From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from AM0PR02CU008.outbound.protection.outlook.com (mail-westeuropeazon11023116.outbound.protection.outlook.com [52.101.72.116]) by lore.virtuozzo.com (Postfix) with ESMTPS id 7B05D802A5 for ; Fri, 16 Oct 2026 15:30:32 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=vxt7SJyT9dZ6FC3AskL7Yr5OnbwDD+LwGRPsVTrPjMmQIQCmN0t86ZoK1D0E7bAQ19zUMPWUL4cPBsQDJhHdoxLlyr0VnqtSKUWMGdDje3XUERm9wy7zhi6hsVyYEk4rdJzzZXtqJ7uBntZHfhD+J5UcPODcjfjpzr2v9hznsWBx3LdbtQHgaC0PpWc31UtNle4fC/7hHk2T3CerJKFZnS6oo9NGT39LITZ2up5N1UISvodfbPK4qKfB08OyjP4o8Bdf+92W2CQe2MoIZgr/jCDZawDLXrECGVADB88I5nfkatXirjVuE6onr58rQ3sE0Rc5cjwF2k/PrbYDRIPPFw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=JB9YPr6MXEfGwOmCD8Z6tj37GzZpmrWBV3o3VoABT2c=; b=MFWcmM0BJeL8B3cs1tuXEF+a5we4GMudlqdqf0qdqqR86m83wsEfH36bmKJ2Z8f3mJiRUHeJi/Iv5kWprVDB6cH3dDYwvCWev7DBiSLPcgluJNRcbhyKLRNs0uLPjQFT2g2KvjKaEjmaho1H+7y9/03P1w1vN7rqrOYNIsVAeCFgrcejD/EsfxjuRZUg6DEbuQrD9WCAuzGQNkbwyrlKRZ0D4MYIIQDus874+56N8xRg47l99VWG70+XxjZSgaMd4Gnq5CaijwrSbEYNFZdqIA3RYTeB0/GvubOfP6UbYEadnOw2qGciuZl2XCuQjQIAr8k9nvPH551EB69qx5dkQA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 69.169.224.5) smtp.rcpttodomain=virtuozzo.com smtp.mailfrom=eu-central-1.amazonses.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=sashiko.virtuozzo.com; dkim=pass (signature was verified) header.d=sashiko.virtuozzo.com; dkim=pass (signature was verified) header.d=amazonses.com; arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.onmicrosoft.com; s=selector2-virtuozzo-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=JB9YPr6MXEfGwOmCD8Z6tj37GzZpmrWBV3o3VoABT2c=; b=I2A2dObikgmqUYYf4exZIe9+aGYCzIAd+ujk1qPMM28JmC6bfEyIFAnsAqvaCNd6yzET69hvHH1hH+PpSeQoYQzTaHOLn67+Vso3qsSpKSi0PuPORYBR7nQYMlSK0qewsU5bVyWzu0VgMEloMumXCLZ3DWuyp2t1mezRKxSF21o= Received: from DU7PR01CA0028.eurprd01.prod.exchangelabs.com (2603:10a6:10:50e::13) by DB9PR08MB8203.eurprd08.prod.outlook.com (2603:10a6:10:39e::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.11; Fri, 16 Oct 2026 15:30:28 +0000 Received: from MA3PEPF00000408.eurprd04.prod.outlook.com (2603:10a6:10:50e:cafe::60) by DU7PR01CA0028.outlook.office365.com (2603:10a6:10:50e::13) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.472.23 via Frontend Transport; Fri, 16 Oct 2026 15:30:28 +0000 Authentication-Results: mx.microsoft.com 1; spf=pass (sender IP is 69.169.224.5) smtp.mailfrom=eu-central-1.amazonses.com; dkim=pass (signature was verified) header.d=sashiko.virtuozzo.com;dkim=pass (signature was verified) header.d=amazonses.com;dmarc=pass action=none header.from=sashiko.virtuozzo.com; Received-SPF: Pass (protection.outlook.com: domain of eu-central-1.amazonses.com designates 69.169.224.5 as permitted sender) receiver=protection.outlook.com; client-ip=69.169.224.5; helo=b224-5.smtp-out.eu-central-1.amazonses.com; pr=C Received: from b224-5.smtp-out.eu-central-1.amazonses.com (69.169.224.5) by MA3PEPF00000408.mail.protection.outlook.com (10.167.241.153) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.522.6 via Frontend Transport; Fri, 16 Oct 2026 15:30:27 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=23yjbh4k34hwzfubhuiim7m4inbd3ick; d=sashiko.virtuozzo.com; t=1792164627; h=Message-ID:From:Subject:To:Cc:In-Reply-To:References:Content-Type:Content-Transfer-Encoding:Date; bh=yNKX01mtPapb1lSvzzCSBVRotefL5Iwor/39EsCoHZI=; b=t3qI1NahuIq1m3ZDH96N0XCcbxtSqOFh7CY+WkyyUNafbWAm+N+hbO2BSa3DNott gQGiNgB7MW/Gp9xEc4pbfsVPSJTcF4Vcx8idOX8iUh0yl/N06jXmzpoL2UFOvSiYxv1 /nwQGqMvyQS4oiJmslZN5E+JY4K+iQN3zuiaZRaCxUEj/rsuFZ+zWJTf6aS1SHm/zNq AvftVbT+Nryhw7vZOjnpVFDCUoxE6LFirvw3+NCUHnbyYOm4N20t3MJjgm7m86X5CbL nvFsbU34GKjEqxWRLExBEADAnW/6Z9egk47EaU6qsjm6FQjWKLYFd37gUCR6ZaSsgPS wneqih9c/g== DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=qftdzk2dqsatjnlrq4r5brjbihpfcrsh; d=amazonses.com; t=1792164627; h=Message-ID:From:Subject:To:Cc:In-Reply-To:References:Content-Type:Content-Transfer-Encoding:Date:Feedback-ID; bh=yNKX01mtPapb1lSvzzCSBVRotefL5Iwor/39EsCoHZI=; b=NC/kJMiAfYyp+ytM7jUHo1grlNBczpCwd0F4pqAIGmApwsJFvehEe1pq4J9rt4yQ X0OTOIQV662eWxZN1L49N4Onv8KgdHJ1Rtf/QL4RDYjGxhF0YbApfYkHuazoWhnxmu3 1ld0jhOJXDdv0m3zZfONAIWMkb/9d0Rmy4pXVv00= Message-ID: <010701a145560343-42d342c5-b366-4c7e-b969-0738d5bbb8be-000000@eu-central-1.amazonses.com> From: no-reply@sashiko.virtuozzo.com Subject: Re: [PATCH QEMU HCI-8.1 v3 06/28] vfio/pci: Reject invalid MSI-X Table and PBA BIR values To: Andrey Drobyshev , svt-core@virtuozzo.com Cc: andrey.drobyshev@virtuozzo.com In-Reply-To: <20261016-vfio_v1-v3-6-47487cb5a8e5@virtuozzo.com> References: <20261016-vfio_v1-v3-0-47487cb5a8e5@virtuozzo.com> <20261016-vfio_v1-v3-6-47487cb5a8e5@virtuozzo.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Fri, 16 Oct 2026 15:30:27 +0000 Feedback-ID: ::1.eu-central-1.2wRQJBpg9g1fGRYexx3dUuYGS25Bux+2TEOx72/m6U4=:AmazonSES X-SES-Outgoing: 2026.10.16-69.169.224.5 X-EOPAttributedMessage: 0 X-EOPTenantAttributedMessage: 0bc7f26d-0264-416e-a6fc-8352af79c58f:0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: MA3PEPF00000408:EE_|DB9PR08MB8203:EE_ MIME-Version: 1.0 X-MS-Office365-Filtering-Correlation-Id: 6ef70baa-7e22-458e-c9f4-08df2b9a67fb X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr X-MS-Exchange-AtpMessageProperties: SA List-Id: svt-core@virtuozzo.com X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|61400799027|48200799018|32142699015|9140799003|55112099003|4113699003|5113699003|10067099003|22082099003|16102099003|18002099003|13003099007|261009223027099003|4143699003|56012099006|5063699009; X-Microsoft-Antispam-Message-Info: ie2N92vLg20q6RanOV3ATghXDv9V+ri5CWHiSBmXDRDxFylNTgAKPk71G1iOv/ofrWBnJjOSvsgCbUr2N7ppGoaIg0XEuqEK9iDMAILDH8DzvMl/W8+XAV9r2BhplU9BpmpZwtRr6HY42ljPtTudRNoiyLBKpgPV83ejkHx+Sve4+vwCfZ6uVIhr7JHjb5i4eoPOERG7Gq6OaqOatUiQsKZbqD/O6K8sswt22zz8K0AWBTwMXGqjQRkl5PNyKQemIixLZD1M4it67dHKkwcIG26OcGaUjgjlMooRLqsQ2n/c6mer8A+INMcc95FK+N/N5Ou/F3i5ccj9BMXDUwK3sXdYqg77l6huKUrv3oL3m6HmO54jlw1QdZ2k3GIQoDeT+WOZJCD9MKRXH9US8Uy35KlVrzun+1EVX5mdER7kvsLjIT49XH1S9kiPuwaAEQ4I5Bla7vUr67W5iobczKOZQwyVA6NaJAaW/piTgSX7LlAOev/tIP6e8798zWv9uFuUVYmTP9ey28VbIGUzySMB2m2LhhA/uu0qY3Y3555PVb1awpAwxXJHfv4tYcv2iFNujWOx3HlOUT9HEBu6MYE/ECu0MkznOzk9rjsnBr0MHTA9gDCPr9F1j8lfRoln1TL06/5MQjPuuSeci22Pjg0z93FYAbOyugO/WslCuZ6F7QdojW3QR9k/qGQkw0Gak1O9KcP+rrAPElXHGJL/JgiQlUXDF/lHfEUVF3RKnNIywsivQLmra0OuPjCUUg+aHsajjmn5Nq+Ng9My1LnpDXf51EXIwgslLeMp35CEGt0A+510Cxz6yoGdxG3g56aiBz/4J635aEB7jF/nXq70sH3H/hoDZj9/vbfzt95P1GWv3ujzHv7q6LoLemkJlPFgX1A/u/ibt51b5CC9sSoEa05B6/lvKZ+ma4730EYq9RSEIgSHeCKkLcSWGYsoRpSy8+02 X-Forefront-Antispam-Report: CIP:69.169.224.5;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:b224-5.smtp-out.eu-central-1.amazonses.com;PTR:b224-5.smtp-out.eu-central-1.amazonses.com;CAT:NONE;SFS:(13230040)(376014)(61400799027)(48200799018)(32142699015)(9140799003)(55112099003)(4113699003)(5113699003)(10067099003)(22082099003)(16102099003)(18002099003)(13003099007)(261009223027099003)(4143699003)(56012099006)(5063699009);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: 5MMlfnkF1+IQrkkLw3iS4Gmmo7Cepjvwzj3wg+NVhm1qxA9/1Hlwp5UeoGMA49FKk2sNGTK1ChDp7t+D+94avnmGMHq8toVKK0j+r9zm/oB5FkG3btLYMtQU50TH1x2FqOZnXU4Z3l8kUPS4cPSmh0uuyyudRPtn9b9bsHijQBlpTrxCEqNFhIeo5r6PlGLDRmJYOfR1dAQobyrmkwd+xjvMxO987s2WHynTiIzLFPu4zjI8nh60Z1Jw22f2QJwYxWcZTu1QtoaxgTD1L7CV3NjQF+KTwjtS3/zctg7/ZE7BSebs6pkuY1yIhsZ/zaTFr+xXVpLv8diZqhpLkQscZXeve0wpWQ3Rp05uEa06jNonJMzxfeuWEyc+seROgwR3Y0Mnagem5aSkpKSMh2fodP+CvwQCOoAsw1/pNmPrZK3C7UZoVW6qPJcet5YDQX5A X-ExternalRecipientOutboundConnectors: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-Auto-Response-Suppress: DR, OOF, AutoReply X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 Oct 2026 15:30:27.8433 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 6ef70baa-7e22-458e-c9f4-08df2b9a67fb X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-AuthSource: MA3PEPF00000408.eurprd04.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: Internet X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB9PR08MB8203 > From: C=C3=A9dric Le Goater >=20 > The 3-bit MSI-X BIR fields permit values 0-7, but VFIOPCIDevice::bars[] > only contains BAR0-BAR5 (6 entries). An invalid BIR value of 6 or 7 > can cause an out-of-bounds array access (CWE-129) in vfio_msix_early_setu= p(). >=20 > Add range checks immediately after extracting the BIR values. >=20 > andrey.drobyshev: > This commit is cherry-picked as-is, with no modifications, from the > upstream commit 9daa7347ff25. >=20 > Reported-by: Feifan Qian > Fixes: 65501a745dba ("vfio: vfio-pci device assignment driver") > Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3878 > Reviewed-by: Alex Williamson > Link: https://lore.kernel.org/qemu-devel/20260706161334.2165482-1-clg@red= hat.com > Signed-off-by: C=C3=A9dric Le Goater Sashiko has reviewed this patch and found no issues. It looks great! --=20 Sashiko AI review =C2=B7 https://sashiko.vzint.dev/#/patchset/20261016-vfio= _v1-v3-0-47487cb5a8e5@virtuozzo.com?part=3D6