From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from DU2PR03CU002.outbound.protection.outlook.com (mail-northeuropeazon11021102.outbound.protection.outlook.com [52.101.65.102]) by lore.virtuozzo.com (Postfix) with ESMTPS id 39E1E80B95 for ; Tue, 20 Oct 2026 16:30:58 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=xDnHdyGGTPmkFVJSMQVzepJC0M2rto3KBbfL35tqVXGqJ5vWnmLignposRAO83hWSxjrI5ALEl8zXpiTtL2v8tGGu7uTOFs0TMuYD7XtVM1D5z09PH2MGApnKr/vLZAU8IvhdQ3jK8zVjwqZyNtp4iz6AOm3Wz3ZRcNsf0Kb/yAonVIHRs1VVmFIIxX+nLlX95wEmeX/OWS4Hc0Rb7W9HhPVOHMJ0xk4Sge/yWTy2U9MvG/241VwDef573hh+l3uCW/RIJG4DHkWHPaRdhvIRZLvThDOXeRQVr5Pyd1zWmpWG6XFb5RVmn8MchBLflHanBGMg0sMxappIdydh0a97g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=GpyZeuzxBx/9EXW2jB4YPAzv27x1rv066ytK047XXLA=; b=SxWOb03URFzAQz1/JbK/Ycvie2GtK3UC8dFYbPnurvB950fiSg2tyezsA4hYMgCafz6pZ/RzgQovPhEHC9aL6CxIKupGSoBXhtK27B7oFz+i7MDJj8iAgZ7b+44MOS4uLAK2HzhQ8zSoT+5exscF18469Fkr66szy5BaeC7T0j7CXoPAn0dEyy018uEE8lC7DIrWSrHZkLvSpXmK6/ohD0YW8DPPScFJjmklaWxZjQJdLPXgLh+GjmPMUM05w3jtBmppQQhtqNKWsJWAYV8DZVcKyBgHvE0msDQnMXilT/4rjnZl7YZYj4IiP7JmFhsK82vA//7SEJBeGKNc+4POTw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=GpyZeuzxBx/9EXW2jB4YPAzv27x1rv066ytK047XXLA=; b=dKQQAJFMyeC1qtB6bXf7PjkKbp822mmp5Z/xE0BMH71kvX9+7i9jp56mGLB1XclfXlSlbbCpfppk+uKpIhMU/mbeO0SK/dvpZxQ2n35BLLMfrSK5YEgome1R5ZjyPs2WzFUh0GcDWitq0wHZDAeZy9vwSfQPFFUQ9Lm5QShuQYKr+49uHOy1kY8sAjgbiE94kNp3+RHF2IHNNhcLaGKziSyAijKAPwYLOOv2k1DP4ubKi4Eckqw0sAxDeLC+0lGNQWgZrt6M/SV7CrnnJj4I4e4rusptC/W39OeuiY5qjxBNmwJPdVVjse7f/JFjHHT3TTUvPHRV9cz+wOg06QQ9NQ== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) by VI0PR08MB10683.eurprd08.prod.outlook.com (2603:10a6:800:208::8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.14; Tue, 20 Oct 2026 16:30:56 +0000 Received: from VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8]) by VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8%7]) with mapi id 15.21.0546.012; Tue, 20 Oct 2026 16:30:56 +0000 From: Andrey Drobyshev Date: Tue, 20 Oct 2026 19:30:49 +0300 Subject: [PATCH QEMU HCI-8.1 v4 09/31] vfio/pci: Fix information leak in vfio_rom_read() Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Message-Id: <20261020-vfio_v1-v4-9-83a5668230e5@virtuozzo.com> References: <20261020-vfio_v1-v4-0-83a5668230e5@virtuozzo.com> In-Reply-To: <20261020-vfio_v1-v4-0-83a5668230e5@virtuozzo.com> To: svt-core@virtuozzo.com Cc: Andrey Drobyshev X-Mailer: b4 0.16.0 X-ClientProxiedBy: VIUP296CA0056.AUTP296.PROD.OUTLOOK.COM (2603:10a6:800:34b::14) To VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0PR08MB10656:EE_|VI0PR08MB10683:EE_ X-MS-Office365-Filtering-Correlation-Id: da48dac6-7d90-40de-b247-08df2ec782f6 X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr List-Id: svt-core@virtuozzo.com X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|52116014|376014|366016|23010399003|1800799024|261009223027099003|10067099003|5113699003|6133799003|22082099003|18002099003|56012099006|38350700014; X-Microsoft-Antispam-Message-Info: r/QK/rJ/qbxbRmEs6t4TUOaRMoqhBnDD+AGXr97tX/c7e0fn0SDQ3BLNxGrdHK3K+gTy+Bwxu9LbTjENsDnNlpWonnSdwaYwe6ee9EP9NMRWcW1MKagks65v0o9JTlIT+HBiPzGf+8DHjmeiPeImtp7ClbK9bcool4+SGSxxjhAQQGYDHRxD7/cpNtRJDxSXNx4maK9EsMmUeqHJLM6ncjWc/wxdd9xH+5LbLV9cgEPXG2XMDC/p9fs4BNugQqjtOUXpOqhsdcBTEGsqJ/dd7Yk95MEKh+Pw7nKpzyo3YJo3jXzm5DLmA8gZUV7ZaBPF+zm2fS44IGOpX87FV5bQrKVvbbqMhTeLakjd1KS3YFvmF8df1Q2idZtq1wetenoKhxAhlMX3YsdhuiHnZhtMT49BYek8JexTv1Jwe/QFKiA3S+GSUsea1Z4R0uOZzoF3cPW37Q8coXMqX4D0mS5pg4F0QtMdKDvaVhN9U8twBuWeV3J3CavTycIi2ySE1/SxrrC4uDzZsToMOGBqdPTmXebQkKXsWXbaFLHxBDeYHpv5A8f/pccxg5HpVFSifVvfJ1mkF3tPaVLQTAcKMFRA4USU/X3XJqbf3oDjyAuFqi8xyU0fJUJXgkoNaeeNpEgw2XD3+6eVMWDkYmJlrcUW+LVxKjEzDPHNtLfOsBsEeg4= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0PR08MB10656.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(52116014)(376014)(366016)(23010399003)(1800799024)(261009223027099003)(10067099003)(5113699003)(6133799003)(22082099003)(18002099003)(56012099006)(38350700014);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?c3ZEMVFTUzRBZnpEOVFjRHVIbDQ2TGxwdjZ1Uk91RWlIZkRNcDJsckVqd1dY?= =?utf-8?B?cWtQUjZDdzRXejI1M2l5VEdPNWFYY1BlWkVuSDZ6VkV4bHV5SGJXTlA4RGxa?= =?utf-8?B?ZklwOWhlblNPNmRZcmlaM0pudnUyaHNYU1drY2gzN05hUEtTMlB2QjZuRyt0?= =?utf-8?B?WnFuSzdLbXdVV2cweVFHWnhXbzkzaGtqTHRmYTFmTmF5V3ZIZHh4dS9GcldL?= =?utf-8?B?VjNyczRxYUp0ZVJETmxGVHpQSS9CeDNxRExnRi84Uy9rVDhKZHlaaFBIR1JG?= =?utf-8?B?eGZ4QTJKZUNuQS9Qa2kyM0ZSTGRUZDR1YUlOT1BaYzBqdy9yYmljZnlXSlJS?= =?utf-8?B?cGsydXdYQ1VlM0czVnhyZnFsOGtSbVNxWGxJb2hRc1h0dGtDTlVNdzRNSGJa?= =?utf-8?B?SXVsQUhFMitvcEpiZmQ4OC9Vb2lhdFY3UVpvOFlhd2lxWkp1eitNYjRzZ2hI?= =?utf-8?B?Vk9CZ1ByaGZwUU5mQmJtK0RhYTAvTUgxUEZQWHdSeWNlbjRyQS9WQTJDOUlO?= =?utf-8?B?Qm5zQis5UHNmcCtDbGwzdkpuK08wNnlNZ1c4aTA3aWNxSWRUVjNsZmRUMllJ?= =?utf-8?B?ZlZnQWEwQ3oyUFRxZUIwVWgydlpmazVpNGhDczFRRGM5U0U5aTJuU0Z2bkNu?= =?utf-8?B?eXh4dWNyTVBuanBqQW1aNWF3a0FMUnplQ2ErckhXTG9XcXBrZDlwZDZFNVdZ?= =?utf-8?B?K1ZzSklORTUwMkN3YXNlNkN4b0JiZlNwa2hIbEx0KzZPZENNWVFOVVpjS2py?= =?utf-8?B?NE54UFhObzQ0anV3K2JvTFMwNk9FcmNRcDBURDNMN0t1MExCY0FINVl4NDh3?= =?utf-8?B?VzV6K0t4OUhHSFVwR1g0em51cUVLV3RhQ1BmRnV0MHpaNWx2UTZtSURVRmhN?= =?utf-8?B?cXZkNzBXUVNMWG1VUkhSVHZSamFqS1pFbnNwTGRaV3lBc3JVck1DNE5NWHNN?= =?utf-8?B?SmFRWE1aVDZ3QVlvSXk3d20vWExCeTJpWnE4Q0UrZVRRZXQxUC9ZNWtTS01r?= =?utf-8?B?dm9nR0tYZDhHUUk5eVl5QzlqdzVCRFF5TUxBdVY5bkNWcHE3MGNaVnJvZEgx?= =?utf-8?B?UXV6eVhvUEZXVkRMcGJNNHhvNnBnR1NpWGNZcTFPdTVCMFpOSi9hSDMrQnNO?= =?utf-8?B?ejJPVEgzNnZBVnZLcnYyeGlnTStvdEd3NGlRN1N0TFMyOEdVWnZaTmtxSXpE?= =?utf-8?B?N01zSTJuNnlES2NtaVZVK0NUeUtQVzZJbC84UXhUOHYrbEUxVGg3bGRBczBY?= =?utf-8?B?WXN6c2xsMnV4TUFjVkxEYVNBWkVwRWRPTlJLRHpqQmVndUdRNzF0bmVFNkdV?= =?utf-8?B?SXNKWjF4aFMxY0lucUpndjJJWnZ3WjUvWUFNbmtLcEJGRUdNNU5UZUJ5b0hG?= =?utf-8?B?ZHV3T0hWVDVvU21VMVNKS01JQXM4REhpbG5LU0VaL2UvWkJNUTRqb2I1dnVj?= =?utf-8?B?MjJ4dm5NWEVZSXg5S0ptTU45TDF1czdRd3NOV2RTTDJqeGtCbEMzd3BzNVM3?= =?utf-8?B?b1NjRjE5eGpyZUZHU1Q4T3grVmJObWM0ZTFiV28zZmptV1RuTHlWcUh3Qk5x?= =?utf-8?B?RlFIcjlxUGRONjByQ2svZFBEOFJzdVM3cW1WdTNKVlN0bjJ3dktoYVhOWEpy?= =?utf-8?B?TDVXVWZKWHBaelNSenU5OEw0Q0pXVEtxQkd4Ly8vWXYyZ0RzSWZLTGsraXhx?= =?utf-8?B?Q3cvSVdrckQvOFM5Z2dKeFVhaDhUZ1Q4aUlWSy9FTU5SL05icjAzS1NmSWJF?= =?utf-8?B?c1lHTTYzRGJJV0FlbFFRL3cwc3dkaVQ5c2NnRmM1WnpwNDRnMEZEQytGVHl4?= =?utf-8?B?WjJXckJ4YVhSVTFtbnZ5c3YwaHdwU0F1Nk0ydFZpdlFBK1Z1SDJ6NGZmWEtz?= =?utf-8?B?dzB5bmxacVYvcXUvelYvTFhSTE1oeDI4aWR1K0xLNDJmODlPWGVMdmZqUzdW?= =?utf-8?B?bi8zVkEyelVNNS8vcWxHeitWcmVoZG12c3hDMGZHZlExbUFSZTdRY3h5ZDZp?= =?utf-8?B?N1l2ZitiTUxSSmQxbFhpampNTERBQUdTaFN6aDVwTXNzN3NXVndUdTBEaVlo?= =?utf-8?B?YjFIczI5alh0UXBpbDlTbGVvWFZ1VDRxSW0weTNwV2VhSkVLbllkbnc3Vjlt?= =?utf-8?B?MjYzK3JVeGE2SGNNWnl6MmViRExHL2hRWEpHa1FvVWhzR09DemdKQjJGY2FM?= =?utf-8?B?eGFKeGlJaUxYbUx5cmlPVVl2aEpFRGJxS1U5WW91V2Nzcjl1S0Q2My8xSlpv?= =?utf-8?B?aXJQQ0ZDT0JFSFBnVnNvTWZaQU1DZkRqdWY4UXdybTRZODBSMjFYekQ3L2dw?= =?utf-8?B?VVFROEJVZnFFb0s1SHBTTlkyTndDcCtsNFlpbG9vZW80SzRzY3hsd1o2Nndh?= =?utf-8?Q?HCqtQgCBHzVzvfxM=3D?= X-Auto-Response-Suppress: DR, OOF, AutoReply X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: da48dac6-7d90-40de-b247-08df2ec782f6 X-MS-Exchange-CrossTenant-AuthSource: VI0PR08MB10656.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Oct 2026 16:30:54.1127 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: WpqoKvHAnVXH4xg+2klPPXH4gS6kR/QM4yptvLpu7NogthvOuks4d3p6opYzzqlgnRQV8kTHm8Vk3C0o5EW5ZAahv0LQKoZBHiFNtxb3jdM= X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI0PR08MB10683 From: Cédric Le Goater vfio_rom_read() can leak uninitialized stack data to the guest when a read occurs at the end boundary of the ROM BAR. Fix this by initializing the val union to 0xff, matching the ROM initialization pattern used in vfio_pci_load_rom(). andrey.drobyshev: This commit is cherry-picked as-is, with no modifications, from the upstream commit 402fd5a75659. Reviewed-by: Philippe Mathieu-Daudé Reviewed-by: Mario Casquero Link: https://lore.kernel.org/qemu-devel/20260602074446.1206892-1-clg@redhat.com Signed-off-by: Cédric Le Goater --- hw/vfio/pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c index d930ef46309..fa2ca0d779d 100644 --- a/hw/vfio/pci.c +++ b/hw/vfio/pci.c @@ -1153,7 +1153,7 @@ static uint64_t vfio_rom_read(void *opaque, hwaddr addr, unsigned size) uint16_t word; uint32_t dword; uint64_t qword; - } val; + } val = { .qword = ~0ULL }; uint64_t data = 0; /* Load the ROM lazily when the guest tries to read it */ -- 2.47.1