From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from AM0PR83CU005.outbound.protection.outlook.com (mail-westeuropeazon11020105.outbound.protection.outlook.com [52.101.69.105]) by lore.virtuozzo.com (Postfix) with ESMTPS id E89898017D for ; Fri, 9 Oct 2026 14:56:15 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=NfWdX2RUWKsAEuuzggCMYp25BFwnuRIGDIiK+X5HuNUIkntPqSbyF1IrAB7n9I3W/LSAQej5kVuEXHeP8RPT4E4w2sfpaZS0RoSZI0PlSTwzXIh3pa6YBkc3ug/TDtqFwrIEwiAR49xgpkiu5S2NyJ4C4aGCuIMVB3FNgAQ17Dp26edS3hpjmDYtdrtes+yg0JFGY2cpXDs9uEY+aEWjk/nYN8W0kAHuyZ2z5MSMqo/d5uScDWFGDXAfuAfJGTKKknS5RJe6QjNaQCj0u0PtCem+qU5UKpXtF7UyqndsAj1+h38q2e1xmrwZBQRdqc4FzVPZD0YsGFrk7g4n9NQyUQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=9n/f58Cfww7ExcwPHWCumaxgk4jzvGlue5epPFjzeyw=; b=XiJHs4hHJEks3cbENXJTYD2L4XvptuNETUjMZMpPdc9rrBBQYO1EK+zCMZINVfSJua5HoJDl7X+waJRR2/1no1+4Mb9jruxA+L0THHc4aKTECnzTUHXOQK8QBSHgefGTkDZWiI3H0prj5qqPE/cNyqXcyLnriwgTvyxe+g1+kpepukt17LZ7IYTmMNam0jHlxdnQWkCnHVVHhPYKxBX7tarUWACWzHyWRiExUT5rLI7Lsqca0PiqhwmrVfzmTbH2JLTl4Z2VKUFtXnnlsiJbCtxfyqijFZgyFIftiRCkBeG8Z40GAi7A0tv/rJomUY2ppQNkAamZuQ3Um75QCW/2LA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=9n/f58Cfww7ExcwPHWCumaxgk4jzvGlue5epPFjzeyw=; b=jwAvyIfEXsmkMkincE3xDaEz2CpCLyWkjrdckhXseuy92VzaqFVn9JNc9GnQKRWCnxsnHTLpj1lNPxqqZDs6Iv9epwYbv1gexIYRq8J5MDPi8yZdRdDV/TJRmUIR+LLNFWvw9Wq9EjVCudQEYCajUieX2eCp04u05q3p5wOoRx1ckuTS8L7hGFrZrfB+pt9yxE3PsSf0oRIFgcErz+hkQ1yJ2wOODrjNOjJELvoO1oEq+ExgpZd5ED+l3dc7DH2HBnhSaljafxBnmB1Azi9Zp4xAqVRtYTx6lxQh5n+TST1aIRdMLPAIYLmFtGYRUci7n5edeVwHcRpe1UxSlTKmYw== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) by VI0PR08MB11172.eurprd08.prod.outlook.com (2603:10a6:800:254::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.496.14; Fri, 9 Oct 2026 14:56:07 +0000 Received: from VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8]) by VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8%7]) with mapi id 15.21.0496.010; Fri, 9 Oct 2026 14:56:07 +0000 From: Andrey Drobyshev Date: Fri, 09 Oct 2026 17:56:02 +0300 Subject: [PATCH QEMU HCI-8.1 03/21] vfio/pci: Reject invalid MSI-X Table and PBA BIR values Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Message-Id: <20261009-vfio_v1-v1-3-2ae91d5b8048@virtuozzo.com> References: <20261009-vfio_v1-v1-0-2ae91d5b8048@virtuozzo.com> In-Reply-To: <20261009-vfio_v1-v1-0-2ae91d5b8048@virtuozzo.com> To: svt-core@virtuozzo.com Cc: Andrey Drobyshev X-Mailer: b4 0.16.0 X-ClientProxiedBy: VIUP296CA0132.AUTP296.PROD.OUTLOOK.COM (2603:10a6:800:34a::14) To VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0PR08MB10656:EE_|VI0PR08MB11172:EE_ X-MS-Office365-Filtering-Correlation-Id: 95360bd5-ebcc-413b-165f-08df26157266 X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr List-Id: svt-core@virtuozzo.com X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|23010399003|52116014|366016|1800799024|38350700014|56012099006|10067099003|5113699003|18002099003|22082099003; X-Microsoft-Antispam-Message-Info: BIRYmFaRFgmmJTMlAd3UDhjHhricD1Gtk13O5PQUKbqDFsEqVRFryRRoOjMfZ0CbjKEKapYM5dWdN91I41MGqdepVodsewObbR2GTgUqxFQ7f0AlXsTc2GeeLHWymO5rxOfxclc0X3yslXwSiiJ363lABikzQLI5MTCTd/jiazBz8YxVaXE+DKrCTE6Yk3RasJfbp91ztrYQ9sqNP5/7GjR6Eeh9AOvG2yWAdQxQSgnAopmhuQHtINxNgHKGjIB8wfE5i4sWMdb3tM6vSjMqrn7H+zmvgMo6GMT3w8iRk2Z8zGJLXoAI4lCi6tLiMkO2w1dUIKsUHh/RiidK7Vb6GaNGuC9Asce3rko4CftgILs/KerrZfoiUejFQryRV1dccEDbQNf+SxjAzJZEX+yfhgSckI8Bi5rXErXQId/F7v5zHC2CmmRNifv8vHTYOp1ye4Tn88KJAZYgzhDZfzc0jnzvE8pjrjdTOAhyR71bMkyco8eQpJWIDqloTy9+JJjB6BBkPXl4crOCzih4Ypcu3ou/z4sp08YQFPNDtQvYURDou3blRrPKzF497aIPI107rZZZcOfpWTujL2rKTB6ROdIbVwSPsrRY/S2iZpltthUFtVgdMJiqSW5AXyoUkXPeXAS0NtuCO9OUknSNq8KFtckYGnehsBM1g/7JvcrXtcQ= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0PR08MB10656.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(23010399003)(52116014)(366016)(1800799024)(38350700014)(56012099006)(10067099003)(5113699003)(18002099003)(22082099003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?dC9lM1IxZkozdnRiTUcxU2dCck5Qc2p1ZE95NTdaSWhNQy8rOHo2NWEwcy9w?= =?utf-8?B?SndnenFTTi9MUldZdC9NUzhtRmEvUktYZHZOakV1WitPbnBaODhGc3RMZ3Z0?= =?utf-8?B?NitscUdzUXkrOHZzWGNxVW9jc1ozTmVqVG5qOEdUeXlZZ1RSeEU4STA1QXkr?= =?utf-8?B?Rko2WkV3cHBhVHZDSWxPSDVJK3k3WjNUS25RQ0hrZ1dkSkFvc1g5eUM3djFQ?= =?utf-8?B?MStpdVdPcjdEb09CUE5jbDJKVmFRbkJsSUFzK0xEYWlxTUtyakUrQUNGT3Bu?= =?utf-8?B?UXJJdTZZUEI5QTZSYUFZTTFOQWJSUktQQU02OFpCMnNBRVl5RVAyMU5VOWlP?= =?utf-8?B?NjJPMDlNd0h6b094YnM1dFpqOXAvblRpMGZDeE9MemlNb2ZBOFpsVUpzVUw2?= =?utf-8?B?Nk5DVHpUQTBBeWgwd3BjcEQ3bWZkVE1YaTBJV3BHNzJMTmxaakF6YTR4U2VL?= =?utf-8?B?OFBKN0ZOcWVxN28wV0RsY0tFdmRLWkkvTGsxS04zdHZOQkt0bU11b292Skpo?= =?utf-8?B?RW83SDRuQjFpVXp0NTVBT3BhTEFsNzJoTVNUU1FaWTh2R2dna2I5N1RXNDhl?= =?utf-8?B?RHhJSDVhRDFmK2xQU0ZPWHhFOUtMb3pCaGxsUUJhTzBWSHAxM2NiYjRjZHZr?= =?utf-8?B?NVA2U0g5QkROamtBVUNUbXZWTnFVK1JjcVh1UlVOblFkeSsrOHdGaGMrcFpM?= =?utf-8?B?czVaOGxJZHBrUTl1aEh6eGxwd2Z0enR3M1RONjVJR2U4NmdoUXdMUmVhNXFP?= =?utf-8?B?TGl2UzBaT0FPVWtoVFNHRnlkTE1pYjVCcWw0clA2dFU3SUdRbzZOOWtTWFRG?= =?utf-8?B?aWZBNWRPWUNINm13UVNtOExJclIrTUFBOXYwQnRKV3dDRzU4N2t3VHZEVUEr?= =?utf-8?B?cmgzejh1aTdmcHNDZUtMT2wzNTc3NkprbWZpd1N4dnh0QXRGUlJuc1AvOEdZ?= =?utf-8?B?a0diYVNMMEZsTk85Z3o5L2JxanJrdHloZU01bEQzVWMwbXNlcmdybTlEbHlU?= =?utf-8?B?ZUlGTUJ0WEJqRWNNdi9udnJDN242YU9xYjNNYVEvcEQzTGxpbzA3NDFGSVh5?= =?utf-8?B?K3pBSmY4ZzRZTU5MWXAwaFNlaGdLZk14TUNzQ1ZSR0JWU3NqU3AwUHhOYzRj?= =?utf-8?B?RGN0OVcyTmU1ODFGVytjM1kxbmpRdzMxckdtOUNla0VTVWxzOGdGS2V1SkF6?= =?utf-8?B?QTViTHpXeDRyS2txbUdIRWgrUHVzWU51eDYvR3Vqd1lzQkd4VG9JNm1xeGdu?= =?utf-8?B?dHJuZ1dlM09DYS9mckk0RFZLREVpL3Y3V09iRElIY3REV29ZZHlqU1dSaEVO?= =?utf-8?B?VWU5TFhMS2MrMUhEbS92UU9CbEd3ZU5UQmNTNzVCaUFyYVZvU2J5ZnNEeVpU?= =?utf-8?B?TXpzM2UyT3RYVDFJSU9kMHVvRHVaUG5ET09ESkdjNnJxdnROVHVPSytOSTg5?= =?utf-8?B?aU5jbXUrS1U1OW0vQkd3UnN3RW9SSUhZZGt5QndqSjhkdEZUR2hHUGphQ09C?= =?utf-8?B?QmltUS9mQ0dVdFAybnpub0hDeUxSOU9MaDAvNDJJa003cTVaclVobGc5NGJ1?= =?utf-8?B?RTlCNnQ1Nm5FeWk0bkZiWFpPSHYrT1VGbXgybk42eERQZnBBQ2V6WTVnUGZV?= =?utf-8?B?MU1RcUdrcnZMeXczU1BXSWFBYVV1eEs4UjdYckF6TWJVOGVFS25yMFBGeUwr?= =?utf-8?B?UjRTWHFTUDJ4MkhOcTZuNTRCODV5cEwwVzhQbUp2eGxJRlJoM2tqcENlbjdU?= =?utf-8?B?clZFWkU5K2pEQUZKcTEvb1d4Ry8rSEw4WlZJYzFUU2NDZ2gxTmg3TDAwK00z?= =?utf-8?B?OWd4akFnRkhwMW1BV1RTVEQ0b2U2K0cxS25ocHJCVlRTQ012bTJNUmFsZTVx?= =?utf-8?B?VTF4aExJWEJoQnJCZkRlczNjYVBiY1dJNllLMC9WS0wvUGphMitpS1pGeCs0?= =?utf-8?B?bHJkNENPcDl3UHhFOFJFSGRPclVjUmlIMUR3cEp6VXloOHY1aEJtSU5rQW1O?= =?utf-8?B?b2JqbWNKcFR4a3RZY0V0RjU0dzFhTlMzOCtXRXNBNmpLVk40N2pJaFQ0REhO?= =?utf-8?B?cDY4UlJIbHJGc29uT1hmUll6TCs0SmJEODdTOWxUZnQvbFRxV3V3VWs5bEVm?= =?utf-8?B?eVhmRE1PY0JUYWtmb0tyZmZRNm1raTFwcUM1WDNVY1hIV0RGT2s2VWZQTVhJ?= =?utf-8?B?ZE9QNnc4VVdkWEZ0OVBzUlVnVENGblJqUVlweXFKMXpHTWpCbmZuaTFjREFM?= =?utf-8?B?N0FtR2swZ0ppazh6U0JOMGhISXRMendXNDdoUFprOThtenFqMnZkb1lFV25o?= =?utf-8?B?WXhTQnAxYXNWSy9BWmkrNVIvb0x3RXZqN1NnNGJJbkdwMktyVldTN3ZNMTN6?= =?utf-8?Q?H6nYMfkqL3My9/jQ=3D?= X-Auto-Response-Suppress: DR, OOF, AutoReply X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: 95360bd5-ebcc-413b-165f-08df26157266 X-MS-Exchange-CrossTenant-AuthSource: VI0PR08MB10656.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 09 Oct 2026 14:56:06.6595 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: XINrkMFlLCidpzE6/kwxM3iR9/6fzXE/fkTVj8cI9qe+68dN75ACF9UagGByIB1xqAg+beVpzym/TTWcUnQjVDBulzdZItzrWh9JbmWuxXY= X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI0PR08MB11172 From: Cédric Le Goater The 3-bit MSI-X BIR fields permit values 0-7, but VFIOPCIDevice::bars[] only contains BAR0-BAR5 (6 entries). An invalid BIR value of 6 or 7 can cause an out-of-bounds array access (CWE-129) in vfio_msix_early_setup(). Add range checks immediately after extracting the BIR values. andrey.drobyshev: This commit is cherry-picked as-is, with no modifications, from the upstream commit 9daa7347ff25. Reported-by: Feifan Qian Fixes: 65501a745dba ("vfio: vfio-pci device assignment driver") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3878 Reviewed-by: Alex Williamson Link: https://lore.kernel.org/qemu-devel/20260706161334.2165482-1-clg@redhat.com Signed-off-by: Cédric Le Goater --- hw/vfio/pci.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c index 5e281b2e1d9..d930ef46309 100644 --- a/hw/vfio/pci.c +++ b/hw/vfio/pci.c @@ -1791,6 +1791,14 @@ static bool vfio_msix_early_setup(VFIOPCIDevice *vdev, Error **errp) msix->pba_offset = pba & ~PCI_MSIX_FLAGS_BIRMASK; msix->entries = (ctrl & PCI_MSIX_FLAGS_QSIZE) + 1; + if (msix->table_bar >= ARRAY_SIZE(vdev->bars) || + msix->pba_bar >= ARRAY_SIZE(vdev->bars)) { + error_setg(errp, "invalid MSI-X BIR, table_bar=%d pba_bar=%d", + msix->table_bar, msix->pba_bar); + g_free(msix); + return false; + } + ret = vfio_device_get_irq_info(&vdev->vbasedev, VFIO_PCI_MSIX_IRQ_INDEX, &irq_info); if (ret < 0) { -- 2.47.1