From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from AM0PR83CU005.outbound.protection.outlook.com (mail-westeuropeazon11020125.outbound.protection.outlook.com [52.101.69.125]) by lore.virtuozzo.com (Postfix) with ESMTPS id 02331802A5 for ; Fri, 9 Oct 2026 15:10:24 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=jRAdvmmCao0aDqWgyWSPUesGUHD06xeiYuUNQMS39+qKyc7nIxZ7RUmZwXPIK2/pTf913vo4a8F8VFKT0DByUvlpldldcmQHB2SKIpDrv2yHKd43KjOr5Pw1KA4RJ+00jJCFaIVQu3p2v+JQHfqGU1NINsVx3xfcu9mRBJdk3XESCuP6enc4vRyA0obCJ0olqYSesEz1j7kX/9xEWnRO1eHRB40fltpREFjpXHdqlC+L+dgTn2jKhGhrwnrsIBFA8Y8kvTESS0TNNhcQ4rtWLTQ5pOxfeI0+krgtjwoNKotKrsBu3Ak7a9/HJ6NoRL68vugDmAItkrFD9tfzSg66Zw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=laPoeN5l+/FQdxHLYU/lxEk9RedQcofK8lK13moOGfU=; b=ynkcg7UA8K4HEKMPJIlY7fuWvt2gRMbYgcLdXargFvUoBKycGhPedA+czU29sPwCuA+r1mdVGNcyfm6vS8jevO8QXs0/PKk4Kg4MwPqaPAjurxUN87iVvqGUMkkk1NaOdqq9PyhMXEQkNkkqZuaXywOgxTYESaZJFGybyjGWnvDRaapWk95aP8OSvfmyantYlVpNOgpIZtODJrOfCtSSIAti9gz9WiMVMfOJweKdVACY2o7D8NhxP+kCRtkIoOXQpCiLAzhjOTsoX/rtYieGfQY0V2uhgf00fXeDpgLTXLA2texip6DZqw6WcPAzyZJm7W+p+zxzhWvHNwFpqGrJRA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 69.169.224.2) smtp.rcpttodomain=virtuozzo.com smtp.mailfrom=eu-central-1.amazonses.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=sashiko.virtuozzo.com; dkim=pass (signature was verified) header.d=sashiko.virtuozzo.com; dkim=pass (signature was verified) header.d=amazonses.com; arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.onmicrosoft.com; s=selector2-virtuozzo-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=laPoeN5l+/FQdxHLYU/lxEk9RedQcofK8lK13moOGfU=; b=GX2mgxo+H0FFnTD6knbgevMbDbjvRLfnVTCj9J7VpRdqtsf7bEUiyGq6VBnRozRZ1Va+YePyDLIe6HmiUoPhJjZFwZ0drKvk9iMjm5ZO/AuIdytw/aHB5ubt43rY3y4rYRs2ggidt/2xBma+oU5HguRRpOOP9Fd05HURFmeEblc= Received: from DB9PR06CA0014.eurprd06.prod.outlook.com (2603:10a6:10:1db::19) by VI0PR08MB10655.eurprd08.prod.outlook.com (2603:10a6:800:209::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.522.5; Fri, 9 Oct 2026 15:10:16 +0000 Received: from DB1PEPF000509EC.eurprd03.prod.outlook.com (2603:10a6:10:1db:cafe::a8) by DB9PR06CA0014.outlook.office365.com (2603:10a6:10:1db::19) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.496.5 via Frontend Transport; Fri, 9 Oct 2026 15:10:16 +0000 Authentication-Results: mx.microsoft.com 1; spf=pass (sender IP is 69.169.224.2) smtp.mailfrom=eu-central-1.amazonses.com; dkim=pass (signature was verified) header.d=sashiko.virtuozzo.com;dkim=pass (signature was verified) header.d=amazonses.com;dmarc=pass action=none header.from=sashiko.virtuozzo.com; Received-SPF: Pass (protection.outlook.com: domain of eu-central-1.amazonses.com designates 69.169.224.2 as permitted sender) receiver=protection.outlook.com; client-ip=69.169.224.2; helo=b224-2.smtp-out.eu-central-1.amazonses.com; pr=C Received: from b224-2.smtp-out.eu-central-1.amazonses.com (69.169.224.2) by DB1PEPF000509EC.mail.protection.outlook.com (10.167.242.70) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.522.6 via Frontend Transport; Fri, 9 Oct 2026 15:10:16 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=23yjbh4k34hwzfubhuiim7m4inbd3ick; d=sashiko.virtuozzo.com; t=1791558616; h=Message-ID:From:Subject:To:In-Reply-To:References:Content-Type:Content-Transfer-Encoding:Date; bh=fHw3fvXTgvPpovp1aE4vk6cW/x437/eEMNrDfaViP4c=; b=EbkxbiDW7kjX0XV0e2xmNypxBdHjYmY//4r8yiqhcZeMid9Aj0g8DWQjCkp8wlgi DevrFAmZpahe7mcRUn5lxtqW3D6UqddCnkgap6q5dZOohbL1DgqkLnEY9qnvOvIrRsf Szb3MNNcoV4IW4BST1K4woEXcqbkNTArbJT8Z7VUPSVhxKFEMTpiWCHGfJic0pkaVVk z0zfVMUZu1Uglo2Vb7B9CDhoAFakMO/RuA3FMAVPGs6H+pyBO/Kaob4jS9X/XnZEcoJ GslwMHC3Gy8pEfJWqyAP/5Uhbgos/7iTE3NEQuOOzvkySHqZfd90ovFVuuVBmpohYRl Lf08DVYKAw== DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=qftdzk2dqsatjnlrq4r5brjbihpfcrsh; d=amazonses.com; t=1791558616; h=Message-ID:From:Subject:To:In-Reply-To:References:Content-Type:Content-Transfer-Encoding:Date:Feedback-ID; bh=fHw3fvXTgvPpovp1aE4vk6cW/x437/eEMNrDfaViP4c=; b=RKO7+9uVfBsQGgLHhFla2M8gl6r4ZEMH/NhToh7g3mzT95pOK/XT/SPRZ1hEF4vk uzRZ+6xrJ9LuUUKSquU5IwmvBhZ7KKHl5EPlItQ/DtMP5eUlSxhYcmMwGlaDGf4N7FQ yPjYFnBRfpFn2F5VDG4+qVMbobJGzjDYS7YdNpDw= Message-ID: <010701a1213703ef-0d759161-b2fc-49ad-b5c3-1c8ab42f685c-000000@eu-central-1.amazonses.com> From: no-reply@sashiko.virtuozzo.com Subject: Re: [PATCH QEMU HCI-8.1 03/21] vfio/pci: Reject invalid MSI-X Table and PBA BIR values To: Andrey Drobyshev , svt-core@virtuozzo.com In-Reply-To: <20261009-vfio_v1-v1-3-2ae91d5b8048@virtuozzo.com> References: <20261009-vfio_v1-v1-0-2ae91d5b8048@virtuozzo.com> <20261009-vfio_v1-v1-3-2ae91d5b8048@virtuozzo.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Fri, 9 Oct 2026 15:10:16 +0000 Feedback-ID: ::1.eu-central-1.2wRQJBpg9g1fGRYexx3dUuYGS25Bux+2TEOx72/m6U4=:AmazonSES X-SES-Outgoing: 2026.10.09-69.169.224.2 X-EOPAttributedMessage: 0 X-EOPTenantAttributedMessage: 0bc7f26d-0264-416e-a6fc-8352af79c58f:0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DB1PEPF000509EC:EE_|VI0PR08MB10655:EE_ MIME-Version: 1.0 X-MS-Office365-Filtering-Correlation-Id: 81b223cf-b52a-4b27-f7c1-08df26176d18 X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr X-MS-Exchange-AtpMessageProperties: SA List-Id: svt-core@virtuozzo.com X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|704161411799003|704162011799003|48200799018|61400799027|9140799003|32142699015|376014|10067099003|5063699009|56012099006|4113699003|5113699003|22082099003|4143699003|16102099003|18002099003|55112099003|13003099007; X-Microsoft-Antispam-Message-Info: =?utf-8?B?NUNlc20zY3htY3hLejdRRVFpK1YvL2taOFM2ckp0NFVxMCt0bDYwTU9qcURS?= =?utf-8?B?RU5HL2dCMDZTcWZjbEtLOW44QnZnMTNKWUZzRXdpb0ljMzlJQ0p6dnU2clB1?= =?utf-8?B?VjRUdDZTVi8zRmFLREVzTmlSbEZ0OCtHWlZkejRNV1lYTVhKcWcrcm9uMjR3?= =?utf-8?B?S2ZDSStHd2JJRGlVN3ltT0JRNTFtMUNwWDBSdzY4TlZZODJvbnpMYmxTZ2hz?= =?utf-8?B?dytIWGN1dTFVS1pIamZ6dmxLQjVkeGZFL3MvbDRGd2g5WndiYkR3eWhFK2FU?= =?utf-8?B?UGhDQUoxTFJ0S3l2Zlh4VU42RXJOTDJ2N2IwVlgyRG0vNW1JRlZlMDYxaGl3?= =?utf-8?B?WHV6WEVSY1pqYkU3eWJvSmxEVlJyQ3Y1Rm10VWZvWXVuZHlPdzZHZ2k5RGlL?= =?utf-8?B?emhDV3RUWWRJQU1DeXhmeXlCUGluVkZqZWlCQTBKVldwUzcxbEExckpIeFEr?= =?utf-8?B?aGF0TlNkS2NLOUdrQnRtcGhFK2JTWENXakppTVFBeUlXWjNKR2RRSGdFa2Jx?= =?utf-8?B?MjBXQ0tiLzlGZ1M3KzRlYmpldmxOZGpKOWtic1VDOHI4YkkzbUNWZmF4amhN?= =?utf-8?B?WmFYUXZ1YmJ2bVl6SlBxb1ZnUmNnb1FtU3FrcE5XMDk2VTJqUHlOVG1pb2Nt?= =?utf-8?B?SVNXc3BxZytPZnYyQ3FySjJtWGVJWFN5OFFVQ25UdEpnK2cza0lmeCtYL2hs?= =?utf-8?B?ZEZJN2ROOWhPT0VBUlpodFB6YThJdHdGbHpoSUFLRmdxU1oxY3Jyb1QrMXVt?= =?utf-8?B?dURSQjRhUUc1ZU5mY2ZDcXpJUTZmaHYrQzBYQWszU0h6dlF1b0RFVTIweXR6?= =?utf-8?B?alhDQnFBUy9hbHowL2pQcnlJcXYxWFZWc1VpZlpUYTNlelFsOFF5c2pmaTg2?= =?utf-8?B?dmhZYUVhV1lVRUg1RXJIeUl6bzBaVFhyZUpxYVJxNTZ2aklQcDRsVTJ4VTVz?= =?utf-8?B?OG5CZFdkZFRhRlY4WjhnSjlPdjZkL1Q3YWI5TUdsU3hyaXVGeHhja01haE4r?= =?utf-8?B?OWpqUmhnaENWZjdBZzA1bzM5dnYwckxkV2RLWHhTaU00blJsYnVpc1phdkFs?= =?utf-8?B?S1hrcEFLRlhCNFV0WjBmams0MHAySEF3VDNNWnB5NnUyMC9HSmcrZGNESVU2?= =?utf-8?B?SXRDVUVyQXV4NVg4RHMxOEpveXM1MmlxK2lVQnRvMDlGWU4wUnZlQUV2RnB6?= =?utf-8?B?b2ZObFFSNVptMC9PUTA5WjlrbEtDZ3Ztb0lVd010aitEd3dlT0drOC9WcXgz?= =?utf-8?B?U1ZDQzBZUEJVMWJTS01wQWNNNkJXUysrREJFQVB4dmIzNXNnN2NROVB0V0Vo?= =?utf-8?Q?qaXBPaF/ouFUk=3D?= X-Forefront-Antispam-Report: CIP:69.169.224.2;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:b224-2.smtp-out.eu-central-1.amazonses.com;PTR:b224-2.smtp-out.eu-central-1.amazonses.com;CAT:NONE;SFS:(13230040)(704161411799003)(704162011799003)(48200799018)(61400799027)(9140799003)(32142699015)(376014)(10067099003)(5063699009)(56012099006)(4113699003)(5113699003)(22082099003)(4143699003)(16102099003)(18002099003)(55112099003)(13003099007);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: gp3ijvJQC79OiZmKDZsNEKp0ATcJjJLnjnEq+A4kqmffMizGq0VsKI980AnSZuSocrAEYaa1oEIsIV5eLyBndM0HwnA6eoBt+LYvrAtNNSN/zL8h9OEcxnBzydSCZNQ/5/mJubGQP6Fiv2YAe49hiCtGX+mt/PyTdhxZScAFEPPC0XLxf4t3YFFKpN+cOLzw96Yo0/887hUqLjcMWIPtl45uL1nCRlPlX6C8j67ROXkFTvSIeOkzc4XIVnWN8+cHQD9BXq1J/69D3Mo8TVV2y1laz1RsJIes484LW2iMwNjgAasaeOKb8fCRZrXdUJLjFab7cIJ2GJwf3i6CBBhH2TiaBZTvykJHrVTr8cSTMzBAsc+2xjZAXu2NSLYG/zjM2hN4hxQpmRyu+buDoUswBOO9o6EdfMHbaI0Uxn0TQKUbvHxQYuDH0ZpzYlnsFDMc X-ExternalRecipientOutboundConnectors: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-Auto-Response-Suppress: DR, OOF, AutoReply X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 09 Oct 2026 15:10:16.5488 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 81b223cf-b52a-4b27-f7c1-08df26176d18 X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-AuthSource: DB1PEPF000509EC.eurprd03.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: Internet X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI0PR08MB10655 > From: C=C3=A9dric Le Goater >=20 > The 3-bit MSI-X BIR fields permit values 0-7, but VFIOPCIDevice::bars[] > only contains BAR0-BAR5 (6 entries). An invalid BIR value of 6 or 7 > can cause an out-of-bounds array access (CWE-129) in vfio_msix_early_setu= p(). >=20 > Add range checks immediately after extracting the BIR values. >=20 > andrey.drobyshev: > This commit is cherry-picked as-is, with no modifications, from the > upstream commit 9daa7347ff25. >=20 > Reported-by: Feifan Qian > Fixes: 65501a745dba ("vfio: vfio-pci device assignment driver") > Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3878 > Reviewed-by: Alex Williamson > Link: https://lore.kernel.org/qemu-devel/20260706161334.2165482-1-clg@red= hat.com > Signed-off-by: C=C3=A9dric Le Goater Sashiko has reviewed this patch and found no issues. It looks great! --=20 Sashiko AI review =C2=B7 https://sashiko.vzint.dev/#/patchset/20261009-vfio= _v1-v1-0-2ae91d5b8048@virtuozzo.com?part=3D3