From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: <010701a15a2e1c34-68f5ce6c-a762-4881-bbca-106f72fb9016-000000@eu-central-1.amazonses.com> Received: from AM0PR83CU005.outbound.protection.outlook.com (mail-westeuropeazon11020098.outbound.protection.outlook.com [52.101.69.98]) by lore.virtuozzo.com (Postfix) with ESMTPS id C5D05802A5 for ; Tue, 20 Oct 2026 16:38:56 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=LKYlJljulnjQsCdvQiKqibanv6L69GPuQ/7MhbBEmOM0ytOLU4MD8Q/uqGIbaHdvPzJzD2CvhPnA6NLLowHOqbYLmMM602h5Zkhwn3oVp10uwLjuIL/PC4bVnorZFb7CFrkwehSmqhz2ZqOxcrSaWDmblvla6hjDCdAnwWl/+JLYYLqFKCrryvJaFv1gLtDfjU4EV4+wAxtTcAQmSvSfBKh4n8D1IPAGTyCkA/gsCrAgfgI1W63NhZhS8njKnUBbmclbE9QVZJQl4uIpa4Rok6CWP4mEItZuHG59QgnUeDjIWQmn/0PNYMhBUrX+65TBy4PJmpy+1/9goi1lAg+wvg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=fEh6ZKcJP/QxDojio06qXh4zfXrTG14DUSBjYXVadRo=; b=xDS/r7BXPu+qlUOARkbwggU8+TUd9Lr+ngBTDZiL4mFLOjKAIe9EXs4JduaFNvTFlrWSij2hBRDqbDiysRfihlX9wIHiKF/g+HL2El6GnXt5JsTYthabQNW6WglgSShsR1DELmw+X91d3qZjbguOdcWzA31jSW4vxs1+QIiaZ9Fopai6QJ5WKSd/HZJfglCUfcbw0S+hmB7yO9QhlVVIckl/JnsbdP833Fhht274oePfIly/th1A7U4W/bSjD0QDaNgu7Wr+5EY41ehwUdxplXJi96u3LjXj9+xZDWHZP1596WsRRfozq3VuBRm2ff9NVSjUDmxeINzdmAGt7qAU/g== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 69.169.224.2) smtp.rcpttodomain=virtuozzo.com smtp.mailfrom=eu-central-1.amazonses.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=sashiko.virtuozzo.com; dkim=pass (signature was verified) header.d=sashiko.virtuozzo.com; dkim=pass (signature was verified) header.d=amazonses.com; arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.onmicrosoft.com; s=selector2-virtuozzo-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=fEh6ZKcJP/QxDojio06qXh4zfXrTG14DUSBjYXVadRo=; b=RpzmkoYcM+1B056eriU7mbcMW3lJsys8zRChmxS5+Jk33CUvG/NhzJFZFaZg63b8Tn12j2ddNDJCpxwGpTbYcCd6Y/LWzCTQexyPhhTDwgTd0yatqnHgu1tIlDWpI8LrwojIFTfKd6nJMbL5A3IDn+D8xO8Rx5W+QjzvMicZDiI= Received: from DUZPR01CA0175.eurprd01.prod.exchangelabs.com (2603:10a6:10:4b3::19) by DB9PR08MB11894.eurprd08.prod.outlook.com (2603:10a6:10:609::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.15; Tue, 20 Oct 2026 16:38:55 +0000 Received: from MAD0EPF000008AB.eurprd04.prod.outlook.com (2603:10a6:10:4b3:cafe::a9) by DUZPR01CA0175.outlook.office365.com (2603:10a6:10:4b3::19) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.522.20 via Frontend Transport; Tue, 20 Oct 2026 16:38:54 +0000 Authentication-Results: mx.microsoft.com 1; spf=pass (sender IP is 69.169.224.2) smtp.mailfrom=eu-central-1.amazonses.com; dkim=pass (signature was verified) header.d=sashiko.virtuozzo.com;dkim=pass (signature was verified) header.d=amazonses.com;dmarc=pass action=none header.from=sashiko.virtuozzo.com; Received-SPF: Pass (protection.outlook.com: domain of eu-central-1.amazonses.com designates 69.169.224.2 as permitted sender) receiver=protection.outlook.com; client-ip=69.169.224.2; helo=b224-2.smtp-out.eu-central-1.amazonses.com; pr=C Received: from b224-2.smtp-out.eu-central-1.amazonses.com (69.169.224.2) by MAD0EPF000008AB.mail.protection.outlook.com (10.167.241.183) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.546.15 via Frontend Transport; Tue, 20 Oct 2026 16:38:54 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=23yjbh4k34hwzfubhuiim7m4inbd3ick; d=sashiko.virtuozzo.com; t=1792514333; h=Message-ID:From:Subject:To:In-Reply-To:References:Content-Type:Content-Transfer-Encoding:Date; bh=WnCdTpnVnegfJ3jbztTMJvRxBUlL+ID1vqU8rXwC+Kw=; b=bQSdqgjnxkA2kFONYoEASMCVhxIR2fT0oH00DmxPBPx3TpqrqhNx7Vp9gGdjoH/b dlYpoqt2rofjazYsVZBemLBlpVnpOPeNxUVDc9qypLqAr3aabAT8FXwomfy5AjrW2P4 85FfNnSKK3Gk3OH9A3ZVz+w0DGYCIuJTAsp6cDrDSYITfSvs04KgtsjKi9qIzay1yTW +qFMZbuDQXNIieexb/978o+Gapm4P+nJuAXBq99v0SxO7SYGOl9oHEqQQuuXpFZTGLX yM/YqOAOrMF6Hy04wprBMlD5s7ci9nBMu4upR/2oTeBtmyU+QmJgEhnbgR1oyo9BSR3 VXofXEGoPA== DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=qftdzk2dqsatjnlrq4r5brjbihpfcrsh; d=amazonses.com; t=1792514333; h=Message-ID:From:Subject:To:In-Reply-To:References:Content-Type:Content-Transfer-Encoding:Date:Feedback-ID; bh=WnCdTpnVnegfJ3jbztTMJvRxBUlL+ID1vqU8rXwC+Kw=; b=Kj5LDOJtrIdf8e8CdNTOVgCrd/8zS6oJdjpIVlJE7aTriuw8GsxRYkmGPVfvRTGz fvHL5EJpp2Auj8bWB+jQrgahox5QrgfZkjhT1OYHpQjC4O46COUYoN2t4ApzsW3pYh1 jIxz45K9LDfqP5nUTGl2kSnGJf6HDzAnGB3FdfI8= Message-ID: <010701a15a2e1c34-68f5ce6c-a762-4881-bbca-106f72fb9016-000000@eu-central-1.amazonses.com> From: no-reply@sashiko.virtuozzo.com Subject: Re: [PATCH QEMU HCI-8.1 v4 08/31] vfio/pci: Reject invalid MSI-X Table and PBA BIR values To: svt-core@virtuozzo.com, Andrey Drobyshev In-Reply-To: <20261020-vfio_v1-v4-8-83a5668230e5@virtuozzo.com> References: <20261020-vfio_v1-v4-0-83a5668230e5@virtuozzo.com> <20261020-vfio_v1-v4-8-83a5668230e5@virtuozzo.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Tue, 20 Oct 2026 16:38:53 +0000 Feedback-ID: ::1.eu-central-1.2wRQJBpg9g1fGRYexx3dUuYGS25Bux+2TEOx72/m6U4=:AmazonSES X-SES-Outgoing: 2026.10.20-69.169.224.2 X-EOPAttributedMessage: 0 X-EOPTenantAttributedMessage: 0bc7f26d-0264-416e-a6fc-8352af79c58f:0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: MAD0EPF000008AB:EE_|DB9PR08MB11894:EE_ MIME-Version: 1.0 X-MS-Office365-Filtering-Correlation-Id: 5099923e-11e0-4c4c-58e8-08df2ec8a141 X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr X-MS-Exchange-AtpMessageProperties: SA List-Id: svt-core@virtuozzo.com X-MS-Exchange-Transport-Rules-Loop: 1 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|32142699015|61400799027|48200799018|9140799003|376014|55112099003|5113699003|4113699003|18002099003|22082099003|10067099003|16102099003|13003099007|4143699003|261009223027099003|56012099006|5063699009; X-Microsoft-Antispam-Message-Info: 5xl8X/fTSPbR9Ybmavttb72SHm4JSOBSHEAPg/y8ojHIripPNORpjRP2SGN93g2tKKtE4vEStIbmFaDKLslpbRoa4XvD4/AR9DfJqCM+A7riK8m9zqyxp0iF4VbNzrgCBAbqD+UqXUexjLzaUmBaqJXB+S7fGJ9n53AXI9yFEQJ/DRe4zwWo2OnWdWK7HxqOIhAFVBMUGDrNGZEihY1fFo4bNGWxztuiAZdHA6ixYX+9RBogamZNUdfPYHUrGNiXHbMQ5hXRYtgscjCOQKeNJ06iXP8/IjruiZI1quqLdbmNwBdo++6FaESE52hCllRJGHB2smREf7GfpbN1lEtPyVXelTPCfKHfKK/ubsyob3sTwEYQsEtIpiNTZFwOgfUWve9qeqX/tO4aWhh4+RzLiiDRZcznWjNYpTeyXgN/vZrbyUe8LdmZwPUm3e9TeH6dLRyOwlBI9jOJv65KL03vDII8ClP0oLEMLVsev8Vx6HTaOQnbyVf9Y265s2RjFgQmK1lt4qjtfkFubpmSYxiXA/daZBzKiClvSbDPfwks/3TtmFdrnMbsvPGIajRzhO4Vn1VZIfTa0ZgDQP2rsoHHv5ewTn49iGmJipTQhFc3jr55FDzUOu4qSNa+sgp6U+xyI9ov0fjje/vOkblY1TuW1I0J5y3+pFr100WhY9/4ovhakr0K7WXXgOt5wqkMixlbaE6DB1OXNnc3GLhKaOVBeyIHOYs8Cw1wBS/h9T/i1XBaYAQlvKrq8XNe6TwhFBzEbBuOqUG7ItvERK/jcaJeypuFpf9wfBIakafmP6ytNrb8AX6qh8Bt6gAs5l0U2g2i64Z+sgpzUUOFmbrDgy0EwBCwWySIC9RoALeArdxmPZUUJlEF/U/3Iw/wxzcO9qnUlr6TU6/mAdNDyKyhzGmprB6YOV1DBGrEcrHSkKBdPlRKD9Mh33ml2C+AV1eIzOtZ X-Forefront-Antispam-Report: CIP:69.169.224.2;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:b224-2.smtp-out.eu-central-1.amazonses.com;PTR:b224-2.smtp-out.eu-central-1.amazonses.com;CAT:NONE;SFS:(13230040)(32142699015)(61400799027)(48200799018)(9140799003)(376014)(55112099003)(5113699003)(4113699003)(18002099003)(22082099003)(10067099003)(16102099003)(13003099007)(4143699003)(261009223027099003)(56012099006)(5063699009);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: 0a+kbjGMhqsXNGx1hcxK2XBzCUDhNfzE47GaDKeiVcHdNR/nRgPNDBfoYkdfzKHA49L/gZRvK6/AQOafg1KO9S2ROjzKICdYorp+0PS5ULYiw013ZahQBGLWW2e+YjmShdgd68W0ddauGhZbkqNMwX9dKkNrPfW+XwFEuzF6qGcAFbKn/sLE+KiLHWkAaop2z7NM9lxM3ZVZ9fLwO7OUrKy5MUCHAyHhCjEJvVCcEJhAWE3saLCbBcGy/QT8f4mNjGy6IwsIY/TDgndrV5ZmLf6kAHNt1wTDoRfGpcyw7NjMTUDowQxpvDVCCWypsFAWlbksxYoeQeeg8tVXPlOIZffs47P4oKR5nVA4MALrsT3yU1RTzZgcJT7dzXJm8XQHc9yaZ0cXpa4EHZLPSG5s5mzmZ1L5AvcyPWTy15WtR/rkjbdcUuMJs8clWXkJBP0F X-ExternalRecipientOutboundConnectors: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Oct 2026 16:38:54.2684 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 5099923e-11e0-4c4c-58e8-08df2ec8a141 X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-AuthSource: MAD0EPF000008AB.eurprd04.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: Internet X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB9PR08MB11894 > From: C=C3=A9dric Le Goater >=20 > The 3-bit MSI-X BIR fields permit values 0-7, but VFIOPCIDevice::bars[] > only contains BAR0-BAR5 (6 entries). An invalid BIR value of 6 or 7 > can cause an out-of-bounds array access (CWE-129) in vfio_msix_early_setu= p(). >=20 > Add range checks immediately after extracting the BIR values. >=20 > andrey.drobyshev: > This commit is cherry-picked as-is, with no modifications, from the > upstream commit 9daa7347ff25. >=20 > Reported-by: Feifan Qian > Fixes: 65501a745dba ("vfio: vfio-pci device assignment driver") > Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3878 > Reviewed-by: Alex Williamson > Link: https://lore.kernel.org/qemu-devel/20260706161334.2165482-1-clg@red= hat.com > Signed-off-by: C=C3=A9dric Le Goater Sashiko has reviewed this patch and found no issues. It looks great! --=20 Sashiko AI review =C2=B7 https://sashiko.vzint.dev/#/patchset/20261020-vfio= _v1-v4-0-83a5668230e5@virtuozzo.com?part=3D8