From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: <010701a169b81bae-f9e34e72-b026-4bf4-9137-9c92a9ae9f67-000000@eu-central-1.amazonses.com> Received: from AM0PR83CU005.outbound.protection.outlook.com (mail-westeuropeazon11020096.outbound.protection.outlook.com [52.101.69.96]) by lore.virtuozzo.com (Postfix) with ESMTPS id A59008045D for ; Fri, 23 Oct 2026 17:04:00 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=anE45nrm48m+K4jiViZ43Mz4tdgX6wH1WYNr6wQp55SLKnQNQqCNrid38S4iXFGl0NW2R4JzrpB1l1Ve0J5Ml48GlKS1W8OOqGERNZPvAwg+QN4KDNNc2wS+0vy1FztGH7S9j0MVvmezPNOmy+yC9FXNrzZF3FdQTkWYQ43GN5YFVvmlicW4/TIA8mNerkh84KrNiiMTCzoKkm98lKjhmpGma2tNuQxftTeMzeFMwjPQCTaEThzZroBB0NaG2oI0rjB51UFtPkLzRKn5By0kOHMjyqgewbXfyV9UTMVisZUM6IiG1SeBa5v0zMPFOgG+U6yIQ+CUJwb2ADmOI3o4yw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=V3S5J++jABl38jEN93qI58eH0ICyc0u/g6bL2ELQeDg=; b=r/G2VyXmVjCx+DPDvKZOBOvF5GLdIbVpC9d9yFoHrOIhXTkNVEz3Dku9KlrtWVWGDLUDv+xlXED46QMFosPc4pfQ/p3GbRgVLWsY+R7gWRNbDgJxWwjeQOS7zSSb6yF1cOX0LD5mixxhEeWc4kfPbHSuFeomSnpPlk8JBjM8oPUpl3SX2MKUZyKGQuCmF11YfNAHp1iTSe6Fac1/9k/JgyZUtFTSMSsXvFdE6DLuhN5H6sX/95wwdN4RdWfBAEkHJBzSfmWzw4unh+KZXVWpv5CgRAQ1h7Wxhgb3xkNjt+BOe6HUFQ9Gw1ylS6zzSrlQ/h8MhtOVOM4cIfhzsWzzWA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 69.169.224.2) smtp.rcpttodomain=virtuozzo.com smtp.mailfrom=eu-central-1.amazonses.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=sashiko.virtuozzo.com; dkim=pass (signature was verified) header.d=sashiko.virtuozzo.com; dkim=pass (signature was verified) header.d=amazonses.com; arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.onmicrosoft.com; s=selector2-virtuozzo-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=V3S5J++jABl38jEN93qI58eH0ICyc0u/g6bL2ELQeDg=; b=ZmYtoEZVPwP2rK+qEzLpfaI6+3veEI5E4rhW9dQVlSl6hEFcA8iQNhM0SXGGLvoOTIT5nJ6a7vCm9goAtbSVu0D0QRUXDcynuE/SHgSzoZVN6S24tslGauj9v1ZgM139u9/otBjYCqgATAuDsGekGexkA/To7t1qRV1NwxE8opM= Received: from VIUP296CA0009.AUTP296.PROD.OUTLOOK.COM (2603:10a6:800:34f::16) by BR2PR08MB283693.eurprd08.prod.outlook.com (2603:10a6:2c8:6::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.19; Fri, 23 Oct 2026 17:03:56 +0000 Received: from MI3PEPF00008482.eurprd02.prod.outlook.com (2603:10a6:800:34f:cafe::25) by VIUP296CA0009.outlook.office365.com (2603:10a6:800:34f::16) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.546.19 via Frontend Transport; Fri, 23 Oct 2026 17:03:56 +0000 Authentication-Results: mx.microsoft.com 1; spf=pass (sender IP is 69.169.224.2) smtp.mailfrom=eu-central-1.amazonses.com; dkim=pass (signature was verified) header.d=sashiko.virtuozzo.com;dkim=pass (signature was verified) header.d=amazonses.com;dmarc=pass action=none header.from=sashiko.virtuozzo.com; Received-SPF: Pass (protection.outlook.com: domain of eu-central-1.amazonses.com designates 69.169.224.2 as permitted sender) receiver=protection.outlook.com; client-ip=69.169.224.2; helo=b224-2.smtp-out.eu-central-1.amazonses.com; pr=C Received: from b224-2.smtp-out.eu-central-1.amazonses.com (69.169.224.2) by MI3PEPF00008482.mail.protection.outlook.com (10.167.240.169) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.546.15 via Frontend Transport; Fri, 23 Oct 2026 17:03:56 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=23yjbh4k34hwzfubhuiim7m4inbd3ick; d=sashiko.virtuozzo.com; t=1792775035; h=Message-ID:From:Subject:To:In-Reply-To:References:Content-Type:Content-Transfer-Encoding:Date; bh=7dbqTYxEepbq2BKIY4tVIgavZdpxhfFnGyV9MkZwMQU=; b=yTb8Y4D3ORt6DxPNdAASQE8ZLaKDqgPdZeN/js/r6cEilL3vyWor+IYJ2VOCky/F 5KpznXBtND3je+uWRc/Ko70jyhFhDyTUVEYcK4tApWg/Y++hXcfE+4RVlMHcm9MT28v 5Agwn8ZL2Ko2zZibubyxYX8fEp1icRvT2O78H8a2cTCkCoBrkhukvFYTChWUQtq7K5m qS1qLLiNUuQyV1DcgNLSvhXUmxMK1jw3nN24uW9hd1CjuqQhN7WxH3Vop+S1O0Oc5El zJjOzvD+eKTDeUaB2q7k7crTmXPpXhuBRl3vcWob+1Hw2xm7lPyz8hVCGMIiTdwVSWC MDI9WK/6zQ== DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=qftdzk2dqsatjnlrq4r5brjbihpfcrsh; d=amazonses.com; t=1792775035; h=Message-ID:From:Subject:To:In-Reply-To:References:Content-Type:Content-Transfer-Encoding:Date:Feedback-ID; bh=7dbqTYxEepbq2BKIY4tVIgavZdpxhfFnGyV9MkZwMQU=; b=j6gq9DxwtoQZPUgp6ylaHVOMF6TotC+mw62qWXx2wdV9OaUzS2s7zNaA/oO5A5Ez AFqVw1jHZPmI5LgLiZmOOCcGgQN25GUgJt+8WdDtytkpuzP7nbD35vuoYdgWPEY6RZB ivoijCLGJ31HEfaaPl/wL8/F2zzgQc3yFEYPDDr8= Message-ID: <010701a169b81bae-f9e34e72-b026-4bf4-9137-9c92a9ae9f67-000000@eu-central-1.amazonses.com> From: no-reply@sashiko.virtuozzo.com Subject: Re: [PATCH QEMU HCI-8.1 v5 10/36] vfio/pci: Reject invalid MSI-X Table and PBA BIR values To: svt-core@virtuozzo.com, Andrey Drobyshev In-Reply-To: <20261023-vfio_v1-v5-10-ba0bf3c6d122@virtuozzo.com> References: <20261023-vfio_v1-v5-0-ba0bf3c6d122@virtuozzo.com> <20261023-vfio_v1-v5-10-ba0bf3c6d122@virtuozzo.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Fri, 23 Oct 2026 17:03:55 +0000 Feedback-ID: ::1.eu-central-1.2wRQJBpg9g1fGRYexx3dUuYGS25Bux+2TEOx72/m6U4=:AmazonSES X-SES-Outgoing: 2026.10.23-69.169.224.2 X-EOPAttributedMessage: 0 X-EOPTenantAttributedMessage: 0bc7f26d-0264-416e-a6fc-8352af79c58f:0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: MI3PEPF00008482:EE_|BR2PR08MB283693:EE_ MIME-Version: 1.0 X-MS-Office365-Filtering-Correlation-Id: 9d6a4f3e-bfac-4067-72fc-08df31279fb9 X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr X-MS-Exchange-AtpMessageProperties: SA List-Id: svt-core@virtuozzo.com X-MS-Exchange-Transport-Rules-Loop: 1 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|61400799027|32142699015|376014|48200799018|9140799003|55112099003|4113699003|5113699003|10067099003|16102099003|22082099003|18002099003|56012099006|5063699009|4143699003|261022105027099003|261009223027099003|261021121427099003; X-Microsoft-Antispam-Message-Info: ulVb8vwISMlPdc7eJwHMlrZLWm09IWbsHT8Nm/jkeWVH1EvB50FGBjqLPG5188FS02k4v++i1qxWiLtPJVZ1eya4svWPjaZEgNmy+vz12kJYhyhS5YNy2RLIq6rEHLAxu5UQWA2okGLZ0V1F8+p3UTtrAfCIFoQjb75y7tKzOuNTMbyFclBEfjj8Dqvjpkqfp6RZX1rBl4sO8h/aCdxZ9ss/b2+FNYlr6LbIqQzq7ZRwwJPeyl4HjcKem1wQB4i7p7J5igZ5d+5GHTC44XG7w48qlwL8IvKsDg523Gi7VhIoHoAoADtgvCRxgfaXXns90Z1IaQPYUoix/1yDDJ9acU0F2/kUARcgiGrEoB8Ku+YkiCEMzXDRQ21w9hFroHyhKiZwum9NdnparJgTemM4ESdT3Py1KXKXI5Cxpdch6fOEd95Xo7XtRNVaGWXnPqkeHT8Zy83JG37b+0cMkvIPB0CWfFG+WwnfHnkF92q/OLzTu/IBLJ8le+MIwl7O8qQYBJSHHwZTZ+UyS42w9LrM4qY8x6InK5nMsM3EmFYvpSxbO3DqHAvkq7XAlJLmqA6EwAASxe13wQdb/0eYvNXWVZe0R7pQVitr/qux2PztfEU6hXKQEV+cVZn5wS3L8aPN8fX2AuS78DyRADSwrsMIQv4MF7fXGFIEh3CmqUEoDJCB8edviZhMM1uVIS7FmE3Pa3SPhIEj5c3OwObByrvpPmEiPOqU9rZq8pW2VusytNcuZ4E56J1n1PWPmAocM2uFoLeiPdh2nBdnP2n1jg03gNVmzlYaTh1z61xnFsk4xQt45Xse5p1cIfD4ZiXSW8SKW63f1KTYJ5+/QrQUO4Ln7wFXU98C6KcLAIh5ADgdQ0/S2igTCgtMCsd+4mvIwCopTWM/wZukwXYKOxoMyarjP3lgC2RZD6yAuBDJ4WSqb4xThGLPC2nwHrGyJRtzHVQJ X-Forefront-Antispam-Report: CIP:69.169.224.2;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:b224-2.smtp-out.eu-central-1.amazonses.com;PTR:b224-2.smtp-out.eu-central-1.amazonses.com;CAT:NONE;SFS:(13230040)(61400799027)(32142699015)(376014)(48200799018)(9140799003)(55112099003)(4113699003)(5113699003)(10067099003)(16102099003)(22082099003)(18002099003)(56012099006)(5063699009)(4143699003)(261022105027099003)(261009223027099003)(261021121427099003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: BWpNxM7gOrP4VHy7pfLuuvHe6YvpVR+SRclwFC98zDVHoiEo4lTL70qs49w93JkCmHxkY7/tCpUAjjghgyoCtEPeitykRF/QCyJEtdcoYLvkDGFQ/Qi57siS/lLW1Q2jFkYSt9hQ33p/my/rvyUEE/VpKr9fFU1U5DIFHeDwPJL+8murx3HDGY/Z68b5BAiopM5AYSPA8wJe0v8ThqYXyv+8naHR3pMQfSyi0VHv41PAJM5Qk9EhQkDIcJh8TRMUtcHTQhDsj/ayWgWpVuR3pz4KfvHSE68muf3h5XUQsQaxb+i896oB/JvWQsSR/tSqrI+zmmeDEWmzaDIQlaV1LByU2NKV9aPsgkvA65uMIAjMR134O8XkwrNBKthfjXVngAaHmDCeXmReaf62LET4CZqc7An+pj/Dydy+ZifBShfVKuRdG2ts9R3Y6zbeQM7g X-ExternalRecipientOutboundConnectors: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 23 Oct 2026 17:03:56.2443 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 9d6a4f3e-bfac-4067-72fc-08df31279fb9 X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-AuthSource: MI3PEPF00008482.eurprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: Internet X-MS-Exchange-Transport-CrossTenantHeadersStamped: BR2PR08MB283693 > From: C=C3=A9dric Le Goater >=20 > The 3-bit MSI-X BIR fields permit values 0-7, but VFIOPCIDevice::bars[] > only contains BAR0-BAR5 (6 entries). An invalid BIR value of 6 or 7 > can cause an out-of-bounds array access (CWE-129) in vfio_msix_early_setu= p(). >=20 > Add range checks immediately after extracting the BIR values. >=20 > andrey.drobyshev: > This commit is cherry-picked as-is, with no modifications, from the > upstream commit 9daa7347ff25. >=20 > Reported-by: Feifan Qian > Fixes: 65501a745dba ("vfio: vfio-pci device assignment driver") > Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3878 > Reviewed-by: Alex Williamson > Link: https://lore.kernel.org/qemu-devel/20260706161334.2165482-1-clg@red= hat.com > Signed-off-by: C=C3=A9dric Le Goater Sashiko has reviewed this patch and found no issues. It looks great! --=20 Sashiko AI review =C2=B7 https://sashiko.vzint.dev/#/patchset/20261023-vfio= _v1-v5-0-ba0bf3c6d122@virtuozzo.com?part=3D10