On Wed, Apr 05, 2017 at 02:41:44PM +0200, Cédric Le Goater wrote:
> From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
> 
> Under some circumstances, pci_intx() can return -1 (when the interrupt
> pin in the config space is 0 which normally means no interrupt).
> 
> I have seen cases of pci_set_irq() being called on such devices, in
> turn causing pci_irq_handler() to be called with "-1" as an argument
> which doesn't seem like a terribly good idea.
> 
> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
> [clg: updated for qemu-2.9 ]
> Signed-off-by: Cédric Le Goater <clg@kaod.org>

Reviewed-by: David Gibson <david@gibson.dropbear.id.au>

This looks like a real bug fix which should go to Michael independent
of the rest of the series.

> ---
>  hw/pci/pci.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/hw/pci/pci.c b/hw/pci/pci.c
> index 817ad14ed987..bfd65461348c 100644
> --- a/hw/pci/pci.c
> +++ b/hw/pci/pci.c
> @@ -1419,7 +1419,9 @@ qemu_irq pci_allocate_irq(PCIDevice *pci_dev)
>  void pci_set_irq(PCIDevice *pci_dev, int level)
>  {
>      int intx = pci_intx(pci_dev);
> -    pci_irq_handler(pci_dev, intx, level);
> +    if (intx >= 0) {
> +        pci_irq_handler(pci_dev, intx, level);
> +    }
>  }
>  
>  /* Special hooks used by device assignment */

-- 
David Gibson			| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au	| minimalist, thank you.  NOT _the_ _other_
				| _way_ _around_!
http://www.ozlabs.org/~dgibson