[PATCH] hw/audio/cs4231a: fix assertion error in isa_bus_get_irq

[PATCH] hw/audio/cs4231a: fix assertion error in isa_bus_get_irq

[Zheng Huang]

This patch fixes an assertion error in isa_bus_get_irq() in
/hw/isa/isa-bus.c by adding a constraint to the irq property.

Signed-off-by: Zheng Huang <hz1624917200@gmail.com>
---
 hw/audio/cs4231a.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/hw/audio/cs4231a.c b/hw/audio/cs4231a.c
index 5a9be80ba3..d390da4c37 100644
--- a/hw/audio/cs4231a.c
+++ b/hw/audio/cs4231a.c
@@ -682,6 +682,10 @@ static void cs4231a_realizefn (DeviceState *dev, Error **errp)
         return;
     }
 
+    if (s->irq >= ISA_NUM_IRQS) {
+        error_setg(errp, "Invalid IRQ %d (max %d)", s->irq, ISA_NUM_IRQS);
+        return;
+    }
     s->pic = isa_bus_get_irq(bus, s->irq);
     k = ISADMA_GET_CLASS(s->isa_dma);
     k->register_channel(s->isa_dma, s->dma, cs_dma_read, s);
-- 
2.34.1

Re: [PATCH] hw/audio/cs4231a: fix assertion error in isa_bus_get_irq

[Philippe Mathieu-Daudé]

Hi Zheng,

On 9/5/25 13:15, Zheng Huang wrote:
> This patch fixes an assertion error in isa_bus_get_irq() in
> /hw/isa/isa-bus.c by adding a constraint to the irq property.

Can you provide a reproducer to trigger that?

> 
> Signed-off-by: Zheng Huang <hz1624917200@gmail.com>
> ---
>   hw/audio/cs4231a.c | 4 ++++
>   1 file changed, 4 insertions(+)
> 
> diff --git a/hw/audio/cs4231a.c b/hw/audio/cs4231a.c
> index 5a9be80ba3..d390da4c37 100644
> --- a/hw/audio/cs4231a.c
> +++ b/hw/audio/cs4231a.c
> @@ -682,6 +682,10 @@ static void cs4231a_realizefn (DeviceState *dev, Error **errp)
>           return;
>       }
>   
> +    if (s->irq >= ISA_NUM_IRQS) {
> +        error_setg(errp, "Invalid IRQ %d (max %d)", s->irq, ISA_NUM_IRQS);
> +        return;
> +    }
>       s->pic = isa_bus_get_irq(bus, s->irq);
>       k = ISADMA_GET_CLASS(s->isa_dma);
>       k->register_channel(s->isa_dma, s->dma, cs_dma_read, s);

Re: [PATCH] hw/audio/cs4231a: fix assertion error in isa_bus_get_irq

[Zheng Huang]

Hi Philippe,

On 2025/5/9 19:28, Philippe Mathieu-Daudé wrote:
> Hi Zheng,
> 
> On 9/5/25 13:15, Zheng Huang wrote:
>> This patch fixes an assertion error in isa_bus_get_irq() in
>> /hw/isa/isa-bus.c by adding a constraint to the irq property.
> 
> Can you provide a reproducer to trigger that?
> 

Sure, this bug occures when start qemu with:

```bash
qemu-system-x86_64 -display none -machine accel=qtest -m 64 -M pc  -nodefaults -audiodev none,id=snd0 -nodefaults -device cs4231a,audiodev=snd0,irq=17
```

and error message following:
qemu-system-x86_64: ../hw/isa/isa-bus.c:84: qemu_irq isa_bus_get_irq(ISABus *, unsigned int): Assertion `irqnum < ISA_NUM_IRQS' failed.

Besides, pls refer to patch v2, in which I updated the constraint.

>>
>> Signed-off-by: Zheng Huang <hz1624917200@gmail.com>
>> ---
>>   hw/audio/cs4231a.c | 4 ++++
>>   1 file changed, 4 insertions(+)
>>
>> diff --git a/hw/audio/cs4231a.c b/hw/audio/cs4231a.c
>> index 5a9be80ba3..d390da4c37 100644
>> --- a/hw/audio/cs4231a.c
>> +++ b/hw/audio/cs4231a.c
>> @@ -682,6 +682,10 @@ static void cs4231a_realizefn (DeviceState *dev, Error **errp)
>>           return;
>>       }
>>   +    if (s->irq >= ISA_NUM_IRQS) {
>> +        error_setg(errp, "Invalid IRQ %d (max %d)", s->irq, ISA_NUM_IRQS);
>> +        return;
>> +    }
>>       s->pic = isa_bus_get_irq(bus, s->irq);
>>       k = ISADMA_GET_CLASS(s->isa_dma);
>>       k->register_channel(s->isa_dma, s->dma, cs_dma_read, s);
>