci_set_long() land at offset 0x0c, the low half of PCI_EXP_LNKCAP,
    zeroing the link speed/width capability fields on every uncorrectable
    error injection.

    Use pci_set_word() instead, matching the correctable error path in
    pcie_aer_inject_cor_error().

    Fixes: 34e65944c035 ("pcie/aer: helper functions for pcie aer capability")
    Signed-off-by: Li RongQing <lirongqing@baidu.com>
    Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
    Message-ID: <20260915072908.2197-1-lirongqing@baidu.com>

diff --git a/hw/pci/pcie_aer.c b/hw/pci/pcie_aer.c
index 22497b1fd6..43b14c1f22 100644
--- a/hw/pci/pcie_aer.c
+++ b/hw/pci/pcie_aer.c
@@ -589,7 +589,7 @@ static bool pcie_aer_inject_uncor_error(PCIEAERInject *inj, bool is_fatal)
     if (inj->unsupported_request) {
         inj->devsta |= PCI_EXP_DEVSTA_URD;
     }
-    pci_set_long(dev->config + dev->exp.exp_cap + PCI_EXP_DEVSTA, inj->devsta);
+    pci_set_word(dev->config + dev->exp.exp_cap + PCI_EXP_DEVSTA, inj->devsta);

     if (inj->aer_cap) {
         uint32_t mask = pci_get_long(inj->aer_cap + PCI_ERR_UNCOR_MASK);