From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from DU2PR03CU002.outbound.protection.outlook.com (mail-northeuropeazon11021102.outbound.protection.outlook.com [52.101.65.102]) by lore.virtuozzo.com (Postfix) with ESMTPS id 1308C80B97 for ; Tue, 20 Oct 2026 16:30:58 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=KpYLv5TiaCCSHVy2GMCTr6P2WJmQtDfBUqtwKmYB0j7Dk8KeAB/kkIt5i7yqjZXff/b8VckNsAj6j9gjIGSZeLmlrO8moYi3kIZ3V0If+BJYV3re4K2h5UJsYpY+n6AaE3OluPAy2JV0yDL3/y/7uCJZOewJ0roFY0nBHFczLBAUYdZEIBX42+/UZUwglpzn98B1IeF6AW2K29RCfjK4KgtUakZQJLLWpt7heyqEawBUn3GvwBkDci9nDDEy5e8rIheUkBH0NGngZcDx0t2df3Soy+FnmzTS5m30o2KBh/ZYilQiD0WMz5458AODHvu2pJbgFIldpCQjH7OYC2npww== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=9n/f58Cfww7ExcwPHWCumaxgk4jzvGlue5epPFjzeyw=; b=hd+JCe2TgrBl2LKywPvATBWaIRd/n0QFjvli6ASu0VEBUqriT2WE/uvAi+W6GhN39ReNtqfy2tdm0gtIcjExMh+FRPQV76lQBxvCINhuFs7L+HDt4ZP2AKoXb6UONddLzt/LtTSrqNp1GIgpFCz/+yYk0WavQIL95cJDzp1IgR3RDwwsHJsptsBUc6QRsXp+1mtWnVW/PGeUIWxTOR/rkFwsIDOQ99GdzxWw28Ab35Eu7jij0bRtWFpf/srkbzXd5EQL6BlItMWhsaUqdDHQDr1FlwydW/0mMqQNqISFaBrc39teKmkbx+C7N1CXm+W9L6EagkICVTU/V8f9fnoGuw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=9n/f58Cfww7ExcwPHWCumaxgk4jzvGlue5epPFjzeyw=; b=GDpxFxcTcFAdUaiZcRv9lRvztX+BBcqgs980tbxzDnKyWl/7oXTJO8bRTGpXp1TYB0BRrcm2/Ke6on2bXuroOy2evNrQmoyJ9KkJjgNc2dIMSzBRqhgDYqCx0ptevoDNFgCwWGsUaFv7VTdxb+JXxDccD0bZYxLAqv+IdGkxLHV+unojPBBuCEg5wLD5acbT7G3KdzTe5TCQnI8h/IE+/CxZAl9Lw7pzvZh5MouhdrmnA8Uz4FwxbKNZj+oKGpZfbpEiZQssxmtI0b+a7QQ3pc3ocq/ivPEMUS/jqJtkiES6jxoiRR3D4jCdB7EZ2/vb6R389BVS5nSuU8BuJngaUw== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) by VI0PR08MB10683.eurprd08.prod.outlook.com (2603:10a6:800:208::8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.14; Tue, 20 Oct 2026 16:30:56 +0000 Received: from VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8]) by VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8%7]) with mapi id 15.21.0546.012; Tue, 20 Oct 2026 16:30:56 +0000 From: Andrey Drobyshev Date: Tue, 20 Oct 2026 19:30:48 +0300 Subject: [PATCH QEMU HCI-8.1 v4 08/31] vfio/pci: Reject invalid MSI-X Table and PBA BIR values Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Message-Id: <20261020-vfio_v1-v4-8-83a5668230e5@virtuozzo.com> References: <20261020-vfio_v1-v4-0-83a5668230e5@virtuozzo.com> In-Reply-To: <20261020-vfio_v1-v4-0-83a5668230e5@virtuozzo.com> To: svt-core@virtuozzo.com Cc: Andrey Drobyshev X-Mailer: b4 0.16.0 X-ClientProxiedBy: VIUP296CA0056.AUTP296.PROD.OUTLOOK.COM (2603:10a6:800:34b::14) To VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0PR08MB10656:EE_|VI0PR08MB10683:EE_ X-MS-Office365-Filtering-Correlation-Id: e123e83f-0102-4d81-4433-08df2ec782ce X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr List-Id: svt-core@virtuozzo.com X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|52116014|376014|366016|23010399003|1800799024|261009223027099003|10067099003|5113699003|22082099003|18002099003|56012099006|38350700014; X-Microsoft-Antispam-Message-Info: teBBiT+Grh0G6ooQ3fuDP89TODOYG/vShZPuoXZdI2wJlCdUOueY0qSyQmAZP/86ZVIthxNBfeh+BwTuOLq5+HCo2wQo4cDIOgrc1aSnR4xGR4AqdGCA3LcJBu7S4ixNXNmA7Vy9HJ+eE/mhg8GtzdCWirIIZeoetrxo+eJjcTe9irrdPuZUdWfHdeuiJaGKmbyt0N2uj79IOVOsidbrZWXQsNs6064U8P2B9TGShTuDvC+fWP/FjhOv79A1deyITX0ZsSKADgeISJ/HuJC3no2RGzmTYdXA+KDVOALZRnzBXzRPa313CyJnW00M+VBm/qlGjZSi4AF5ox26SwXbk0DO7JeDxX5sH2io0akhunm7SDQlFmiQdfgUUandC+BEcxcvVlM8QnxYDpqE1K9G/jSz/4mUQvSEK01E8jc12e+XFSNAfFDFPT2EI3zaOpEN+jrNhnGQWpOt0i9gW+ZjboyTU8vFZbpvja/fv7Dp0i1XqowAUDKk9Ap407SeZdK2fZarPZhsnz7AFM+O6k37j3AvNl8aGkBJrMkioMn53/xPvCGk/wgp7zQxQPZj+nSq/rA8AsssM8BrG1UF2p33I8aeazcpu7SJPcg5PPXDJx9qr28SvyHVvywaZ1NszzyiM92aUGKmTNMOQzmXGT4aUgxxaQ0DHD01psiDjm/vL90= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0PR08MB10656.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(52116014)(376014)(366016)(23010399003)(1800799024)(261009223027099003)(10067099003)(5113699003)(22082099003)(18002099003)(56012099006)(38350700014);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?TnhhK3BNRFJyWFVPbHpadzRmSGlCZk10YjBUeUFxbWVxVGFoQkcxYmtKSUdx?= =?utf-8?B?U3A4M1RJMEI4aktUbmY4dVk0M296enN0VFBpVXRvbm14SXh1T2lFZUdzdEl0?= =?utf-8?B?VkFua1EzajJjWTJlemwwcnozaWN1R3NqeGJ6M0NONjBYdys5MWNHMGg4eGNj?= =?utf-8?B?K1FqRmVBS09FQ3VtODRIUG9VSzFEUjBDSFBZY09JaHNQZGV6N3hsbkNraVlk?= =?utf-8?B?RE9TWFdEeGlQOEtoZHgzYkFDQjJ6VlEvSmlKNU1CZkRkZTc2eHlZTmo3SjNv?= =?utf-8?B?dHJCZWNDL2NMeHJERHJhMWxWQUgwekhFeHNrbGtDOGN4c2tvUnpwaE5VRzRG?= =?utf-8?B?TDJWRnNPQXdMVkdselJYU0hKYWVaN3cybG52bGgyaXg2VjBFbXJuOVR6eWda?= =?utf-8?B?Q2F2ODUvU2lrblhKczZ4YXBvMWQ2cmliR1NvYjZxaHVKUFYzbzhxdk43WTBs?= =?utf-8?B?SWZlaEg4eEc0UGoyWmZYRmU0My92WnFMSWlRVENpMVRzeGFGeklWcjVzeWFJ?= =?utf-8?B?SVdBYktoNUFSbitvZWpzYjR3VkYvNk1JV3BESFhKSE0zRTZyb1ZKWWxRa01H?= =?utf-8?B?c0N5WVVlYVRCRkl1NHJUekVQK1pLTUZhbXpPY0RaQUFKNkloRzdXWTUzRlNu?= =?utf-8?B?NHJCcXRlNExDa1hoRHZseHdObFVqa2wrcURXMk5OQVZWVUVRVTZiTERwN0lm?= =?utf-8?B?d3VMMFNaNUZxTVFxK0wrUk9UYkhOdTdBZlptN08yUlQyME12K0RCUS9wN3Jz?= =?utf-8?B?azIyQkNqSWZTQU0xY00vNUM3U2ZhQ0xaY2VGM25zY3d4dkRGTS9scVVOTlpS?= =?utf-8?B?K3BVNGpFZzc1Y0dyWTBmYVhqRjNzZkhnUlRzcTVNbDdDMGkzWWVhYSthYXFm?= =?utf-8?B?Z21JdnA5YlhWWHFCdnBrbTJSSG0xQ3ZPc0pweHpsOUpUVElsUlM0eFVFL2Zk?= =?utf-8?B?ZzJtOWx6V0hkRUFiWi9pb3A0UFFScUx4dTNjTDdZOWY4WUFOMHlBVXg4Vk5M?= =?utf-8?B?RXM5cGw4SGoraC9sQ1lVUC9WRFRFQlUvRGJ3K3JkblVYeGJNM3ZZZkNDUXZ1?= =?utf-8?B?dUhrK3ZhTVhlTnpUYWcrMTZ2YXNjLzNoMk1DZlExMnMvUXdqQW16a3J1T25D?= =?utf-8?B?UmJJWlZDemRDZnZvSzRSM1JXOHhuSkRoaGNjZnFnZFBVdy9rRnJoQkdJNEgr?= =?utf-8?B?TnBzY2tnd25CSStHL3NFSHgrZ241aU9ka3RvcDRQKy9FRGx2blUybEMwZzdU?= =?utf-8?B?UFJlY09JR3UxNjdKd1BvcmVuV0xxRkpjUjNBNmZhZHdFQUh0R3h3Z1k2Vysy?= =?utf-8?B?Z0tRYjFZNlBtYVZsL24vbXNwQUdycCtmaHlvMEt4NlowdmdVRmx4enIrQ3Bj?= =?utf-8?B?a0J1RFhVVHRhU2E1YThIUEJxeUJkMkgxdlhhUW9mTnBJQUxnczZKTUtBWlpK?= =?utf-8?B?Sk9hdlI4bHg4WFpOYkxONVF6U3lTaXIwWUpZT3lJRWpHK1FNb2dlaURUVTFw?= =?utf-8?B?cTJVSmY2K205OXErS2RET0VSY2d3WFV2ZHl5czZqSVQvdEZVWGtUVGl6Nllr?= =?utf-8?B?OWpJdHREQWo2VXF6SnQ4aWNiRWlSVWEvdUtqR0c2OGU5a0lyd1RqenVtRllk?= =?utf-8?B?OUNrN05YZ09IRHZnYzBtNkFOK1lsdnl3Y3l0czJhUCtvSXh1MThPZ1UxbGxw?= =?utf-8?B?c2VOZHpmZ1dFS2pTNzQvVnV2T1RtMCtkY1pKaUltRjJhZEQ3RExCTmwvbDVD?= =?utf-8?B?d3Y4WVpjcFlwQU9HdzZnbkhvcEVGeE93NnlPUWtQL21lYy9EU3pCVXl4SERJ?= =?utf-8?B?R1Rjd2JXUXRGWTNveERPUjZrNFd6NkNmSkt5NFpFRTM2NTlPbE5RZDIvYnhI?= =?utf-8?B?VUpOUnA3OUFjb1dUNXd1NEl6dkhJYXdKc1RuYWQyQTNyM2JYdGc5SGNSV2Ji?= =?utf-8?B?UUVGRlhaMFlYVjhURmhtOCsvdStPdHVqQjlQUFhqQzk3ejRGWmhLb0VKNmIv?= =?utf-8?B?SFYwVkRZVTEydUVhb3dUOGJ4NGJMZENXLy9MY05QQVJ3U0hZTmZnaysvZmw3?= =?utf-8?B?OTNzLytKZ3RZMDVDZFlnNWllaGZVOFVFSU11dC94SStnelNhWGQ2REJnQ1hw?= =?utf-8?B?aGRpdDl3OFk4M1Q2MDdUcHFNYkRqY20xUy9Ob0xROC9nYi9Fc00rQ0VHSUZx?= =?utf-8?B?YklueE52bHJMb2hzUDF3QzFSbTFTRXNuajZRcjdaWnlDMHdRSUJGZmlXYURr?= =?utf-8?B?SFlJdzB5VWZKZ2xlZVRqQjh4NzJENVprbGhXUlgrLytOSytVaUxMdVptbUZ6?= =?utf-8?B?VW0vY3oxNHF3NXJFUEU0a1hkRSt3WGE2OGQvMUxKNEV1aGxSYVowWkc2TzJE?= =?utf-8?Q?8TcKugxkB2j4NIYc=3D?= X-Auto-Response-Suppress: DR, OOF, AutoReply X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: e123e83f-0102-4d81-4433-08df2ec782ce X-MS-Exchange-CrossTenant-AuthSource: VI0PR08MB10656.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Oct 2026 16:30:53.8569 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: OCJ2DEdSBwsLcQL7fyjga9a3b6P6OR9FAZv+zmivcLdVrfTN4bw7sljoNDaSX92F66exdx19iFLCCYRO56QiwXsuepGbtAOAKugdGtFWzWU= X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI0PR08MB10683 From: Cédric Le Goater The 3-bit MSI-X BIR fields permit values 0-7, but VFIOPCIDevice::bars[] only contains BAR0-BAR5 (6 entries). An invalid BIR value of 6 or 7 can cause an out-of-bounds array access (CWE-129) in vfio_msix_early_setup(). Add range checks immediately after extracting the BIR values. andrey.drobyshev: This commit is cherry-picked as-is, with no modifications, from the upstream commit 9daa7347ff25. Reported-by: Feifan Qian Fixes: 65501a745dba ("vfio: vfio-pci device assignment driver") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3878 Reviewed-by: Alex Williamson Link: https://lore.kernel.org/qemu-devel/20260706161334.2165482-1-clg@redhat.com Signed-off-by: Cédric Le Goater --- hw/vfio/pci.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c index 5e281b2e1d9..d930ef46309 100644 --- a/hw/vfio/pci.c +++ b/hw/vfio/pci.c @@ -1791,6 +1791,14 @@ static bool vfio_msix_early_setup(VFIOPCIDevice *vdev, Error **errp) msix->pba_offset = pba & ~PCI_MSIX_FLAGS_BIRMASK; msix->entries = (ctrl & PCI_MSIX_FLAGS_QSIZE) + 1; + if (msix->table_bar >= ARRAY_SIZE(vdev->bars) || + msix->pba_bar >= ARRAY_SIZE(vdev->bars)) { + error_setg(errp, "invalid MSI-X BIR, table_bar=%d pba_bar=%d", + msix->table_bar, msix->pba_bar); + g_free(msix); + return false; + } + ret = vfio_device_get_irq_info(&vdev->vbasedev, VFIO_PCI_MSIX_IRQ_INDEX, &irq_info); if (ret < 0) { -- 2.47.1