From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: <010701a135e3f47a-2da4299a-6f13-4448-9a0c-541bae584b90-000000@eu-central-1.amazonses.com> Received: from AS8PR04CU009.outbound.protection.outlook.com (mail-westeuropeazon11021137.outbound.protection.outlook.com [52.101.70.137]) by lore.virtuozzo.com (Postfix) with ESMTPS id 73B79802A5 for ; Tue, 13 Oct 2026 15:31:37 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=h8VSvj5SZkGZ5A/RKzK4XcjUUzuxoWQpfsgkNC6DfuXxYo2S7ISSM0NC38kJxOjvCQD58Bbu+g9L29aSoaKijC1lF2offEcNSL62tjv/xT6km/P0im9uAqnpf9t1bnvI/lTNHZ+8gCDL0WU9Y+SnvGAqQjH/BhTXCuN0dOySWZOQEZ0l/94SfCecjX0DJmhdm3fJB08sJNzTLdt0+pB/ICKpTRSgnTQ/+3juH3OvCADpFcpomJ2UTfpQtpAVC2kH+R+mEeoOHKA0TpqSIw+/IpKdqXI2WLjH50kfQcdtdzXkKyCRHcpT45YN1axeTFv9yYbMfoJgyyyY42IhbQ6wxQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=FhLHZ0O2K/unyM3a5OFVR5CGLpYTlyrgpp5wO6qFw3c=; b=RSBpV6SBOh4OeN/LYpATzH/B1lQZpebuZl4UIPqOJK2mt3iGdZUI6l7FJP9s+gjvGNoGWOY+jDQYLKK/PEgHGRS3mbh20eABgW282qHJ+//i3QeCRW3IKCYxfD83zOBoHCcxs2eAnySOeaz71KCh+/SvR/1UypUHJUpVMcrlkTRStCgIaC7DRGxOdu7QUi9IsMNHXwIr3ehr88E58mrVpYKhnIuOp3eZq0rjWIZfq/MdvW3/vqBO80lhYHGAAofW/Dr1/aRGMrraECTCXvz++mHQm1HoRQWDAxqmfrYmkb8IhpHNcBdRj1nd9+RPOSTUPqDx4NOedP95WC8rjQ8YMQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 69.169.224.6) smtp.rcpttodomain=virtuozzo.com smtp.mailfrom=eu-central-1.amazonses.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=sashiko.virtuozzo.com; dkim=pass (signature was verified) header.d=sashiko.virtuozzo.com; dkim=pass (signature was verified) header.d=amazonses.com; arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.onmicrosoft.com; s=selector2-virtuozzo-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=FhLHZ0O2K/unyM3a5OFVR5CGLpYTlyrgpp5wO6qFw3c=; b=B1/LmxjJEFSZ4FZQQ+kyq7Rgib+JLn3YePIt3MuBBtJXH5NItEFByZF/d/UifgZ2kcPKvinyQwjNmbXowH44IMzLIdfNfAfcDMoNr55k/ljd3RMbbBCXSQJ7ExQFLbrRudhlU7V7UDpXXtCaQbTrkhkOJ4mPA+hesqGDpRL5huE= Received: from AM9P193CA0030.EURP193.PROD.OUTLOOK.COM (2603:10a6:20b:21e::35) by AS8PR08MB8184.eurprd08.prod.outlook.com (2603:10a6:20b:561::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.522.12; Tue, 13 Oct 2026 15:31:34 +0000 Received: from AM1PEPF000C1ADA.eurprd02.prod.outlook.com (2603:10a6:20b:21e:cafe::44) by AM9P193CA0030.outlook.office365.com (2603:10a6:20b:21e::35) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.496.5 via Frontend Transport; Tue, 13 Oct 2026 15:31:34 +0000 Authentication-Results: mx.microsoft.com 1; spf=pass (sender IP is 69.169.224.6) smtp.mailfrom=eu-central-1.amazonses.com; dkim=pass (signature was verified) header.d=sashiko.virtuozzo.com;dkim=pass (signature was verified) header.d=amazonses.com;dmarc=pass action=none header.from=sashiko.virtuozzo.com; Received-SPF: Pass (protection.outlook.com: domain of eu-central-1.amazonses.com designates 69.169.224.6 as permitted sender) receiver=protection.outlook.com; client-ip=69.169.224.6; helo=b224-6.smtp-out.eu-central-1.amazonses.com; pr=C Received: from b224-6.smtp-out.eu-central-1.amazonses.com (69.169.224.6) by AM1PEPF000C1ADA.mail.protection.outlook.com (10.167.242.105) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.522.6 via Frontend Transport; Tue, 13 Oct 2026 15:31:34 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=23yjbh4k34hwzfubhuiim7m4inbd3ick; d=sashiko.virtuozzo.com; t=1791905494; h=Message-ID:From:Subject:To:Cc:In-Reply-To:References:Content-Type:Content-Transfer-Encoding:Date; bh=9pve4N0D+JSUogEqDzqFyVjkO9/DPxNTCJGYDshZ3ms=; b=fuuj8nMdxaAvyYjZyaRENKTXukHEKF6ucp5w5pKL8fDaBt1vrC81mtkT7UK8xVJk QgrACYkQytf+uTGLY6ZBhviedjrtvCBd8orDQgL7nMW2Madkug4dGqz255Tj3Pw0c3Q ynXYEJZlPG1OfVNPnsnVmcOybWxF9d9QjLQj4w84C8EDfzgJo0cx7urN+nBsJDJj1M1 stOkHc/84U35enjfYzZApzQZngwFKC0D3UhgcZ0Ad3G6cDGMIfLx/1g3wyCZ9J/Ygdn FVorWIJCChy06LVSHxVd/Lr74ZgG+stRmUQ6rGRx7eF/FYNrWhnK9b5UrFZlsh0VeJ4 J7QcQNkk4Q== DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=qftdzk2dqsatjnlrq4r5brjbihpfcrsh; d=amazonses.com; t=1791905494; h=Message-ID:From:Subject:To:Cc:In-Reply-To:References:Content-Type:Content-Transfer-Encoding:Date:Feedback-ID; bh=9pve4N0D+JSUogEqDzqFyVjkO9/DPxNTCJGYDshZ3ms=; b=VrvRrCRY8PC/3d+Jq+9hyXQ4ZLhWlJTRGfqKyBO3L1Ul/CHUUJJ7kGc/SRSzh6Wm RO7FJDvjo72T0mgN66I9XGO/4E84VKbHUiRgHV+XFN2IakwMQ1/5bqyUVDqxNdQkMzR O2Lerd19f4FmBmzuSin533InEyOx1lshVCChilfc= Message-ID: <010701a135e3f47a-2da4299a-6f13-4448-9a0c-541bae584b90-000000@eu-central-1.amazonses.com> From: no-reply@sashiko.virtuozzo.com Subject: Re: [PATCH QEMU HCI-8.1 v2 03/24] vfio/pci: Reject invalid MSI-X Table and PBA BIR values To: Andrey Drobyshev , svt-core@virtuozzo.com Cc: andrey.drobyshev@virtuozzo.com In-Reply-To: <20261013-vfio_v1-v2-3-433455c0a294@virtuozzo.com> References: <20261013-vfio_v1-v2-0-433455c0a294@virtuozzo.com> <20261013-vfio_v1-v2-3-433455c0a294@virtuozzo.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Tue, 13 Oct 2026 15:31:34 +0000 Feedback-ID: ::1.eu-central-1.2wRQJBpg9g1fGRYexx3dUuYGS25Bux+2TEOx72/m6U4=:AmazonSES X-SES-Outgoing: 2026.10.13-69.169.224.6 X-EOPAttributedMessage: 0 X-EOPTenantAttributedMessage: 0bc7f26d-0264-416e-a6fc-8352af79c58f:0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AM1PEPF000C1ADA:EE_|AS8PR08MB8184:EE_ MIME-Version: 1.0 X-MS-Office365-Filtering-Correlation-Id: 715ad161-9340-4eb8-d400-08df293f1088 X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr X-MS-Exchange-AtpMessageProperties: SA List-Id: svt-core@virtuozzo.com X-MS-Exchange-Transport-Rules-Loop: 1 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|9140799003|32142699015|376014|61400799027|48200799018|4113699003|5113699003|13003099007|55112099003|22082099003|10067099003|16102099003|18002099003|261009223027099003|4143699003|56012099006|5063699009; X-Microsoft-Antispam-Message-Info: +fAiOh+xW8UbFhhx7OAPifcSVeLRX98YRKOxncFxRgIIDnWW/RIaXPjw+AhKDDvSisONcUfbxZC5vLr0c4VWvZBWPCoQTnspuOY2ytqrDjbzypXN0hdNzaVYOCBok94x4i/gSfb8Lgbh0aMoNCEUq4wFR0uplsvUJxWAl350elXYa8f9RY3WG+woNJ+APW3kPX4Iud0EcBArbpGateL2+lRnEr9TlNf1teiqLqjnaC8ou4SLeN/wQloYCE0KdVVUowdyfw2th5aMuGzFBxKpvi5eac9gsBYLMOYsCaPjuCaRyYj/3ydgQEyfrh4/rN00n/dwpyjEbsrzDRpJbkScsFS6+QFCYwEDaAzrzqjtgtd1NhzmNEP21Pq1o+r0eH7fv+CuCK/geQLC+KOqDwEJKXczERLo3Q6+5CVO7UN/INEA5N1oDWGGxNQd+ocdCAVsEgRks9U+No4jtyBbZ5juhgPHEMsqDdVNZoldy5wcz0Lift8cRTwNdGNbdLmATPKUOI0OpK2BXsp3d6QkfDUs9VXvTRoCWTSXAzz+xKebqegjDLZ9swaUDWchlsP43M+JN05pMg09tW/l/NXYZceakCwGQlxUP+dEdrCglKQgyJ2tskAHZWAdSmbB3V4uMVBIdjqjFEwwIVYuN387MqhLthBFX/3bO6pR40xNfEWjX/x8Ec+lPE+hbXa3u/5ZXsoA66W8asyq28GHoSd2ihezGg9gYRnPa0xALWt+qocbh9BgY23JzpvS3Z8D6XiNTHkRv19u6/Dj91AwO67SHqpYawj3Bc2/ht7lsCnPZDGE1dVNlFMqVhCCcDGqFgWuq4tqCmvpSpOFFp2dmiGj3PBI8ZVhEkIurdARusYzgbgRjdQ= X-Forefront-Antispam-Report: CIP:69.169.224.6;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:b224-6.smtp-out.eu-central-1.amazonses.com;PTR:b224-6.smtp-out.eu-central-1.amazonses.com;CAT:NONE;SFS:(13230040)(9140799003)(32142699015)(376014)(61400799027)(48200799018)(4113699003)(5113699003)(13003099007)(55112099003)(22082099003)(10067099003)(16102099003)(18002099003)(261009223027099003)(4143699003)(56012099006)(5063699009);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: 6+GZaK+0bT6lyUrMlI3UtkOtc02aYTN4lrk9MnCvPGYR9GbSbiQg6ImMae6ky9iD4ZlwuWElaxVUX8ukif2Un3O0jhidmUr+UBsc4zMe5FHyxtkhIcQ5VdIy2miWOfC/eSGVjNVEB27adB3oRiRsUriGO4YVhayXscsupEjp7iuUMS5ce/+wY4T2h4fEOuggTAt8iWKg/+dcDK3bVYg/V0nq717ZU88h4eWkMxi9BImAxKdSVvZrqODYM1bOY0w67jhXjhTxDE/1znrP1X6Ptz1g6BHvw2gQtCYP39opTsNa/qwwBcFAUjvJVa+OHAMEelPnQ5mhz3mGWeQtp5ZeiqlFhi/9OU9Zh3q5Q/xCHRNGPrMHiCX8XK+pNTawHPMZKfySYMQl+Up1QL984dtZBlz3OybOLE0YSCikOwBTsWcNhXRAv3L/NWeBumVJhWjq X-ExternalRecipientOutboundConnectors: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 Oct 2026 15:31:34.6307 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 715ad161-9340-4eb8-d400-08df293f1088 X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-AuthSource: AM1PEPF000C1ADA.eurprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: Internet X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8PR08MB8184 > From: C=C3=A9dric Le Goater >=20 > The 3-bit MSI-X BIR fields permit values 0-7, but VFIOPCIDevice::bars[] > only contains BAR0-BAR5 (6 entries). An invalid BIR value of 6 or 7 > can cause an out-of-bounds array access (CWE-129) in vfio_msix_early_setu= p(). >=20 > Add range checks immediately after extracting the BIR values. >=20 > andrey.drobyshev: > This commit is cherry-picked as-is, with no modifications, from the > upstream commit 9daa7347ff25. >=20 > Reported-by: Feifan Qian > Fixes: 65501a745dba ("vfio: vfio-pci device assignment driver") > Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3878 > Reviewed-by: Alex Williamson > Link: https://lore.kernel.org/qemu-devel/20260706161334.2165482-1-clg@red= hat.com > Signed-off-by: C=C3=A9dric Le Goater Sashiko has reviewed this patch and found no issues. It looks great! --=20 Sashiko AI review =C2=B7 https://sashiko.vzint.dev/#/patchset/20261013-vfio= _v1-v2-0-433455c0a294@virtuozzo.com?part=3D3