qemu-kvm aborts a few seconds after starting a VM with a
passed-through GPU whose PCI_INTERRUPT_PIN comes back as an
out-of-range value: vfio_intx_enable() only guards against pin == 0
and stores vdev->intx.pin = pin - 1 with no upper-bound check. That
value reaches pci_irq_handler()'s
assert(0 <= irq_num && irq_num < PCI_NUM_PINS) via
pci_irq_deassert() -> pci_set_irq(), aborting the whole process
instead of just failing the device.

v1 -> v2:
* original submission was wrongly ported patch from downstream. Fixed
* added checks for narrowed values

Signed-off-by: Denis V. Lunev <den@openvz.org>
CC: Alex Williamson <alex@shazbot.org>
CC: "Cédric Le Goater" <clg@redhat.com>

Denis V. Lunev (2):
  vfio/pci: don't narrow a failed config read to a plausible value
  vfio/pci: reject invalid PCI_INTERRUPT_PIN values

 hw/vfio/pci.c | 37 ++++++++++++++++++++++++++++++-------
 1 file changed, 30 insertions(+), 7 deletions(-)

-- 
2.53.0