[rpms/mstflint] rawhide: fix segfault on ConnectX-3

[rpms/mstflint] rawhide: fix segfault on ConnectX-3

[Michal Schmidt]

            A new commit has been pushed.

            Repo   : rpms/mstflint
            Branch : rawhide
            Commit : 43ba4cf5f1ef0056a8a28917fbb068568a508ff8
            Author : Michal Schmidt <mschmidt@redhat.com>
            Date   : 2026-08-08T16:21:01+02:00
            Stats  : +47/-0 in 2 file(s)
            URL    : https://src.fedoraproject.org/rpms/mstflint/c/43ba4cf5f1ef0056a8a28917fbb068568a508ff8?branch=rawhide

            Log:
            fix segfault on ConnectX-3

Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2445760

---
diff --git a/0001-mtcr-fix-segfault-in-pciconf-open-when-VSEC-is-not-f.patch b/0001-mtcr-fix-segfault-in-pciconf-open-when-VSEC-is-not-f.patch
new file mode 100644
index 0000000..6486f35
--- /dev/null
+++ b/0001-mtcr-fix-segfault-in-pciconf-open-when-VSEC-is-not-f.patch
@@ -0,0 +1,43 @@
+From a434999ca080d30f57a8e4d80621151e71da4fa0 Mon Sep 17 00:00:00 2001
+From: Michal Schmidt <mschmidt@redhat.com>
+Date: Thu, 30 Jul 2026 16:04:02 +0200
+Subject: [PATCH] mtcr: fix segfault in pciconf open when VSEC is not fully
+ supported
+
+When a device reports FUNCTIONAL_VSC but does not pass the
+VSEC_SUPPORTED_UL() check, the ctx->mread4 and ctx->mwrite4 function
+pointers are left NULL. The fallback that assigns old-style pciconf
+read/write functions is guarded by !mf->functional_vsec_supp, which was
+already set to 1, so it is skipped. The first mread4() call then
+dereferences NULL and crashes.
+
+Fix this by clearing functional_vsec_supp back to 0 when
+VSEC_SUPPORTED_UL() is false, so the existing fallback assigns
+mtcr_pciconf_mread4_old/mtcr_pciconf_mwrite4_old.
+
+Observed on ConnectX-3 Pro (PCI device ID 0x1007).
+
+Fixes: https://github.com/Mellanox/mstflint/issues/1157
+Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
+---
+ mtcr_ul/mtcr_ul_com.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/mtcr_ul/mtcr_ul_com.c b/mtcr_ul/mtcr_ul_com.c
+index 6df91f510ac9..f199102bcbd6 100644
+--- a/mtcr_ul/mtcr_ul_com.c
++++ b/mtcr_ul/mtcr_ul_com.c
+@@ -2367,6 +2367,10 @@ static int mtcr_pciconf_open(mfile* mf, const char* name, u_int32_t adv_opt)
+                 ctx->mread4_block = (f_mread4_block)mread4_block_pciconf;
+                 ctx->mwrite4_block = (f_mwrite4_block)mwrite4_block_pciconf;
+             }
++            else
++            {
++                mf->functional_vsec_supp = 0;
++            }
+ 
+             mf->pxir_vsec_supp = 0;
+             if ((mf->vsec_cap_mask & (1 << space_to_cap_offset(AS_PCI_CRSPACE))) && (mf->vsec_cap_mask & (1 << space_to_cap_offset(AS_PCI_ALL_ICMD))) &&
+-- 
+2.55.0
+

diff --git a/mstflint.spec b/mstflint.spec
index bfee298..371255e 100644
--- a/mstflint.spec
+++ b/mstflint.spec
@@ -24,6 +24,10 @@ Obsoletes:	openib-mstflint <= 1.4 openib-tvflash <= 0.9.2 tvflash <= 0.9.0
 ExcludeArch:	s390 %{arm} %{ix86}
 Requires:	python3
 
+%patchlist
+# https://github.com/Mellanox/mstflint/pull/1831
+0001-mtcr-fix-segfault-in-pciconf-open-when-VSEC-is-not-f.patch
+
 %description
 This package contains firmware update tool, vpd dump and register dump tools
 for network adapters based on Mellanox Technologies chips.