From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from AM0PR83CU005.outbound.protection.outlook.com (mail-westeuropeazon11020097.outbound.protection.outlook.com [52.101.69.97]) by lore.virtuozzo.com (Postfix) with ESMTPS id 267BC8017D for ; Fri, 30 Oct 2026 14:53:40 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=i0SUR7ZTodc4xS2zEg9SPpnKDWiiFYTC0O+dBOFZIJEmMj6DmWfrBB22Uw6zuQE13EXybPH5Kp7xkC0VGGldEPzoKOmTGU9dYe47Lt/9cK2S+fHFhIlkr0YRQPoUQIoJqi2BfeXG45KwXdUkjevoZxUIfIj24jSUg2rYFfNki24cISJ3fB+jYOzr07qJ9IRyDF7iXpVRFClTEpnpoabKYvEs9g1hDNUH+Ms6q2yXY1VvFHI4/dUkrhSi3B00mdt9xcUGBdrG4gH5ZRvC/xccfSeIlgg3nAXE9jctH7oBwp6NOBS9IKBB6pStq2MNVQAPEpCxYki3AM7OwR3laWuY1A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=06Z63j++x35JkTf+QiPOpdo/1tQDJd3Kxli+h9k3+pE=; b=teR+2nKqK7KQMqpEdLa4Yaop+41L3MstFYh72PJ+xzhzH0SM2Zud4caXyIEGeiR9YcphBRJ1+3CPMcpaS/x7RZlltb6rtkvcSFq0XxtpoV1Qt+UatXWizVZh9IOzwEHGnMT1Y1PblDbbfuY7i8OOG9H0zsBGneDGN8s0KQV9S5cMVDO+z8OZR8Nym8XOlLDULZa88amIgvHCeQSumMyhLzVLQQiHA/D05wskjcllGjQfHcG7o0jY7dKg3WX4MDx7YgjdmtcsPNvpgRlUHBv935PHHVUUINIgCmCyUGQYO2LvpoiQMjjtotJ0/9Ml7pZxjUO13DynKCnsdp93jnjg6Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 69.169.224.6) smtp.rcpttodomain=virtuozzo.com smtp.mailfrom=eu-central-1.amazonses.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=sashiko.virtuozzo.com; dkim=pass (signature was verified) header.d=sashiko.virtuozzo.com; dkim=pass (signature was verified) header.d=amazonses.com; arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.onmicrosoft.com; s=selector2-virtuozzo-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=06Z63j++x35JkTf+QiPOpdo/1tQDJd3Kxli+h9k3+pE=; b=G7iIfYBzh5KMQ1GrKNmgMRGvOOstnzX2Kq8zZ8E1AtW4uCEJsgLAW4XYgy1iZuHgSRiGnMLmFe0DW4Vgi7WVL2/gOYuYOqWpLN5B+gemk9bzW7W2g5JezDjP5RGlyDv+xaAwlao3vrI68SeFczPX5MQ73YVAfxlNzBdeXb1SHQg= Received: from DB8PR06CA0038.eurprd06.prod.outlook.com (2603:10a6:10:120::12) by AS8PR08MB6069.eurprd08.prod.outlook.com (2603:10a6:20b:29c::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.569.9; Fri, 30 Oct 2026 14:53:37 +0000 Received: from DU2PEPF00028D0F.eurprd03.prod.outlook.com (2603:10a6:10:120:cafe::52) by DB8PR06CA0038.outlook.office365.com (2603:10a6:10:120::12) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.569.8 via Frontend Transport; Fri, 30 Oct 2026 14:53:37 +0000 Authentication-Results: mx.microsoft.com 1; spf=pass (sender IP is 69.169.224.6) smtp.mailfrom=eu-central-1.amazonses.com; dkim=pass (signature was verified) header.d=sashiko.virtuozzo.com;dkim=pass (signature was verified) header.d=amazonses.com;dmarc=pass action=none header.from=sashiko.virtuozzo.com; Received-SPF: Pass (protection.outlook.com: domain of eu-central-1.amazonses.com designates 69.169.224.6 as permitted sender) receiver=protection.outlook.com; client-ip=69.169.224.6; helo=b224-6.smtp-out.eu-central-1.amazonses.com; pr=C Received: from b224-6.smtp-out.eu-central-1.amazonses.com (69.169.224.6) by DU2PEPF00028D0F.mail.protection.outlook.com (10.167.242.23) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.569.4 via Frontend Transport; Fri, 30 Oct 2026 14:53:37 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=23yjbh4k34hwzfubhuiim7m4inbd3ick; d=sashiko.virtuozzo.com; t=1793372016; h=Message-ID:From:Subject:To:Cc:In-Reply-To:References:Content-Type:Content-Transfer-Encoding:Date; bh=IbfYvxWgWPpDY3LvnBAcU8GbY9T3qb/XeWvPV6gQGLU=; b=VpdY6/fAgqepdy0a6aU/GNrmfN1QQO2oHGm3OmW6kROC8MYRbb8AEq2u8TJSTi6B rJJkp57x5FAkVJQ2XH4kpd4BGJAl+IRNCUBkWitEk1lp4jN5VT62mzSDtNvgiGTp7mf Re9TSMSi4Ch1ax5riyzK0NzVlQrkBt82yA5SQUuZldIsnk4YHhKYsONWlODBXvr0XFH 6KYF+tULUrPiJwPUZ+CVqxWjNqJbUxRYTaBlSLaYhb6gKdOxdI3TmRhMV+FWuV/wwvZ ELzWyKDi+LXcrq7a1Ki+P9nxh3GFd3gT8rBvhnZ4g2k6ZC4pIIqlmQB/ZaKqIjzqhvU NzCBBrYHsg== DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=qftdzk2dqsatjnlrq4r5brjbihpfcrsh; d=amazonses.com; t=1793372016; h=Message-ID:From:Subject:To:Cc:In-Reply-To:References:Content-Type:Content-Transfer-Encoding:Date:Feedback-ID; bh=IbfYvxWgWPpDY3LvnBAcU8GbY9T3qb/XeWvPV6gQGLU=; b=fy70E56TET7fLaT9XbfHashMCgYiZS8OGQZeg5bHZkQv8Lsy6OuqXSFTJKvfUWRd XZJkilEq1RTJ9sKh0n9FpFfbOy0khDcygGsd+qpSFEAYKlu9MEsZ6nd4L15uW4JHklR GKFscHV+CMClrXv+9VljM0tQkrGsF/8lYCCyo0d4= Message-ID: <010701a18d4d505d-da04bd5c-61f7-48d7-a85a-ecf6c7e29239-000000@eu-central-1.amazonses.com> From: no-reply@sashiko.virtuozzo.com Subject: Re: [PATCH QEMU HCI-8.1 v6 10/34] vfio/pci: Reject invalid MSI-X Table and PBA BIR values To: Andrey Drobyshev , svt-core@virtuozzo.com Cc: andrey.drobyshev@virtuozzo.com In-Reply-To: <20261030-vfio_v1-v6-10-45de246bc92e@virtuozzo.com> References: <20261030-vfio_v1-v6-0-45de246bc92e@virtuozzo.com> <20261030-vfio_v1-v6-10-45de246bc92e@virtuozzo.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Fri, 30 Oct 2026 14:53:36 +0000 Feedback-ID: ::1.eu-central-1.2wRQJBpg9g1fGRYexx3dUuYGS25Bux+2TEOx72/m6U4=:AmazonSES X-SES-Outgoing: 2026.10.30-69.169.224.6 X-EOPAttributedMessage: 0 X-EOPTenantAttributedMessage: 0bc7f26d-0264-416e-a6fc-8352af79c58f:0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DU2PEPF00028D0F:EE_|AS8PR08MB6069:EE_ MIME-Version: 1.0 X-MS-Office365-Filtering-Correlation-Id: d33ecb3f-b92d-483c-b7ba-08df36959420 X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr X-MS-Exchange-AtpMessageProperties: SA List-Id: svt-core@virtuozzo.com X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|9140799003|32142699015|48200799018|376014|61400799027|5113699003|4113699003|55112099003|22082099003|18002099003|16102099003|13003099007|5063699009|56012099006|4143699003|10067099003|261028144727099003|261021121427099003|261022105027099003|261009223027099003|261026140227099003; X-Microsoft-Antispam-Message-Info: oZ7iJ9RdL79wSJ9rZ4EMU8QP5Aa0IFeReBgn7QNoOdIw1wR6NCDhu1sdLUmtho31Xvw/4H6+QCAli1PsAEqElxtGGgV5m1RREr3pIKLG8WsiXB4sH7StY+GPn8Ks7ZaXuxKxar5BEXd2W4gF9YAr7e513FLCKyoICjSwuJatVke3y4Y3GpsNjQsLmvn47j6ghKF8dTxhDWC3UvJezzGMqkw3BgxzLYzWfekeJJa4j9pw04w0L5v8SIg+xggHlZI3BUsENREHoPHHM4Fa2jpI8gzsiXS43YBKTwRbh5vl7WYAig/Yk3ilrD54vqoclymEAwTcO8TsMBXEWFqRIwoOcTnojNKU4e8RbuvQUezhlh3Km55Q3n8UY62l6PxbCvm9Fegmvhv3IXG3FnFMMe1Fo0l5V9EAhC/EG1nQv/BItPMa2wjAfF083ZZ9lQPahP5yLScnaVcRgOHPOBaV8zOosuBYPagbkhnqRMR+UiHr7/Ve4Vt1z+DwvNSSl3h+zAWZpXmCPNsGZPr+73omAfRFimzS14q926KStFNFnV8LwW7Sb6lBXIWbnL9B0QsGtyk+xosx7Lz1ORuYbJF8pF5J0wK4rDStcqtCQ2VX9m6DoGmIujsXkhYa+avvYRq0iGpywXawmXnUwCvA1tdN3UUSuvLoiTtR3GVD+2KRCBy4Yf2Z6KTcQw+CO6YlfjZwTkJA9c3wXAVCjdKuvoq58W2tR1BLro3kzhmdb6iERd9FjPOR0srYNH6d8CKJdBf1CWEO3yR89qEQEk7Uksbz4n8JFw0lYPPGrPJU4NFCU8cdYoDu8Tih9AL4xQjKWBmTVvPCp1wYVSChVureUpeWfAKBViUnE2CiG7pT4knezjKoZ2Je3Bww64T4Z4CeUuUkjDyZv8OpT+c4JUUqeFtGVzzdiaMX+ZP16B9zHE/ez8xQAqr5PKBVW4+jHQhqH/W1MLjq X-Forefront-Antispam-Report: CIP:69.169.224.6;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:b224-6.smtp-out.eu-central-1.amazonses.com;PTR:b224-6.smtp-out.eu-central-1.amazonses.com;CAT:NONE;SFS:(13230040)(9140799003)(32142699015)(48200799018)(376014)(61400799027)(5113699003)(4113699003)(55112099003)(22082099003)(18002099003)(16102099003)(13003099007)(5063699009)(56012099006)(4143699003)(10067099003)(261028144727099003)(261021121427099003)(261022105027099003)(261009223027099003)(261026140227099003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: NYbIDzly+PfLaAP8I7IboiaJHj/JDLut0W4OGisKISU/OJLg/5/88Yy7k5gFEiZe9uj3Iazq1oH0Domf3h4uxtvuCFpGdbssbzd7JCyuQidO1pwZvGSciHsEOGXelMAIJD169rIBADlxlHeLFnb4cSFsjVG4gzxLGO3SEypT0bjG7wEc1zfRQKgVtYvOf/+9YoP8Hgne54VbnWn0XAREXklRMhYupBHb/Ewo43vcNk3ZJUARaNbCByASOolG5uMe5Td29oZJgwvZUQ8bYVZp+FmJG67r9tdxjbRFZHKjQtnmYwMAA4gYN2o31smO2IswhjSrri3lJSDZgjxmNhIVN0K3bMnr5OBycFfkV3jPiDncP/+QOQOOmxSHmODXqZRw35sZdhfU9QADlayXuszpieJUw81BhrzZe4KflZ+S4g/L0Q5fUY2YrKla54Jf0gjs X-ExternalRecipientOutboundConnectors: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-Auto-Response-Suppress: DR, OOF, AutoReply X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 30 Oct 2026 14:53:37.2200 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: d33ecb3f-b92d-483c-b7ba-08df36959420 X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-AuthSource: DU2PEPF00028D0F.eurprd03.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: Internet X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8PR08MB6069 > From: C=C3=A9dric Le Goater >=20 > The 3-bit MSI-X BIR fields permit values 0-7, but VFIOPCIDevice::bars[] > only contains BAR0-BAR5 (6 entries). An invalid BIR value of 6 or 7 > can cause an out-of-bounds array access (CWE-129) in vfio_msix_early_setu= p(). >=20 > Add range checks immediately after extracting the BIR values. >=20 > andrey.drobyshev: > This commit is cherry-picked as-is, with no modifications, from the > upstream commit 9daa7347ff25. >=20 > Reported-by: Feifan Qian > Fixes: 65501a745dba ("vfio: vfio-pci device assignment driver") > Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3878 > Reviewed-by: Alex Williamson > Link: https://lore.kernel.org/qemu-devel/20260706161334.2165482-1-clg@red= hat.com > Signed-off-by: C=C3=A9dric Le Goater Sashiko has reviewed this patch and found no issues. It looks great! --=20 Sashiko AI review =C2=B7 https://sashiko.vzint.dev/#/patchset/20261030-vfio= _v1-v6-0-45de246bc92e@virtuozzo.com?part=3D10