From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from DB3PR0202CU003.outbound.protection.outlook.com (mail-northeuropeazon11020093.outbound.protection.outlook.com [52.101.84.93]) by lore.virtuozzo.com (Postfix) with ESMTPS id 2665280474 for ; Mon, 26 Oct 2026 13:04:01 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=mfX6xdYiyzx2/9yOJTuVqXzPY6uled//seI0aPnTpKAReXGYzrPRaHcmFGLlQsC+cy+K4zkFphCT/2SAsJ+P/PgwjVhFPAfrEGxmdZFpGeiPhrLjnn7R6hDvhBKVLws4akrIRhBPRMiycDR3hTKapgd8kKRT7ZoA/3qLEn3PNZ/D1kq4dH2mphLn9bwuqDg8Yr9DX4NaMakF2abtqcZlMYiPDp97l21xsCKP7lm8aezKwqaL/Q5QtOdG9DqfJBak78hjBQpyfSCekThiqWtdbev4syDxtaPnD/PwKLM/Jo9DUdDgOVBYorbkF7u7S7gIBPyycuL4vQkRlfdqmqwZOg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=t3M7HIaRwoWR1D9PLL56fauQbC+INYdUugp+KfyIvsI=; b=UNmVD08pnW6xcVxpj0MxpZqlaAKo679pcFuGwQASvHKNVI4X4xkkxPJNtOn/mtm79etR0nHVuUQjz/fYZ+Y9F3LguBoenR02BS36JGn4PgZdTkgN0iWMzqf2aENoQ24yamrmykyciaTOYSTPxjrW9k/Ix9lHpOBfZwt9Gb5qKQX/XfbozGGkBHqt3bKST7JEjn1r6W04Ky00o0qhclHr+vUBrvxtYrx+xz5AhSVhNxetqoUK+Ks2v3V1jT8DNjcyJaW41vNzK22gvpXzppOj9WbfDj7zwMGjY9M9PIicjRzEltHs8oXJW5mokyoeKzyT7zME4DgCIrXY5i+TeZDUhg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 2a00:1450:4864:20::42d) smtp.rcpttodomain=virtuozzo.com smtp.mailfrom=openvz.org; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=openvz.org; dkim=pass (signature was verified) header.d=openvz.org; arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.onmicrosoft.com; s=selector2-virtuozzo-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=t3M7HIaRwoWR1D9PLL56fauQbC+INYdUugp+KfyIvsI=; b=nyi2zoyNNLG2BE9LL8BcrctbqTJZZV5qSxPTC+lc4nIXAfCFfTyPRiMRi701FPfQCuVcJeLPmuBMzzDjL6wzuoxFcCXCDpmJCZFm2lN9pDfuF8jSrg/b2ZddtV0PO2+/xAyj10Ruk1zHL4tU/9W/8cg+oVVbHmE14d9qyP/TX5g= Received: from GV3P280CA0075.SWEP280.PROD.OUTLOOK.COM (2603:10a6:150:a::24) by AMDPR08MB186999.eurprd08.prod.outlook.com (2603:10a6:20b:748::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.22; Mon, 26 Oct 2026 13:03:55 +0000 Received: from CPH1EPF0000051E.eurprd04.prod.outlook.com (2603:10a6:150:a:cafe::c) by GV3P280CA0075.outlook.office365.com (2603:10a6:150:a::24) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.546.22 via Frontend Transport; Mon, 26 Oct 2026 13:03:55 +0000 Authentication-Results: spf=pass (sender IP is 2a00:1450:4864:20::42d) smtp.mailfrom=openvz.org; dkim=pass (signature was verified) header.d=openvz.org;dmarc=pass action=none header.from=openvz.org; Received-SPF: Pass (protection.outlook.com: domain of openvz.org designates 2a00:1450:4864:20::42d as permitted sender) receiver=protection.outlook.com; client-ip=2a00:1450:4864:20::42d; helo=mail-wr1-x42d.google.com; pr=C Received: from mail-wr1-x42d.google.com (2a00:1450:4864:20::42d) by CPH1EPF0000051E.mail.protection.outlook.com (2603:10a6:388::1a9) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.569.4 via Frontend Transport; Mon, 26 Oct 2026 13:03:53 +0000 Received: by mail-wr1-x42d.google.com with SMTP id ffacd0b85a97d-48df8fe8513so2789117f8f.0 for ; Mon, 26 Oct 2026 06:03:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=openvz.org; s=google; t=1793019832; x=1793624632; darn=virtuozzo.com; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=t3M7HIaRwoWR1D9PLL56fauQbC+INYdUugp+KfyIvsI=; b=lKYfT5d3PFsjUCUmhVVCBE2bl/kaJaDp4U7BztiiiUIXn8twqRw9qLo5ZUYX28VmD4 SJFIckYWEa700wlSGUR1hZrVIcu0sFtwk2ggJwlsEjzDAgvR4OW3WTk0YatNPnx9iaeB w6LIq0HzdRiHhpxbE528lISHL6zxoKUU+YG6vOJ7HFcGr6CM/q/MZhvJfaeOx/ZlOPR5 TBldUFNrPjABD/R+lfHaUba38vG6a2KPkYkNb1VvVFF8OLOuNub+TQnfBGus01wBoWAQ hZ/S++7Gu/1trQN/IKvxg1fimbaOBdwyitfnZA36qPSgqO0nlyC7xmAqUA+bxNgPBTcV w5CA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793019832; x=1793624632; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=t3M7HIaRwoWR1D9PLL56fauQbC+INYdUugp+KfyIvsI=; b=P30S8zqSJxy4b1s8k428r9Jm3vVPeK2PUiCVj1qnba+X5c6NifkMio3Wr6Kq+TbH/f jZbY0etDl9i/5GKi1hTbuFKfLHKsVW0EeHAX7V6xlGK8t1zlXw2rs9gyGei1dF6KKehn wF8gzZGAUdrFmoE+oi4MB+Dy1veAEXIwPCUgeghsYd8g7VNQbXA41m0ywZXzRJDwGmg8 69VTKsDMFefKYbqsdRPqLhvSjB//s6G0cpfQ7bZXR5EUFV3vRKhwLTULXbGpv9wAZRhC dE5mDxQnX5e5viNJGw+HJn+UHwl+zCerYYOmm6lQ83WJRdbkGCkEwlnt6wixPP/zhSh3 SlGw== X-Gm-Message-State: AFq9FYKouYBy9On8luCNHpZ7Nj1DIH8PZTD1PLkpYnEGjn58txNE+eno b9lDudpKJxVG5ocGEM3Gbc/WdNMyuEwsScFXBPEf1NJbl6SUbDv+0zXLquqd0E7y4gtB4gvymzS Wu7gWQhA= X-Gm-Gg: AYBFou1ArXe0EQaMlfJYLm+/Gc+QuoQ//glHS6g1RDuYqeP3mHUWJsId21RuPCbTX9m zsKQZJSr0oLIyzAfWfyRTgYR+jpiyuzClInqeOYk7VpGj6IiZ4ZkHVuETGa616tjik41WmWfhpT 3R5VfmZkQUgbJ3wErA2kv5NaqIp7ugFBiX2PgHTfSiaFi11G+P4vHLKk0rWXJAsmvQniKFRFjUS HbubZX0nSzXRvQ5WNylzRYIhDaKlOefgkxO+L+jaNk0n/0QTy2E8UsXs1sDX36QM7xBX0MOQ3Nz DUFeLdbuvPAD+TMM5LIKELwceqpGbErOT0tIlp/fl/Ns9hZ/a2sW3PtGxthazap0Luu22ndB7Tr mapc2x1cCZolWOnLf82lRGcmF+nBVRFkhyawOwLrBh6C3hIJpi0rDxg7RcGuuH36m1TPy4OugsK SdUJe9+TYCfiRk/3FPb+dvAKbp9WgC7z4J1682RGAvFQDnJ8NZvT6+zQUN1gRqtvUe0gvQGzccj 7g/ZaH01ep5fwWhiTbXTHYxIHwnnGgIBMenTfRUng74iA3SgyI= X-Received: by 2002:a05:6000:25fc:b0:48a:fb1c:c2a1 with SMTP id ffacd0b85a97d-48e3eb946b0mr11833843f8f.47.1793019832470; Mon, 26 Oct 2026 06:03:52 -0700 (PDT) Received: from athena.sw.ru ([2a06:5b06:b600:300:1a6:7f7f:f573:ba9e]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-48e3ecd354asm15547596f8f.43.2026.10.26.06.03.51 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 26 Oct 2026 06:03:52 -0700 (PDT) From: "Denis V. Lunev" To: andrey.drobyshev@virtuozzo.com Cc: svt-core@virtuozzo.com, den@openvz.org Subject: [PATCH hci-8.1 0/2] scsi-disk: fix guest-triggered heap over-read in WRITE SAME #VSTOR-151631 Date: Mon, 26 Oct 2026 14:03:47 +0100 Message-ID: <20261026130349.271706-1-den@openvz.org> X-Mailer: git-send-email 2.53.0 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-EOPAttributedMessage: 0 X-EOPTenantAttributedMessage: 0bc7f26d-0264-416e-a6fc-8352af79c58f:0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CPH1EPF0000051E:EE_|AMDPR08MB186999:EE_ X-MS-Office365-Filtering-Correlation-Id: 8531380c-2319-4eeb-b5f5-08df33619603 X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr X-MS-Exchange-AtpMessageProperties: SA X-MS-Exchange-SenderADCheck: 0 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|6059299003|61400799027|43022699015|9140799003|376014|48200799018|82310400026|5063699009|56012099006|261009221227099003|261009223027099003|261022105027099003|261021130227099003|261022113327099003|261022075727099003|261021135927099003|261022115727099003|261021133027099003|261021123027099003|261021121427099003|10067099003|16102099003|55112099003|18002099003; X-Microsoft-Antispam-Message-Info: UVr214R8SNycy4rXHeTCOBIHRoGU3Z++LefuEz6wuDZuGO4WGiX1gHulsHltGT8g61Pc9nEG8rWoa2NMu+Dc2JFmXctiQ2Yir0kfHv0eQFeI2WYu1CBIZebujCpkTXjT1AehH4ujDVLYw0Ej56/3k9kolzrlKWrxF2TV4TI1kuwFO6q8sbul5dK0e8Ct+NpZSrzLKEy+NvhfiPLqZJRe+izzboDZSrALAdlcb9zcMBS5RtKZmoT0xLsnKNeXcQay+aNFYqDnQgiS9gsplY8D8zXg3WTULPNgnY9cwglDRRCaKnuHZKVkxuYCfzzhvXjqnEv+ydv59JdXeHB/QguoS4OtN18gsz9WAtwtAYB3ZSmZN3YKSDuW3441PC7jQDh0T2A7MGZAwlJUABOwDfDbZtojxETWWE+SryrqaAVIYGPfmCCpXyaRnJKeGnTE/lvf36bzZIzP7vSYe1lwHIPDCQp8mEg8A1Xs2vXTYoOob4NoayzUGKaHRoREi/M/++gLKklCRcE4Q0TFUERjcVgVYX4CIALJ7Apzp0dGs+7udR+JJy+Bw4PG7UL8ojdoT2Cd5Pyt+j71pRDl5nRDL4uH7WpjLlIaAtlZjoR6sHk+dHUMK4G+dKXHAqzzrrBSsJ/8oX5lRJLjNHl6weuMtQx3ps8OYHHaraYyRKCuuPfpLkvAfUpw1sRqJGeDuFSoBH7rU1yU1P4nvb1MU1s3mBWA/dgNfxXtPOcwVVIY47a5D8YDnYgAW84WA9IzZ0lPMr1zuXtHKAbxuvKIoFHj7pP2efTVKcaw/HJ1pFgo1bYSqC6DReb5P650XkEBwWDhlnyqeoiHMRlGKrPvaEcgunb6EdHhaLI/VchcsUsI2ev3xvJLB6bqNuqZt/qOs/iEzqcQLJk9ub/b3QIS+FDQaJqd0I7+UzODvlD3YXUF6dOZDXwDqfPatUDphJMsjCcjbz9c X-Forefront-Antispam-Report: CIP:2a00:1450:4864:20::42d;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail-wr1-x42d.google.com;PTR:mail-wr1-x42d.google.com;CAT:NONE;SFS:(13230040)(6059299003)(61400799027)(43022699015)(9140799003)(376014)(48200799018)(82310400026)(5063699009)(56012099006)(261009221227099003)(261009223027099003)(261022105027099003)(261021130227099003)(261022113327099003)(261022075727099003)(261021135927099003)(261022115727099003)(261021133027099003)(261021123027099003)(261021121427099003)(10067099003)(16102099003)(55112099003)(18002099003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: A2MVAiTkrIDkSHVU0hhJq78JW5b+EdmbczQGe3Kq4ubYvrMqjcHE/lyyNCgwWQHNE68KBj7X00MGMVZ/tw7kVaK7p4AxNApT0RtPELT7z5k/828emx26itiYs6VvCcKiMp0SBUkQ5PbtSDP8/9Br38dpJus0KckZgrI409sYndwuhuusdKALuh0OfuzPwz2s0+fcNT68Wr/ozperqDwXrqltxx6AYAb/KLAqzg5KfK1v4J6fRIN6ycHU65zyR0sJKrpWQX600gxxZunHC2ItpI19chvxfwZVU0vcjU0COImpuQPHsZ94BWhYY4JoRGUt9G6oj0PlT6QlPh/zLG+sr6G7zT8jVVT2mezSMhNC28PeQ4MzlzKwBKLNz1IMdIcRDd4fLip98JSIWSDwW9kyz+2S1Ub3pcs8s4qGT/U7eoOPgdFX5IKged2Trmq59tfq X-ExternalRecipientOutboundConnectors: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-Auto-Response-Suppress: DR, OOF, AutoReply X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Oct 2026 13:03:53.0961 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 8531380c-2319-4eeb-b5f5-08df33619603 X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-AuthSource: CPH1EPF0000051E.eurprd04.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: Internet X-MS-Exchange-Transport-CrossTenantHeadersStamped: AMDPR08MB186999 List-Id: qemu-kvm 8.2.0-11.vl9.71 crashed with SIGSEGV in the memcpy of scsi_disk_emulate_write_same() on a virtio-scsi iothread (VSTOR-151631, GMO Cloud). In the core, the WRITE SAME buffer is 20480 bytes, the size of cmd->xfer computed at parse time, while s->qdev.blocksize is 65024: the guest raised the block size with a MODE SELECT block descriptor. virtio_scsi_handle_cmd_vq() parses a whole batch before submitting it, so a MODE SELECT earlier in the batch changes the block size after WRITE SAME was sized. When the over-read does not fault, the QEMU heap past the buffer ends up in the guest's own disk. Both patches are clean cherry-picks from upstream master, Cc qemu-stable and already in stable-10.0, 11.0 and 11.1. Patch 1 bounds the WRITE SAME read by the allocated buffer. Patch 2 removes the root cause: a guest can change the block size only on machines that enable quirk_mode_page_set_block_size, which is only q800. The series applies on f3c1d9ef263 independently of the other pending hci-8.1 patches. Only x86_64 has been build-checked; q800 is not configured in my build. Signed-off-by: Denis V. Lunev Paolo Bonzini (2): scsi-disk: fix out-of-bound read in WRITE SAME #VSTOR-151631 scsi: hide MODE SELECT block size change behind a quirk #VSTOR-151631 hw/m68k/q800.c | 2 ++ hw/scsi/scsi-disk.c | 17 +++++++++++++---- include/hw/scsi/scsi.h | 1 + 3 files changed, 16 insertions(+), 4 deletions(-) base-commit: f3c1d9ef263edfab8d2a273078493bb766dcf8f8 -- 2.53.0