From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from AM0PR02CU008.outbound.protection.outlook.com (mail-westeuropeazon11023131.outbound.protection.outlook.com [52.101.72.131]) by lore.virtuozzo.com (Postfix) with ESMTPS id 7B3648017D for ; Fri, 16 Oct 2026 15:26:13 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=QIiJGd/6rKcz/ugY4CH8Noly9fY4eelopMNnGuEBswADHGJJNdiREpty8r55U0fvLkAukqwuMJ+JFaGakjgKxJGlUvDV5dVCR/gxYIl5HEMYvahbukR2hjppKlAGluVIJ82kmfllNM55qea/jfeR+ePD1G2AuiOVl+ElUz36NP3FdKxSnWVNvLW3U5FNzxEQQ6AnCbyVNFqiHis96P4hU10cZ/O6amGN7MXTSJKeEN5QW4z/mQ4v8TxWAwCr6uqUXg3VoWzh5UFLkedVUufUubqoQDBVUYXDmY6bFdXg0vIZO0QzDZNZyfMCATZ+6+22C5NgRAnTqPpHV0tI47ypvg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=9n/f58Cfww7ExcwPHWCumaxgk4jzvGlue5epPFjzeyw=; b=xsgXlAwxkSaERhFcHQslviwhaTVBqneHZNerI4lxnJaWPE+7XsXtXccgJjz9anMhNBRAwU5P1P1E1TTyKVOfLCgnPbw68aZVA7hbQ/Z+BNelwNo0ZC4v+T4uOl/iMGQg+JANCrpMOflYlQqS4a9QFDGHISNHf7QuA63MUph4DUrU3yTVzoWvcW3e35qVUwqJCla3q7ic1ltkhPIedO+IjMZ/3wPYpUDVdhR2KDINiS3C61Lqy5YZoA2EnbXexraCLEzsVNCFhKSzwH4QtFf1erG12p0jQJXewCcVtygAzPRmyIQr78YlX6bAv0Nf61/QJmLf8KqHagKRwiJYw0O8Tg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=9n/f58Cfww7ExcwPHWCumaxgk4jzvGlue5epPFjzeyw=; b=q68GdHqFmCEftSULyXwDUaL4ArmeIqZ+M0RLovG/1EWq14+d2cfb/YWn3pAywEKJ29nxvwnLMhbk5OmtfFN0zJiBwj/TCLBDPAK7TXiHRer2wURv0PkQX+412vb2v8+r28peTDXhThoCJQNk02SYCmoyIPgzylyA6asFeCtAUo6WFSsJPJ0eXmWsum+31abFKLUwnaUemlz+xjkKSS+xV/VJM0YaGaNOsx+78hK6kEZ0CRL5w78OUHmQGh4gDfbfL9qHcNzXZqbrCKj2BgpsbXvW2YjXqqLCK75m4kG+pi2Ajq5EucCvaOw5rgD4yKiw15bGMMP9etBgzfKuAGDkFw== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) by DU0PR08MB8907.eurprd08.prod.outlook.com (2603:10a6:10:47f::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.9; Fri, 16 Oct 2026 15:26:12 +0000 Received: from VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8]) by VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8%7]) with mapi id 15.21.0546.006; Fri, 16 Oct 2026 15:26:12 +0000 From: Andrey Drobyshev Date: Fri, 16 Oct 2026 18:26:04 +0300 Subject: [PATCH QEMU HCI-8.1 v3 06/28] vfio/pci: Reject invalid MSI-X Table and PBA BIR values Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Message-Id: <20261016-vfio_v1-v3-6-47487cb5a8e5@virtuozzo.com> References: <20261016-vfio_v1-v3-0-47487cb5a8e5@virtuozzo.com> In-Reply-To: <20261016-vfio_v1-v3-0-47487cb5a8e5@virtuozzo.com> To: svt-core@virtuozzo.com Cc: andrey.drobyshev@virtuozzo.com X-Mailer: b4 0.16.0 X-ClientProxiedBy: VI1PR10CA0088.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:803:28::17) To VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0PR08MB10656:EE_|DU0PR08MB8907:EE_ X-MS-Office365-Filtering-Correlation-Id: dfa8a8e8-2949-439a-4912-08df2b99ccf6 X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr List-Id: svt-core@virtuozzo.com X-MS-Exchange-Transport-Rules-Loop: 1 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|52116014|1800799024|366016|376014|5113699003|18002099003|22082099003|10067099003|261009223027099003|56012099006|38350700014; X-Microsoft-Antispam-Message-Info: bu4QwXvEyJdz/VXw7X4nj/64NY3kInS+4ATkOtPalUbLjELqzDv4jsdhHWU42Lts9ZbBg2YKIki/EW7UHfq2Id4R+GJhD0hrv4PDU/xDqzpxWxDQoJ0pS8dImUnHWdUcef8/aQxh1PXx3mP6dmGDcPOLYRSRPL1Th4O/5ICQn5ELH6fjvdJ1pwdxDzX9h+xki6KHZxXUiQDPZf0VddTnbUK2KrM2PgnXVhSwHVw1mbYikLZtUFujMtLmYYFUr2XKbchRZNGz0qkh1NsrrejKPt6gRPDgGnn72S3zT+wVZrks2P4txfu/qjPZsTzTJhpRQxvB8RuGPJcZs9AwctJWLE0PeFY/FHtoZOPOqVsxx3Qk+nS3NYay5Og2XUba4b4UvmGHLie+S/1hFfhYZfxVgYG+ze94EERErCYHLvg5jIbFXl1+79mXxktKCAp1xX8zVzWglndfsT1i+dZwvt/ItQPF4/azEFQBnrcbDfeTdWiAz2jylDkkSRDMOTsHW3+iLgVoRQgqGCNfCZMM55TFw5AZfG8UkszmwuoFcw1n7oNdOKydChO5OLfxqxptGtVoEhtNe/HQ9c8dplqIc7MVqWieKWvw+R1gdfKVBg1bGF1o63SR8cYyoihV03Ry7lm2UQutPvS6fPAGfgWtY2LJIN20C/cVv9fnDvPNLb1lbeo= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0PR08MB10656.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(52116014)(1800799024)(366016)(376014)(5113699003)(18002099003)(22082099003)(10067099003)(261009223027099003)(56012099006)(38350700014);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?NWpiTTJTZjJ5UXU3K3M0c0F2RHlBYUpuLzBJU1RFQU5sdEl5dVJZWHFMSjVJ?= =?utf-8?B?ZVBqZU5scVBxSjdrVEN1R0JGVWxkbWNLSUllS3pSeEtMSXNNMG9sMXBOVWZh?= =?utf-8?B?cFpROTNrWDhBZ3U4VHlOdW1FelV2Y1NvS1ZxbkQrTEpSdGdwM3ZXa3UxQlIr?= =?utf-8?B?am55YURNeUtNZmNTOFRCa3JQMEJ1bVQvdGc0dW5idkFtb3BPUkt0bEN5LzBs?= =?utf-8?B?S0VYS3l5K1loU1c1Y0gzVC9sQ2E3T000Z3JkcTBxTXZ5MUdXRlFLK0VhV09Z?= =?utf-8?B?cytVbUFkK0ZGS0hGbS9RNW9qdmdkSlRtbFZVUUgxSUpqbTlWWE9nZ2UrUEdp?= =?utf-8?B?aTdzVlZjV0h2K1NTNmgyOFlXeWh1MW9sQ0ZTMGU2Z0VFK2lIK0h5YUF6Ykk3?= =?utf-8?B?TzdXR1ZUK3lFWGxVS0llM2IyRXJrcFU3dWFPUjdyazBURUlMQTFna1BCMUdu?= =?utf-8?B?ZDZiaWhBeGsvOStNTTM3MkpKUm5wQTAzbWV1WFpESFFLYVcvakpwZHhMcWlF?= =?utf-8?B?WTJxWFFWbGZuUytGZzcwSzBLWDE4Y01mWUcwWWo2czloNGF4MUY3SVdJZkE3?= =?utf-8?B?aTBaUm1VeDdrc1dqRzdGbVVvQkNTcmdRWkRRZmdhVFE1SHVEN3pOb3o4U1lt?= =?utf-8?B?S0R1L2VnK2pSc0lEcVVxTTB1d2xwOUFLYmk3SCtsOUVEM1Z5aEFwZGJWV0Rw?= =?utf-8?B?TFI2aGc1TThPNWg3a3I3N1JZNk5nc3dEY05ialQ1ZHpYSllhVG4rVjdVR3Rk?= =?utf-8?B?cWRIS0xUU2J0aHp5NjBMMUNEdVJPNGhRQjFqelNHdXZKY3VVVFF1Ym5hcjBx?= =?utf-8?B?N255a2treURDc2pQZ3ZZenpoSG5LSytTZDQyajVjblJ4aFlaTSt4Z3B1UXlE?= =?utf-8?B?bzk1blBaNElqNlFMNDRwVnVGZU0yQ3QvWGlNbGNtUnlNUGFmZ0RjelQwazVs?= =?utf-8?B?dVRTZzBqMUEvTGh2eHZjVTBZcDhvSUd1c0k0cGRqMmp2eFlMQzk1Z3BVMkRY?= =?utf-8?B?cDA2aTFjM3oxWUE4MC85YlU1L0hkWVBDeVMvdlVlSXk1dE9Ma3dSZmVURkRX?= =?utf-8?B?SWx5b2k0ZE1QNnR4OVZicEpqOGZZN1hMdHF0ZWhUaFZwN1BqZXAwNWtkRXAx?= =?utf-8?B?cEg3TENHQVpETGZLNUpjUkZVR2M5VnAwdkNLYXd0dHhsVGY5cTkvN1BvWFRu?= =?utf-8?B?ejNQNEY3bXRsRjVsc0h6ZjhSSXFjb0ZZUG1yNkRnYVpkakRYSjBNZ0pBUzZo?= =?utf-8?B?ZjJnM3VqQXpiOXBmQ2d4d1V4YUZIYU9jNnNHekhBWEJqeUdQWXo0S3ovR2Jo?= =?utf-8?B?YmtwQitlWDMyejAxc09ZOUJUVkxFelhORVdpZ1VmdjUyQ25XbTYyNCtxaTZZ?= =?utf-8?B?Vyt2TTFETEo5Z09nQjU3SHR5TmFaS3NRRGJVUlBzUzZjSFBBL1VVTWFjKzdh?= =?utf-8?B?ejkrTlpvZGQ0eUpMTGlXVG1uQmdaQm1lQXB3VHRrbkIzcXNtcEhMcDVOWURL?= =?utf-8?B?K3FrQUhFeWFjcVRpYXdEN3pnemVnTm94OU90VVoyYkp3MFpTZm5NdkRRaWVX?= =?utf-8?B?QjBWSElnWDBjcktWU0g4YmlhRnVpK29XT0FJK3N3d2tvcXZRNGo5endYZUR4?= =?utf-8?B?MG0xeHJxazlLdFFpYk5ndzJNbHA4VnBYQnZsOEZWakUrVHl3R0lLdUp4VEpH?= =?utf-8?B?aU9kV2JHMjBwTDJwaHJuYlRGZkhDc0l6SGJvWDJXUGRHTmhGZlBiTWFVU0wz?= =?utf-8?B?R0w3ekpjVUs2Y3Z5ajNsc0NzdG5WMGxEUU43N0ZGTVpIbWdjL1MzRWk0bE56?= =?utf-8?B?S0lydTIvUURYN01PQitubkQ0ajNJNlVqRGl3NWNPUHNxeWg1dFFDZmNNc2xJ?= =?utf-8?B?Si9admoxTmZjTHR4d29Ob3ZXekJXck9LY1ZzN0N1NkFuOUsrSDRqemxUWnJG?= =?utf-8?B?dEVrMEhielRCN205QXlZN1hjVE9uLzZJTHZBK3FJVGJUaGxZTXM5VlFCeFA3?= =?utf-8?B?eTRvQXRCVER5TEJrZjM0SlFGdkd3SG00ME8yWXBnZmIxc1FlWlFaeVkxZkVs?= =?utf-8?B?Tkd4R2M2c01vZWJTL2UxblJheG9iL0MzM0FlMU5XcGRYb1ZPT0dxOEFidU5P?= =?utf-8?B?SmQ4RWJtMlIrMDBuOWpSOXVVVEFYdFhRZWNzVU4va3pQdlBtRTNhOVAydlFO?= =?utf-8?B?UFNhUXYvR2RDTDBTY1pYUVd0bGRzVGlaVEpyMDNqak9ZelFDeG50MG1MeDJv?= =?utf-8?B?L1JVUWxBcG9ZUGcrZExyK0M5bXEyMEtFRisvVzdScDEwRFlDejRNZjZlR1dh?= =?utf-8?B?emExVjdQdmNkbDJKaExYTnBzV1hOdzlHM2s3blViY3lSMlg5T3N5NllLYWlB?= =?utf-8?Q?g5jMNET/d6mRbWiM=3D?= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: dfa8a8e8-2949-439a-4912-08df2b99ccf6 X-MS-Exchange-CrossTenant-AuthSource: VI0PR08MB10656.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 Oct 2026 15:26:07.9858 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: iI5t3NBZIPTWUDRTEvzDGHoWbOI7z6PZsZFjsfPGlexgUGTRQjTVgFMtde39ppPyGkSilc3h3q8q60cSldEjSHw9RlNHt/9PYusvmDx/8S4= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DU0PR08MB8907 From: Cédric Le Goater The 3-bit MSI-X BIR fields permit values 0-7, but VFIOPCIDevice::bars[] only contains BAR0-BAR5 (6 entries). An invalid BIR value of 6 or 7 can cause an out-of-bounds array access (CWE-129) in vfio_msix_early_setup(). Add range checks immediately after extracting the BIR values. andrey.drobyshev: This commit is cherry-picked as-is, with no modifications, from the upstream commit 9daa7347ff25. Reported-by: Feifan Qian Fixes: 65501a745dba ("vfio: vfio-pci device assignment driver") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3878 Reviewed-by: Alex Williamson Link: https://lore.kernel.org/qemu-devel/20260706161334.2165482-1-clg@redhat.com Signed-off-by: Cédric Le Goater --- hw/vfio/pci.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c index 5e281b2e1d9..d930ef46309 100644 --- a/hw/vfio/pci.c +++ b/hw/vfio/pci.c @@ -1791,6 +1791,14 @@ static bool vfio_msix_early_setup(VFIOPCIDevice *vdev, Error **errp) msix->pba_offset = pba & ~PCI_MSIX_FLAGS_BIRMASK; msix->entries = (ctrl & PCI_MSIX_FLAGS_QSIZE) + 1; + if (msix->table_bar >= ARRAY_SIZE(vdev->bars) || + msix->pba_bar >= ARRAY_SIZE(vdev->bars)) { + error_setg(errp, "invalid MSI-X BIR, table_bar=%d pba_bar=%d", + msix->table_bar, msix->pba_bar); + g_free(msix); + return false; + } + ret = vfio_device_get_irq_info(&vdev->vbasedev, VFIO_PCI_MSIX_IRQ_INDEX, &irq_info); if (ret < 0) { -- 2.47.1