From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from AM0PR83CU005.outbound.protection.outlook.com (mail-westeuropeazon11020123.outbound.protection.outlook.com [52.101.69.123]) by lore.virtuozzo.com (Postfix) with ESMTPS id 46C89808A3 for ; Fri, 9 Oct 2026 14:56:16 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=U5j/u350v1djaG5EPduhkNti5ouuEfxu6geNtZ+t7o2xwRBrGlWcz+msYfx348WlpB/A2MkLzI/pUre2r2CxE1Y0B3aTDkz99XA+APsEBubshJK8Ojs024ggueomheUuHhmiifUJALX2K71MNvOuOXXtqOH/93A8JbsdWSpl8bk8+SmvnftHNhXuqkgFh5V4ViTRPK2Gp24tyH/X3iuHjv9VxN7QmeJDCrzoR2/ouJu4s5qQI7htuItjR9XZTd3M8KzZbKTP6bOqSAt8aurO6/owBU58KTFbAKEkYJuAAzaGrRPaUa7YgTQpKVK6DHgjDKY0oZRlaPFV4VUPkYYp0g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=GpyZeuzxBx/9EXW2jB4YPAzv27x1rv066ytK047XXLA=; b=i3J3ii0GCCcuxmRvv6w9ytgANag/2PghSYhk+FzMH14wna/8m22jm/bg5qrmpD8kcsvCg6dj4tEc4NRi7YnAKz1AXe3Y8EjHMbvG1SwbOabZpOPK1Vi06k7PO5IMVCSfoR8oiVZezKNINHj9UM0R5Bu1+tiFS+VY8l06r7ToJn15oekokvLsEMgJ/U8WkcQ4UZUbmnaZPQ/w+rRQXDiv5/YceI+EUzhyOFE7blUqwdPMXDs3mtSIkrQu/j+oUC8ccnjYoVtizwEByMpBAKXJWdLkO0a6163glvrpQT+p2TWUlJWejCNXR64LBRY57UrYqjCa32WVstULb3+Aa1mguA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=GpyZeuzxBx/9EXW2jB4YPAzv27x1rv066ytK047XXLA=; b=m8D+87C3/sr+n0Dd/rI/z3/SKs7qKL4ya37D4lof36gSutUX/lDMKJ/XlhsaW3DW8rYix5y01iaw9dKqPI0Yo6pyv7juIkp7a+AGrxmdAZ8gFwwZolwInHHZ3YQTFT28VmBlJVFU9kJyOGVUf8RuRLyrEld9CLYj7tR5XVBDq9/HVk0MDbx3ujFCraPn7KnlVqllJJ7uvucVBCgCghA+abPqT12PwOE/ZwvgrImzoyHc86waQeGZ2vnC3u1WM7GTb++c2H4VgPz8eMFWuOuiKN2VlnzY8Tjamusmy0o8ENDKAuTJSjZem0/v6oauWcFbO6HZeqpjMWKOCysuNfBT3A== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) by VI0PR08MB11172.eurprd08.prod.outlook.com (2603:10a6:800:254::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.496.14; Fri, 9 Oct 2026 14:56:14 +0000 Received: from VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8]) by VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8%7]) with mapi id 15.21.0496.010; Fri, 9 Oct 2026 14:56:14 +0000 From: Andrey Drobyshev Date: Fri, 09 Oct 2026 17:56:03 +0300 Subject: [PATCH QEMU HCI-8.1 04/21] vfio/pci: Fix information leak in vfio_rom_read() Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Message-Id: <20261009-vfio_v1-v1-4-2ae91d5b8048@virtuozzo.com> References: <20261009-vfio_v1-v1-0-2ae91d5b8048@virtuozzo.com> In-Reply-To: <20261009-vfio_v1-v1-0-2ae91d5b8048@virtuozzo.com> To: svt-core@virtuozzo.com Cc: Andrey Drobyshev X-Mailer: b4 0.16.0 X-ClientProxiedBy: VIUP296CA0132.AUTP296.PROD.OUTLOOK.COM (2603:10a6:800:34a::14) To VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0PR08MB10656:EE_|VI0PR08MB11172:EE_ X-MS-Office365-Filtering-Correlation-Id: d1fe1fdd-1340-44d3-c646-08df261572a3 X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr List-Id: svt-core@virtuozzo.com X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|23010399003|52116014|366016|1800799024|38350700014|56012099006|10067099003|6133799003|5113699003|18002099003|22082099003; X-Microsoft-Antispam-Message-Info: loeoFGnHkxBpxe2bUkx1xUZ34dWLnDljxQrAcdvd+MF9mqeT7orJ6F9JP6MpJ2sUMkAh4hIweHnPLkJ1g6f9pbQx4/2X+7I86g1hTjmeg1cc+YySFTVvvvI6Y94NWW54Trny/J3CG0sdyHvwBCATt2NElOdGaBFLa5+o/IC3qBROoMjgju8zrTx4xB3XwYd+5+FXSt397ZTwBHyOW33aGU1rv0U/HXnNWTdGCwVlShEw4J+W4ih3u7397NP2i2Nl3ZtnkAMUk3kqJ80Pf7zA00jUSB4BDSUFQVgwII03wA3WeZKa9G+2UPw6KAxSsJbOkO21h0+0G6524ukIMRVas+b0tdtAxkx/GqPKYxCUYGmQWZiDf1BlAmkSUt/LErQeEPjsteyOPOZWKfw93csM2gIFT5TH3FFRIF1rziEMhBqdYjvWuNOiEnTByQvyJjdCphhAUHREIcruGtLC3goX23XNJJAEV2sidCzM5A5R7W0t7rSK+4gP2LZZ6H9C1GzvpvDWGsjckJ+KdLi2ThZwWX5ok+njHbbC1gCqDp/mdjWIFixWBFtkYm6vb9Q9Q9iJKR2hEg78KQ2uVQXUqfb5SGd1TnNsLl20XbsT766JEapUjVC1dMfKloHjOCtI3qkz8uBhb9HnP0kx6nPsipZIW+MYAm3m0oARSMNhI2nXBIcbyV8yTcvT6fZEw3jSlbGy X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0PR08MB10656.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(23010399003)(52116014)(366016)(1800799024)(38350700014)(56012099006)(10067099003)(6133799003)(5113699003)(18002099003)(22082099003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?Qzl5eHF5bFpMRWxSRHVnMHBrMG1iK1dzS29aanRpa2d4OElYdmthais1dnpv?= =?utf-8?B?dUNHR3BUdmFvYU05ajhEdDJzN1Q5aCt0L21WdzlqNkh4TDk5L2NTZDNEMjRO?= =?utf-8?B?OHdDSFpKV1ZaeDN0dm1vWGYyVWpEVXJ1c2taM2hSbE9teElYZnBDQnR5UEdM?= =?utf-8?B?NEZORmd2NW13eTdrdDNVYW1ORVQxdERYTFk0S0hHUzdHdFprYk5jSVp4czg5?= =?utf-8?B?QWNBWTQ0cUl0cmFsTENBcy95NEoxM24rbzRrZVdhWXhNM3h3ZjMvZ3hwbm8r?= =?utf-8?B?UlZNZkk0L2VtcC9uV2RJZ29rcDdYeCt4dlYxczlLVkhFeWtWN3V2ZXl6UnBq?= =?utf-8?B?VUQrampBMVJGaUV2OHVtUlZnWVNIWUxKK1lZeHRrRWxDODVqUjJxd0hxamNU?= =?utf-8?B?QXVrOHM5VUl4OTBjM3RFbzhXVU1iSWJaenpQcXZrUXdNbVAybCtEQWVSU3ha?= =?utf-8?B?MytPMEc2Q1d5dUFUZFlnK3hUZERubG5CUWF0WDZIbEs4QmVMRnJVa3hnYy91?= =?utf-8?B?NFJaSERrMWhuZTJXWTdwUXFIY0g5N1dRWXVhamlsMmxLbEhDQVlVOEF4VWcx?= =?utf-8?B?MU1XWW5JejNHdGVITjBCNXNOOFNoZm1PYmNlZXJKZC9XQlV4emxYQ3V0SnVM?= =?utf-8?B?MFYvbTFpbUFKUStuajY3cit2ZFFTN2lMT3Rwa3NkWmdPWmh2VWJ0SWxrSjV5?= =?utf-8?B?WWxUS2dpKzZIQVR6bDRMNithNDY5cHoyOUlRVkJrdGxSL0xPWUpHYlFDVGQ0?= =?utf-8?B?TmN6RzlyNWxvVW04NzV3RmwxbjBUdXhPaXRHQjVNVlVVcExrYnRwaTkvL09u?= =?utf-8?B?SEY0RXpVUCsvdFRrVlh0N0svbFZHT0hJTXYzTTNvaXg3MEJJOGVxcVRtQ0ZP?= =?utf-8?B?RXA5M1Y5elBnNFVpTUNiNklQKzRISzVDQ2o3d0w3bHB4OWMvY2wvV21IQWxV?= =?utf-8?B?M2hPMUozQ3EvK1FBZ3hlODJVK1N4TmRqbE5GSExxYlJJNzFkVlB4M0tjekJq?= =?utf-8?B?YUF3S2Y2aEthamM0OFFvcHR3QjhNSEN6YWZaNUowaEVxZ3ZmWi9MNjVyc2Mr?= =?utf-8?B?SnhGRzBoSkJpK3dpcjhyQ2RERW1KVklQL09VcmFZQ3JpN2VFTHNjekYzSm5y?= =?utf-8?B?RWlNTVNzTEdXWVo4Y0NYcXQzajA3TDg5SWxjbGNYYldwUHRjc29xeXV2M3Ey?= =?utf-8?B?TitOeWl5YXdvY3JaWWhyQ0RpWHZDc2pGZ0NwQjYwMGtacGczK2NiblZHSE1o?= =?utf-8?B?RlJuVTkzOGJUNXN6MmtXMHd4L2twZzRuYWtTVHpmQVJJNlQvaXJWQitNVkN1?= =?utf-8?B?ZWRzWnJiVWh3b085MytYTVQ3dit2eDA1UUpLNVBqL1U2RW1oV2NCY3BvOWxh?= =?utf-8?B?TjBnbjA3QVJoOVpzWVhwL0dXOGM2QkFHNUNRZXJza1VoRTI2WElHWTMweXB6?= =?utf-8?B?WnZZZzZIM1k0YzlqM0hqWmNkbHdIeEVUNHBmeTU3ZFpHLzVPRCtYaGVTWXE3?= =?utf-8?B?MFFsU3V1OXpmUGIwVXlYai9TY21sRm5XZWc1YVJlWVdWV2JOb2lvSUJLOFh6?= =?utf-8?B?cDBsUHFoalFKTVBuSUc1ZHBHZE1NNFphN0h3TndGK0k2ckZ6U2FmK2VZOGdn?= =?utf-8?B?cnJPQUNWV3lLMjU0UWZzRm1oR1c5aml3RmRSTE9FL3ZTeTlWdW9mZ3piMEtl?= =?utf-8?B?bDhLcldaR0hYOEVYT1I3VEdRbEFEb3JwSUpkVlVscnlLKzdKWHpuUk9mQ2pa?= =?utf-8?B?RmZ3TXc3VVljU3ZGUmVMQ2VuczZrYzY2c0tnc1pJVkUxOUlHbXk4dUtCcmR2?= =?utf-8?B?SjdoZWUwaFdpc21IMlNiME9yTDYzQytzSFB6V0ttNFZKcEJQNFRXTVZsYit3?= =?utf-8?B?SXgzQUlidHl3R0ovYktPNm5IRUVvQVdmdUFYcWZkYTZVUUh4Zm11MUE1ODRq?= =?utf-8?B?cFdZdGRTS1VBL2kzTW5IQVB6YlBsbWx6WUltbk1vQmY4bUpoU01SK213cWs0?= =?utf-8?B?NVQ5Y0lPZENYQUd3Sk04MWZVVjhQTlNDUVpVTUt1MGs3Yk9yWVlWUUdZbmlF?= =?utf-8?B?RDhrOHpQSHpCMlZ1d3cwUURwYXBLSjhRZG1FYkpCejNRbzVFdjh4QlN1TWhk?= =?utf-8?B?RjhHKzRYVWJ1eG9pN2IvVWZwRkVwbEtjbmlnMkM0R3dxNFVETlNNc0dYV1Yx?= =?utf-8?B?SUFGNlJCWlo0bnd0ZkZUSjBlZHl2Z1RVbHBnaURRcFdaZWRrQjZXT0dYR29W?= =?utf-8?B?NFQ3SEFwZ01GdXpHVkpiT0hJaGFjdGhYeVZ5SVlsZm9kUmNlZnhMSitRbmpF?= =?utf-8?B?T01ER3JFUUUyMjQ4UHJ2QlZXVzZzYTNicGNORVRGMTFVcXR3MlRFZGxIajRv?= =?utf-8?Q?C5ks9S1Ma5oabvxA=3D?= X-Auto-Response-Suppress: DR, OOF, AutoReply X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: d1fe1fdd-1340-44d3-c646-08df261572a3 X-MS-Exchange-CrossTenant-AuthSource: VI0PR08MB10656.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 09 Oct 2026 14:56:07.0435 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: pqXLuI6B5FNH7mHFvqxips/O052m2tgahuM57FSRPmt+zJmwyP9RDvyBiZEg/gV/LcxJCaQCal2nZXoGNUY0+1rCmu5zx2YVCdxzxIwAJtY= X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI0PR08MB11172 From: Cédric Le Goater vfio_rom_read() can leak uninitialized stack data to the guest when a read occurs at the end boundary of the ROM BAR. Fix this by initializing the val union to 0xff, matching the ROM initialization pattern used in vfio_pci_load_rom(). andrey.drobyshev: This commit is cherry-picked as-is, with no modifications, from the upstream commit 402fd5a75659. Reviewed-by: Philippe Mathieu-Daudé Reviewed-by: Mario Casquero Link: https://lore.kernel.org/qemu-devel/20260602074446.1206892-1-clg@redhat.com Signed-off-by: Cédric Le Goater --- hw/vfio/pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c index d930ef46309..fa2ca0d779d 100644 --- a/hw/vfio/pci.c +++ b/hw/vfio/pci.c @@ -1153,7 +1153,7 @@ static uint64_t vfio_rom_read(void *opaque, hwaddr addr, unsigned size) uint16_t word; uint32_t dword; uint64_t qword; - } val; + } val = { .qword = ~0ULL }; uint64_t data = 0; /* Load the ROM lazily when the guest tries to read it */ -- 2.47.1