From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from DB3PR0202CU003.outbound.protection.outlook.com (mail-northeuropeazon11020143.outbound.protection.outlook.com [52.101.84.143]) by lore.virtuozzo.com (Postfix) with ESMTPS id E66BC8045D for ; Fri, 23 Oct 2026 16:54:39 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=AxgyAVwP5U+JxxDhjzVmZZhUD1h3ps+pJEnhFYWz7IiuexPB0s4007JUvt5c06fHMpOyVIyB4X5LiQLYMRp0jbsKeeBea1PZWVMZH3q1E6G3XNLsgUIG6w0UMsgiwfMEXEoOu+2e0KSNd+n7tWNXcusiNB4tX86b7/TMqwTIiEbdQbQSw2UFoq+ER+jQrRTuxdx/1hw6bFKrbuY3U8dDvxEMUQAlpW+DY/X0NJY7xGiUvTro2ivi2yt1O5Iodh+cY6cAYeaubvLAIu42cKo9jXJQWLbEs8H6jIwk2MBsW8wKAmjS0bQj9E6bC9PwWp2J2hYMIAh3EAt/d14oLUov+g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=9n/f58Cfww7ExcwPHWCumaxgk4jzvGlue5epPFjzeyw=; b=tyAZLl/wuzjna8sTW2aQzvE7MWyqF2RHvZljDaonL0pHb+nllKYQOFiqtVMP7b3DEq2uokzG/mpE3Ie25gKmcA0q/qlEd7z+IgISLnUyxH3JeleNEs6h2AKPemlSZh8R8SOEwbZyRmf7DzOaWvrxj09T/ZOERLrZpWjPI3o3AUjd640ZwYsAdOkIJ8UzjZNhsVYgrgtnhp1XbISqx4npbLSRAYPlRwKfNGVzJgofZc46IIOqYEM6qoxnrBqxcRGYP3SohrWXSiJ8+YNImzQKnUxKLhjq8tTf+wlXCc5VJCE2Gh8vWOO1bSCSsLWuxSYBwX8iZBFaFWiLnL9FSAjGgw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=9n/f58Cfww7ExcwPHWCumaxgk4jzvGlue5epPFjzeyw=; b=fupvVpekoM2yRfCJzgIb+JSK8MsewhcWNj1xkExXb85yZa2JYXU6AabtIKMab299/kHOeN7xg+HE7RQ74n/9VKq1tMooOd2/hneogAMS9tCpz0cXBICESGIXueonCa8jnpfHWPxr+sRCkiG4nzwwbvRnLWyHQ76ilItltAl1GwIcHOjwSWamSKqFWOCO1SM07rZDqnBP781vDE6yYpfEl4BFFl36809YCNhFJAREYfKJ47YyIQDuCqYDTt0YDXngy4Pzp3CQz39nY+io/Gh0L1ZltCtFPkV3BUX0CaesYfwVUH90CDnvtfYevwumdMNCeBcK9n0xiC+dx6aR6fiYRA== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) by PAVPR08MB9460.eurprd08.prod.outlook.com (2603:10a6:102:316::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.18; Fri, 23 Oct 2026 16:54:37 +0000 Received: from VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8]) by VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8%7]) with mapi id 15.21.0546.017; Fri, 23 Oct 2026 16:54:37 +0000 From: Andrey Drobyshev Date: Fri, 23 Oct 2026 19:53:47 +0300 Subject: [PATCH QEMU HCI-8.1 v5 10/36] vfio/pci: Reject invalid MSI-X Table and PBA BIR values Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Message-Id: <20261023-vfio_v1-v5-10-ba0bf3c6d122@virtuozzo.com> References: <20261023-vfio_v1-v5-0-ba0bf3c6d122@virtuozzo.com> In-Reply-To: <20261023-vfio_v1-v5-0-ba0bf3c6d122@virtuozzo.com> To: svt-core@virtuozzo.com Cc: Andrey Drobyshev X-Mailer: b4 0.16.0 X-ClientProxiedBy: VI1PR0902CA0027.eurprd09.prod.outlook.com (2603:10a6:802:1::16) To VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0PR08MB10656:EE_|PAVPR08MB9460:EE_ X-MS-Office365-Filtering-Correlation-Id: d2d8234c-14ab-4868-0ffe-08df31264c02 X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr List-Id: svt-core@virtuozzo.com X-MS-Exchange-Transport-Rules-Loop: 1 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|366016|376014|1800799024|52116014|5113699003|22082099003|18002099003|261009223027099003|261022105027099003|10067099003|261021121427099003|56012099006|38350700014; X-Microsoft-Antispam-Message-Info: Ju46JEhoutAN3dz1mLDTbFWVoWOaxN2LxV2ukEfNSCVJSq3NgoSMuNsTJ+sJNLFQ/uzj7yy0MrVUV31j+78L1JlNMx8rAM+FvWGpBSJPita1kLjJr+qRFnje/wMV3et4dl4XuCC0tFDQVlW/8SL83mi3uwosGIHa63drlICZ3ScWqzstgobT8HxVobZW0NFk1KPLsvZRA0cIr8hlS7l37GomTqbA5VpUZNx1PdBHbTNMEYFVs7glL43z4vUbgeK28H1bH42zmOXdP9eY4oKsWQ/gPAnu1B0QbkcBC0K7CI7ntInjbNLlpLriRdQB+RhXlImJK/juQhoogURITwIDeeSU96kH7eFuy5jA4kao5PkbYO9Z2d00qSF5jU14x2cT2G3qmuUe/Ev3TXjI3aaJdEqpS7AOqYFUu7cErARaXpOetTMRLDwj5GTGMmRKB7GZGgH9Ctp1D+fjUTxFxTDIsvKy1qSTgQWMkubb92ZxgPGX+nUYJIbNZyeE8WYxJQXzMnmnlDqijodDPfnMljFmbjl2zVPHYCjXxlAphJtHHa4gOPF/K7GmwGAQ+Rtydt3hBB+R++YzupJMALGuwpnQw8K63oP3A12cdeCCkZlHUhLzXZ0CWb5MeLjxmyJkwtLDf1kvMSeyEIf4cgD0gU+Q74RQ5Aff+Y0PpBj3tdJiTYg= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0PR08MB10656.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(366016)(376014)(1800799024)(52116014)(5113699003)(22082099003)(18002099003)(261009223027099003)(261022105027099003)(10067099003)(261021121427099003)(56012099006)(38350700014);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?NGNsMmdkUTF1UEN6QWc2NmFaaHVlZGdZRkpNMkJZaVFtOERHSXNsaEROWGY2?= =?utf-8?B?N2I0WlY0bVBwZ1NXRi9mL3lNcnhINklzSnZCY2hwTnBqbnpueCs2aHhoR2xh?= =?utf-8?B?bDVnUVhRbkw0R2pOUU40RnBMUzczdGc2SSt2Z0lYcGxmWmsremtIbHdvUklO?= =?utf-8?B?SXluTEJtUjBOYUV0MmYwNGw3Z21vUHdLSUNLV1VnZHN4WXZlR1VKRTJyOWNj?= =?utf-8?B?NTNlUUtNbEVFbC90VjcwaktKZXU5Q09lcHpnNXFleHNjclp2Vm05QUx2VWdj?= =?utf-8?B?cDNNMExDUlVLTFhxQm4rVVk1NmRKRUxlY0RyUEdMQ1gxQU5QaklrcEErRkhK?= =?utf-8?B?OTJzWjkyVVQ4Y2IxWnMvUTVRN0NRODEwQ25OeDFhZ25JOW1sQnR4UlZ1V3o4?= =?utf-8?B?MWh6dUFNYW9jSmFhei8vR2plYzBoNFpQbU40S0xUYlVPRlI4S0RFb3FDRzJK?= =?utf-8?B?NlQwYlFOT25PQVA1MFlxZ1dhZHlTc1g5NStYczl4L0h5MU5UL2dieG9ZdXlX?= =?utf-8?B?empzUGV1bTlZSUVqR0NlVG41T3Q0ODZpUzBpT1JIMDVjaEw4Z3JPak1DcnlR?= =?utf-8?B?MFVvNWs1VHBwbTRKaWMvRU93SVJQdS9OOFBtWEoxVUJwdkFLaStiWFV1Y3Rv?= =?utf-8?B?aGtvNW5KVnpQUlpPaDZIc3E4NWdDVU9FOFlpR05RSTFXaUQ0NHF2T0hUYWl2?= =?utf-8?B?TjZJSFNicW9WVVp2emIvL201aXE0VWkxaHRSYkV3MEUzSy8vYkFWWkhSRkRW?= =?utf-8?B?UnlhcjV6ZXVyY05BT1REQjFLRjVDTHRyNDR2T2lMdlQzTVVpaGZvNm5HSC9q?= =?utf-8?B?Y1VOckJGeENzSGdKT0VmUW5MWXpxVENJcjArYzEzQ3daWHlCQ0NZN0hPZTRF?= =?utf-8?B?bk4wMk9ocHYwOWNEQ3FEc1FhRHJuVExwKzFTNkd4cmRkWThCR1JlZ2c1QzZE?= =?utf-8?B?WXJIOElnT0VTRVNsaitpVFY5TkZjSnVPWVpVQ1VKV1ZPd0s1RXQ1WlhiSWJB?= =?utf-8?B?NVRHU3Z3ZGtGbkdlYUtrZEl0R2k4TGlNQjZuVmZzanhhbm9rNkREN2EzZ01D?= =?utf-8?B?Kzg5ckU2dXljM2NwM0VRY2p2a3QvcDNNMTBtSWdJalVGaUE3cWg1RXpGU2Fi?= =?utf-8?B?SGdrK3R5OHpUajNFNmFRbytiZVJYckt0L210dGw1dWd2Z2N3YWVVZWY2TWFH?= =?utf-8?B?REtPbnIwUzIrYmlJZUdiejN2bmh4TUJjZmRCVTJyanN6czZHaUpEWG1KUlFv?= =?utf-8?B?T2h4QVJTQ2dIQVB3aHFDRlNFU2RzWjlZRzVPOFdFZFF0MnVQalltbHIwSFYx?= =?utf-8?B?Uk5aa205VnZwaWRKRkhrWnJUNzhudDE2UzBMaitaNStVcXdpYTQrT3htUWVV?= =?utf-8?B?K0h3ZmFzL0dFbDNNOXJOY1NodXlvTXRBZE9FYlFoVEQ1MCtTbXZaa1NtS3hi?= =?utf-8?B?YURNOG8yaUZFY2pHOGdFbm1VVTM3Sm96ZHkzL3JISU5hRWcxVURpdENnK0Fu?= =?utf-8?B?MEVXdWkrZHpSUGhrNSt6UVIzSi9HSzUzbXBLcUVEZmxmSEUyWTRIcVRQYnVB?= =?utf-8?B?OHI2cXYwZ05QU2pVcm1SK1o2V29mVzNoZnVnRUtxWU1VZ014K2JkamRuS1FM?= =?utf-8?B?R1pzM2dKaWFqbVl3RXNiRkdjbjFaKzdWL0tTYjIrazVJQ1hWOG9ZNmYvYmhZ?= =?utf-8?B?bGhlUWR6SFlHc1NwUXp6OWZBdXhTcTR4TTJrVEtYMDBZajJDd1dNVzFhVkhW?= =?utf-8?B?U3llb0ZPWmpjdGZIWnpYK3ZCbjUrcWs4S1lZR1UzNDhwQytBbnVOdU9od1pU?= =?utf-8?B?OGNicnFjb25LMURwTFZ4dFdMU2tlRnVtaTcyclJxZ05KbUNtdENyVTZVa2lq?= =?utf-8?B?VTltQnY2b2hjSHNiY3JqWFpDUC9VczFwNGlTWTVCbG9RMlRhWmFQYXdUN29o?= =?utf-8?B?QmRSa3RkY0NPTUF6NlcxTnZ6MTRkbi82bkJNcmdnbzAzbGU3N1BOMTc3Z05M?= =?utf-8?B?NGdiblZSeitHVjVhU1M3NFl6eFZ5WEpGZHEvTlBxWnVkenJsdStHdXFIU1Uv?= =?utf-8?B?azFqb2VSb3ZvQTdoNHp4bk1oZmxuS082aTZEUUVIVWJjRnBYcDAzcVI4VUhz?= =?utf-8?B?cmtMWTZQYlZMR1FoZGorU24vQnpTNk5qbURNTWZBUVdBM0dxd1VaRFBwZXZY?= =?utf-8?B?dUZ2TkNGcGlpUU9ldU8yUlhSdDdrb0txNEFaQ0xUK0tIMWQvWVNrazM1akEz?= =?utf-8?B?TWxDQ0MzMFIydnkzWmJ6OU1QakRUeVhiS1RiTmU0cTlubjBRdzRpM24xSmQv?= =?utf-8?B?dFlqSDJLQmtPbkc2d3c3eVAyMC93cmJaRkpNbGRjdFFoT3JDT0ZCN1JVT1dQ?= =?utf-8?Q?oy2qT7IRkLJNVUVo=3D?= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: d2d8234c-14ab-4868-0ffe-08df31264c02 X-MS-Exchange-CrossTenant-AuthSource: VI0PR08MB10656.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 23 Oct 2026 16:54:26.7569 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 1Z82QSGYypTImiMv9E28SN6NabbwDmqVWfCji7znbSlN/HtBizi/kDLYZejhHhxPkPZ3+aypY+3GqLsGIj1heyOpMZ6k8+Z0nJQvZ4JB+no= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PAVPR08MB9460 From: Cédric Le Goater The 3-bit MSI-X BIR fields permit values 0-7, but VFIOPCIDevice::bars[] only contains BAR0-BAR5 (6 entries). An invalid BIR value of 6 or 7 can cause an out-of-bounds array access (CWE-129) in vfio_msix_early_setup(). Add range checks immediately after extracting the BIR values. andrey.drobyshev: This commit is cherry-picked as-is, with no modifications, from the upstream commit 9daa7347ff25. Reported-by: Feifan Qian Fixes: 65501a745dba ("vfio: vfio-pci device assignment driver") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3878 Reviewed-by: Alex Williamson Link: https://lore.kernel.org/qemu-devel/20260706161334.2165482-1-clg@redhat.com Signed-off-by: Cédric Le Goater --- hw/vfio/pci.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c index 5e281b2e1d9..d930ef46309 100644 --- a/hw/vfio/pci.c +++ b/hw/vfio/pci.c @@ -1791,6 +1791,14 @@ static bool vfio_msix_early_setup(VFIOPCIDevice *vdev, Error **errp) msix->pba_offset = pba & ~PCI_MSIX_FLAGS_BIRMASK; msix->entries = (ctrl & PCI_MSIX_FLAGS_QSIZE) + 1; + if (msix->table_bar >= ARRAY_SIZE(vdev->bars) || + msix->pba_bar >= ARRAY_SIZE(vdev->bars)) { + error_setg(errp, "invalid MSI-X BIR, table_bar=%d pba_bar=%d", + msix->table_bar, msix->pba_bar); + g_free(msix); + return false; + } + ret = vfio_device_get_irq_info(&vdev->vbasedev, VFIO_PCI_MSIX_IRQ_INDEX, &irq_info); if (ret < 0) { -- 2.47.1