From nobody Mon Sep 28 02:05:45 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785422468; cv=none; d=zohomail.com; s=zohoarc; b=IfBLIEdKsxM0md5eEm7LGBvrsuVlvOMicTynbZnO8hitU3N8j4hPp5oe4zFRHRnE/9UK2N4NgBtDUvPZPBgE59pxTmgVfS8uGob/wKp2u0Di/X2EW/Chk2iMKhlAOKllCMvD2I/xm8slzUT4RGO+kOzNEKk0auB/NSXp4xWk9R4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785422468; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=WU7696LrQetw1gphi8sovpLXs74SqnB+0kWy0HhzST0=; b=X5M/w/ZddI1SxIqTtv264kxl7sLJhPE2aaHlfCqJhILDsbBAbat+2RjNukCbHslI1NU19f78IqlnS/RwpBQF6xVhMT8wPu6FQzO9y/MMfPaNghWk6hSJBLkmMg6gl7nIdHUxEV58tHINKt8XzMMD5bk708R9Y9g+8al3vzG7Mt8= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785422468300156.50724907012102; Thu, 30 Jul 2026 07:41:08 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wpRva-0007Ph-RO; Thu, 30 Jul 2026 10:40:06 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wpRvS-0007Mt-07 for qemu-devel@nongnu.org; Thu, 30 Jul 2026 10:39:59 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wpRvQ-0007x1-1q for qemu-devel@nongnu.org; Thu, 30 Jul 2026 10:39:57 -0400 Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-284-EJjkGOXbOgGF_UUN9IHc0A-1; Thu, 30 Jul 2026 10:39:49 -0400 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id F0E2519560B0; Thu, 30 Jul 2026 14:39:47 +0000 (UTC) Received: from thuth-p1g4.redhat.com (unknown [10.44.49.70]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 87F1E1956044; Thu, 30 Jul 2026 14:39:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785422394; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=WU7696LrQetw1gphi8sovpLXs74SqnB+0kWy0HhzST0=; b=LkEE8Id1MaS6i1tl3zNqZUYrsf56LUzVVkDHlB8xwc/y5jzi4qxIlMZmEtXcP0JjZprm7L 1mjM+bjNMyRrkRx0OiyNk0Nnn9ygEyA8HyfLAUmwCtdUrU+NWRd2/tKd3b/h3el/Uujahw D3+jvbxyTgXuE4LP0hXHiEKiSEyfUvs= X-MC-Unique: EJjkGOXbOgGF_UUN9IHc0A-1 X-Mimecast-MFC-AGG-ID: EJjkGOXbOgGF_UUN9IHc0A_1785422388 From: Thomas Huth To: qemu-devel@nongnu.org, Dmitry Fleytman Cc: Jason Wang , qemu-trivial@nongnu.org, qemu-stable@nongnu.org Subject: [PATCH] hw/net/vmxnet3: Do not abort if guest provides bad interrupt numbers Date: Thu, 30 Jul 2026 16:39:43 +0200 Message-ID: <20260730143943.1117129-1-thuth@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=thuth@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -2 X-Spam_score: -0.3 X-Spam_bar: / X-Spam_report: (-0.3 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-1.58, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785422471075158500 Content-Type: text/plain; charset="utf-8" From: Thomas Huth vmxnet3_validate_interrupts() currently aborts via hw_error() if the guest provided bad interrupt numbers. This should not happen, QEMU should rather refuse to activate the device in this case instead. Thus propagate the error to the callers to handle it more gracefully there. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/539 Signed-off-by: Thomas Huth Reviewed-by: Philippe Mathieu-Daud=C3=A9 --- hw/net/vmxnet3.c | 35 +++++++++++++++++++++++++++-------- 1 file changed, 27 insertions(+), 8 deletions(-) diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c index 8569484b2f2..1c5d1d740cc 100644 --- a/hw/net/vmxnet3.c +++ b/hw/net/vmxnet3.c @@ -1336,32 +1336,46 @@ static bool vmxnet3_verify_intx(VMXNET3State *s, in= t intx) || intx =3D=3D pci_get_byte(s->parent_obj.config + PCI_INTERRUPT_P= IN) - 1; } =20 -static void vmxnet3_validate_interrupt_idx(bool is_msix, int idx) +static bool vmxnet3_validate_irq_idx(const char *type, bool is_msix, int i= dx) { int max_ints =3D is_msix ? VMXNET3_MAX_INTRS : VMXNET3_MAX_NMSIX_INTRS; + if (idx >=3D max_ints) { - hw_error("Bad interrupt index: %d\n", idx); + qemu_log_mask(LOG_GUEST_ERROR, + "vmxnet3: Bad %s queue interrupt index: %d\n", + type, idx); + return false; } + + return true; } =20 -static void vmxnet3_validate_interrupts(VMXNET3State *s) +static bool vmxnet3_validate_interrupts(VMXNET3State *s) { int i; =20 VMW_CFPRN("Verifying event interrupt index (%d)", s->event_int_idx); - vmxnet3_validate_interrupt_idx(s->msix_used, s->event_int_idx); + if (!vmxnet3_validate_irq_idx("event", s->msix_used, s->event_int_idx)= ) { + return false; + } =20 for (i =3D 0; i < s->txq_num; i++) { int idx =3D s->txq_descr[i].intr_idx; VMW_CFPRN("Verifying TX queue %d interrupt index (%d)", i, idx); - vmxnet3_validate_interrupt_idx(s->msix_used, idx); + if (!vmxnet3_validate_irq_idx("TX", s->msix_used, idx)) { + return false; + } } =20 for (i =3D 0; i < s->rxq_num; i++) { int idx =3D s->rxq_descr[i].intr_idx; VMW_CFPRN("Verifying RX queue %d interrupt index (%d)", i, idx); - vmxnet3_validate_interrupt_idx(s->msix_used, idx); + if (!vmxnet3_validate_irq_idx("RX", s->msix_used, idx)) { + return false; + } } + + return true; } =20 static bool vmxnet3_validate_queues(VMXNET3State *s) @@ -1554,7 +1568,10 @@ static void vmxnet3_activate_device(VMXNET3State *s) sizeof(s->rxq_descr[i].rxq_stats)); } =20 - vmxnet3_validate_interrupts(s); + if (!vmxnet3_validate_interrupts(s)) { + vmxnet3_reset(s); + return; + } =20 /* Make sure everything is in place before device activation */ smp_wmb(); @@ -2392,7 +2409,9 @@ static int vmxnet3_post_load(void *opaque, int versio= n_id) if (!vmxnet3_validate_queues(s)) { return -1; } - vmxnet3_validate_interrupts(s); + if (!vmxnet3_validate_interrupts(s)) { + return -1; + } =20 return 0; } --=20 2.55.0