From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from AS8PR04CU009.outbound.protection.outlook.com (mail-westeuropeazon11021093.outbound.protection.outlook.com [52.101.70.93]) by lore.virtuozzo.com (Postfix) with ESMTPS id EFA6380A83 for ; Tue, 13 Oct 2026 15:28:11 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=tOQYi89jRRfMZNObmSPgazjMOEL24h+AtUF6E34esbNizUq7QYZGYmx3HI9WOM/6THTGofap35ctc3MtnltQ0iqpcGRQF7CwsMIiSEdxAuqLVvOaFsdOuXYBiHL7DYJyMcn0JUgYIEjGqxe6Gm5sOgqo6MfDfUBACfhzkfAgbEnkXRj5MSWW0fsnaPXfv+AN1Qg9mUZqMFdLqJ5LYU+23WAaX53q1BjnCfInuv0kJ5Iq98vY3wHyCjaiyQ1RJa2TweiswfNFt03L1tcsgZ24QXMnIj3kIGdA4o1KXOGRbQReHQBkdEQ53YyIKTljfFYUQYS5Dqr/9DowfhJSXt75GQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=9n/f58Cfww7ExcwPHWCumaxgk4jzvGlue5epPFjzeyw=; b=YGVfir1vARbI/kqbeSPyE0b5brKz0d+/9bMu/LubrzoyghxLDV7UaQCsrlsoRz3CTqNhMcRK9SBw2/2SR3WRy6dK/e3DP8wtKmSC1XJrAjONeoSPXo/csAtO8zHyT7cr9SryHxObp1iNEb6zgpcbtYwRqtzAK1NMyB6g/uvjW4rt7wga0au8Ez+jnVURGkQ1lixQyMvjxBi+l7GIt1qZiarHyBK4eu0xQVmV+JB0IXqX10o1p/+ihzM++CRrApi1wXnRTU2i+zX9qKVPCBgQCydbES52euGXFOhZG2Z2K9ikWP0WsE0zf+bt/FOZQDUM4ao1Bll6EMmcRze8P5iAvA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=9n/f58Cfww7ExcwPHWCumaxgk4jzvGlue5epPFjzeyw=; b=wrYZBH+hQoxP5/hm/qAG0YmweOw1fGKvw8XavI+GifjVP9DXDLYj3wZ7JSx3HAH1bdTsVIpB9P/PZZ823Y27X79HxZaBrcDJMo5Ob6RXFjvYJESiWvEF3pX0IyIKRJHIrxncirE2tD8sRZ2lpu4vbKX5neU2Xs4R6BcJEjZEPT7OOVYW4xWF0zm9kFRfZuYZgYZ60Qy6kKzEizcMj3SqI11yxkhc+pGCr3ROO2Tq8D/m6R5fL8VNUwm+6h4lUzDaEUcLdLDLVbhVXhQFcgTsbzTXVS46MwUrk39zr+p8ZZL288Y5hUPyb0cnaP0XN0V3vN4dJqkef5D9FC4/KmE3gA== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) by AM7PR08MB5448.eurprd08.prod.outlook.com (2603:10a6:20b:106::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.522.11; Tue, 13 Oct 2026 15:28:10 +0000 Received: from VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8]) by VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8%7]) with mapi id 15.21.0522.008; Tue, 13 Oct 2026 15:28:10 +0000 From: Andrey Drobyshev Date: Tue, 13 Oct 2026 18:28:07 +0300 Subject: [PATCH QEMU HCI-8.1 v2 03/24] vfio/pci: Reject invalid MSI-X Table and PBA BIR values Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Message-Id: <20261013-vfio_v1-v2-3-433455c0a294@virtuozzo.com> References: <20261013-vfio_v1-v2-0-433455c0a294@virtuozzo.com> In-Reply-To: <20261013-vfio_v1-v2-0-433455c0a294@virtuozzo.com> To: svt-core@virtuozzo.com Cc: andrey.drobyshev@virtuozzo.com X-Mailer: b4 0.16.0 X-ClientProxiedBy: VI5PEPF00000939.AUTP296.PROD.OUTLOOK.COM (2603:10a6:808:1::833) To VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0PR08MB10656:EE_|AM7PR08MB5448:EE_ X-MS-Office365-Filtering-Correlation-Id: 2de2a41e-1351-4885-84b8-08df293e9666 X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr List-Id: svt-core@virtuozzo.com X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|1800799024|52116014|376014|366016|10067099003|261009223027099003|38350700014|5113699003|18002099003|22082099003|56012099006; X-Microsoft-Antispam-Message-Info: UjuARC2MfIpLgwWk6qa1HiPGuANIO1ristAvd6Ww6cQ8z2Tv9FSFHZDjdP6WzDtrXZA/xOoq4YS/fV0/dDggwKYgMYcSNcv1Qb6FAOTvM3Ih59M8IgE1YJNViDeXMIYtgPeekDIpge0ucujRkWzJ8SZauDbaz8IovvbfJy3Bym2xlBmpfwUaookHnn5KFlW8YyUnGyCISy7EK7jA5mWwiohFS0z3txPAu6n7RhHbF06AF/P7DtKzjS/V79z1dQEVqIariddwIStg0JdfrS+Gc5SFEOE0N/QsuqHRugOannKzIXJEZIKyeAUpPb3JNVAagd1JW3mn793wIcRoQW3TGrbWij3P1SHh+YA099PtdaVv4jKj/EhEyHXNDcf8+9EjRH2v+dfuwvmVcJsq3WS0sp30CTtQkuCfPGCBYtd+Vts39dN6j7/we/FKSvmxwz72N1Hra0lz7a/08jCZj8736E9e7gdZt2BUczABcwFAOuXBUNSS8BtWJfuOxM82kezMkFcJ95ZAxfB/8VoGddfxbiGwd9BnDCt+NXBLdo+9tSvlSBwCbjTzz2EwZXG7KiCwFEfbfymvHMF5n7l4uQkUiwaTUBNOylLXLNxYDm/D34gwosDJzE+YYGb+VSnWWyGfmEBQXzRhODSh8wdskOMNol6jkLDwvdBE3VvUqcZBFlk= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0PR08MB10656.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(1800799024)(52116014)(376014)(366016)(10067099003)(261009223027099003)(38350700014)(5113699003)(18002099003)(22082099003)(56012099006);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?eEdwUUxZS2V4bmpzVUY0Y2dZc0wyYWVZbnhxVmQyUk1iOE1lYkpKRUxua01C?= =?utf-8?B?c2Y5dzI1YlVqamJCZkRjUldNL0hMQVY1cE13YzVlcUdybU9GZ3Nza0lvYXh3?= =?utf-8?B?RC9pYlQ1ckhrZXdLTXJ3ZjNKYUhpQTZnV3Z5cTlkcUhRcDZiRm5RdHNnZTNw?= =?utf-8?B?TTEzbndoZFZ3b2pnSEQzTjR5VVE2bVJZSCtFdXhoWVlaNVBFMVRlcnYrTnBM?= =?utf-8?B?eE9yNjJkbmMzUGFwL3ZBTEQxdkhKZEdwNXNuR3BvNDZnTjNHM25INnFSVXh2?= =?utf-8?B?aTl0a3VSSXJjUDRlRzZjU0JaWGl6WmhYblduYXQxVE1HQjY5U2ZxbnA1cGdo?= =?utf-8?B?Vno3dERSaDU3TVYrejNMRG5SQUowMzZlbmdHYmhMOUxvK05wcUxMWjg0bS9Q?= =?utf-8?B?bllXaGdpM3VwN1RTK2xzN3ArVWZQWDdrdmtHNUdJK0xGdkV2UHI2VWxTUFZo?= =?utf-8?B?QTdXVDdSLzI3c1djd1FWbXJnUk02SGZhaG5HenduUmNrSUxLUVp5L0VGSE03?= =?utf-8?B?TG9CSmpDczhHUHg3TEtPVkRPRzd4Z3BFYlhCK3dwWERyY1NjS2ZGdk40bjhP?= =?utf-8?B?cUpIbW5hWm50RktVdjNDZ0I3QWQ4S21WN3NZVjVZZmNYRjJDVWloa3dIMWo3?= =?utf-8?B?eTZEdnFidkg4MkRrMTRIVldzMU4rSTRYTmd3ZnFCcjQ5ZFQxaHVpZkRsSVpD?= =?utf-8?B?ZkFzUEFDMG9sRy9CQXpNSDJKeFB3UWNqU1JnMmlIbzgxNTFFczJ6T3pZN3kx?= =?utf-8?B?V0xyemM1eEdZamE5UCtKaE9TOHVXbW5NRjhyZWlIZGdwZ0FtaFdOTFBvY0RC?= =?utf-8?B?VkhTdEpucUFrcU1ZelRTTEdJT1JkMVBWa1I3TWZZMlZTdUNFU2NTTWk1OHg1?= =?utf-8?B?NkkzeGdTcXpsVkw3T21mMEJTS1Urd05XUmR6S0tpQlNhZFZXRnNySW9EOWNH?= =?utf-8?B?eHlDSWx3K2FZVytvb1FLL3VCOTU5N3JkS2Q2SHcyMVYwdFZyTWZCNGxiaVJz?= =?utf-8?B?U0xyOGR0ZjlGaU9WYkJBbjd3SU1kSlNISVhXMFR0OU5PRlUzUUVYTE5Wbm0z?= =?utf-8?B?VnEvY0c2T0dVUUpUZ0s3YjNYM0lIdlJyMmVBdHVmZWFqbXFTeW9Jc1hSdTV6?= =?utf-8?B?SkpRalNBVGo2ZDhjYjNpYm8ycTA5SEtYTjBSMzRFUnFISEErMFd5YVkydEFz?= =?utf-8?B?bEVSdGdwb0NKa2NVV2NCSHVyR3BFSHdlV2lxOWVTTlJjQlhqeFNHbU91Q0VK?= =?utf-8?B?RzFVWUxiWVNYNm1GOXNYemxycEN6NWFCMTFoQ0lXV2R5VFBvZCtvcVJhbEg4?= =?utf-8?B?aWwyTHN0cFROaUxQb0ZFbFI2b0xKY1g4NmNIUEhuajg0Nlc5aGN4a3hBTzkr?= =?utf-8?B?NGdRVXFzRnQvZ2tZR0gzc2crTG16blhkOTdrTGFXaEExRzM0L0tmUmlNdlhw?= =?utf-8?B?VzJ3eXJOeEkrdTZlSUk3TElCWVVoOGIxTnJjNnJjd0wwNklLZmFqRnNQSUhU?= =?utf-8?B?NUkzU3A1cHRNeXhaTDF3QnNNMnkwL2cyM3BaVjdnTk9hcW9Dc1JrZ0ZuZEYx?= =?utf-8?B?cDNpWTNFV3VjbXVKN3R5V3VBazJEZUh6NStDemR1MmE2YzczUVI1M0RlNVJ2?= =?utf-8?B?MTQyaUJoWTZJOGp3NzVSdVNMQWhpeG9OYzJRYndlN3lIcXVoYUtWcWsyL01C?= =?utf-8?B?NG45cER5N3dPQ2xmd1RmeUg1Z2ZwbVp4M1AzckxReTk5UlJZb0dFcEpsSzhy?= =?utf-8?B?U1ltWmRrZVBnUTJQTWwzSXZUYkxiVmtpMDEvM3ZrMDJ4bnN4ZzlSdWpOUCsw?= =?utf-8?B?SWxkemZrVnF2ZU9jcGR1SDZMa29DZk9na21sdzlaNU1jajRmOTNOdGc5ejB5?= =?utf-8?B?QldXWW96c2ovU0xScC9xT3NleHZpWXJuQW43Q1hUZisxTFRSb1AzTi9qYlcy?= =?utf-8?B?anhEV25LbDdtR3o4L0RvTjR0aEtES2RGbE5lRXAwUUZ6WUc1SWhVcmdiOTFt?= =?utf-8?B?dmRSMlZJS2gzZXpCdzNDRXlUUStWREJDaXRwQVdhWXo4dEx6NkVmSGZ4M3hq?= =?utf-8?B?ZXIwVk1EZzNhcEdSMUNzNVNKNmlnTU13dVlqMFlPV29rQ3hxK0ZDSzd6dDl6?= =?utf-8?B?Yzg4K2QyRFpSZGpXSngvSnFRNUEyRk1FcHBXTEluVDNQd2ZxYU0wZm9Fd1FQ?= =?utf-8?B?QSs5Y1IxN2dDaEpmWTBkeWZsZHlZcExXaFQ0S2YvY2w1b05LNENrM2hWTE5Q?= =?utf-8?B?ak9SOXg2eWY0RHY1WTNveFRVOWJsdXF5K1IwbHh3NE5KKzVWcDNhREZnRE1Y?= =?utf-8?B?RUlRTGdvb0ZQbmtxZXp6Ylc1REdrb1lOUVJxQ2VxTk1sc291UVJ5eG55YUhW?= =?utf-8?Q?ATlJWk9yL/iMH3g8=3D?= X-Auto-Response-Suppress: DR, OOF, AutoReply X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: 2de2a41e-1351-4885-84b8-08df293e9666 X-MS-Exchange-CrossTenant-AuthSource: VI0PR08MB10656.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 Oct 2026 15:28:10.0455 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: /aRD43FVFzZz686jMgPGv50su5Rpii40zpNdk+sU3SajTd9MlnhKfyVUR0vKeZJcVatSJLIHDykRyaV43bE1OcBzK7bxbElSK4KHJm4Nhcs= X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM7PR08MB5448 From: Cédric Le Goater The 3-bit MSI-X BIR fields permit values 0-7, but VFIOPCIDevice::bars[] only contains BAR0-BAR5 (6 entries). An invalid BIR value of 6 or 7 can cause an out-of-bounds array access (CWE-129) in vfio_msix_early_setup(). Add range checks immediately after extracting the BIR values. andrey.drobyshev: This commit is cherry-picked as-is, with no modifications, from the upstream commit 9daa7347ff25. Reported-by: Feifan Qian Fixes: 65501a745dba ("vfio: vfio-pci device assignment driver") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3878 Reviewed-by: Alex Williamson Link: https://lore.kernel.org/qemu-devel/20260706161334.2165482-1-clg@redhat.com Signed-off-by: Cédric Le Goater --- hw/vfio/pci.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c index 5e281b2e1d9..d930ef46309 100644 --- a/hw/vfio/pci.c +++ b/hw/vfio/pci.c @@ -1791,6 +1791,14 @@ static bool vfio_msix_early_setup(VFIOPCIDevice *vdev, Error **errp) msix->pba_offset = pba & ~PCI_MSIX_FLAGS_BIRMASK; msix->entries = (ctrl & PCI_MSIX_FLAGS_QSIZE) + 1; + if (msix->table_bar >= ARRAY_SIZE(vdev->bars) || + msix->pba_bar >= ARRAY_SIZE(vdev->bars)) { + error_setg(errp, "invalid MSI-X BIR, table_bar=%d pba_bar=%d", + msix->table_bar, msix->pba_bar); + g_free(msix); + return false; + } + ret = vfio_device_get_irq_info(&vdev->vbasedev, VFIO_PCI_MSIX_IRQ_INDEX, &irq_info); if (ret < 0) { -- 2.47.1