From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from DUZPR83CU001.outbound.protection.outlook.com (mail-northeuropeazon11022087.outbound.protection.outlook.com [52.101.66.87]) by lore.virtuozzo.com (Postfix) with ESMTPS id 1885180474 for ; Mon, 26 Oct 2026 13:03:57 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=etGYouISi0gXnY20Mdoxm0CnL5VWvnWXtHk68gkfPYsmWPS8+IBqu4CH0bVfNwh+2snjB0BfspYuUxWzGAxywSLqaNm1pc42m8KeFV4E/J4laICKDLi5wV/wQkJ3VBmNyt4lqhulNAyQzVdwffYt3Y6q0uXUZlUo5ufTWtXRImVkNBg8eSX0LYRX4ETqiJn9NVvxMjoHTaO69Eh8DL6n/KHTu9BbMi3o7D9fIJWY9gpGNvqTIEB2Me5TmLWGeRFpV+AqwPdc08i2sS2PvjovgC5lNOCoYZWGqFOyD46SpyqzjFsDeB2EJ5htg/Sp1xYCJpGW/FLog+tXfItPQwJo4w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=1IXDW2xarN0zMumYgeEg71qssYVkPGccleuEKGzBg1s=; b=gYSSObER5dRX5E70teI4LWVQ+8vWKXbWNNAYq19ssgoJuB+fcK9ZKAdHtE8iaZLbbkQjzQHi4x/phZbvs7wI/7EaTlMCKTUglM/p/jDgLfUgEWGenDyU0gkDKBnUO/ETLaCklUF8XQqfqrAvkSdGQXkx/lq3Y0qCCPmNr6jm1/c1Y/7EIbbf0fD1nVYo4XtnsOQXKYIie9fXfXrj4zLHL5Gbytt6lkjIiKW0583oKt6W6qp9becfB7tj62RCDw83y1KBoGKe7roDBp8egSnz8fhanBSJ//A5FEl+XytHD3iqbYdV0NPweXXOa7d5eC+/tpQ5fBWjOMJJgIOv7BaOig== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 2a00:1450:4864:20::431) smtp.rcpttodomain=virtuozzo.com smtp.mailfrom=openvz.org; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=openvz.org; dkim=pass (signature was verified) header.d=openvz.org; arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.onmicrosoft.com; s=selector2-virtuozzo-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=1IXDW2xarN0zMumYgeEg71qssYVkPGccleuEKGzBg1s=; b=A5BdCKNSTNqB2NUc9ThxQ8T0GPrKd0HcAbGBflIkugJ7yjo8Ig5eZUYERe0M0ltn1M1YwzMVdZ/LngphqaEDR8nCTh3HiLEUCvcs9jXD0keZZhKkzzjArpHYXuYT6TnPZgZenfbVBi4Gs7ZjuTLfgeAhbRt6V7TIj5C1B3ApsPQ= Received: from AS9PR06CA0011.eurprd06.prod.outlook.com (2603:10a6:20b:462::10) by AM9PR08MB6180.eurprd08.prod.outlook.com (2603:10a6:20b:2d4::8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.15; Mon, 26 Oct 2026 13:03:54 +0000 Received: from DU6PEPF0000A7DD.eurprd02.prod.outlook.com (2603:10a6:20b:462:cafe::64) by AS9PR06CA0011.outlook.office365.com (2603:10a6:20b:462::10) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.546.22 via Frontend Transport; Mon, 26 Oct 2026 13:03:54 +0000 Authentication-Results: mx.microsoft.com 1; spf=pass (sender IP is 2a00:1450:4864:20::431) smtp.mailfrom=openvz.org; dkim=pass (signature was verified) header.d=openvz.org;dmarc=pass action=none header.from=openvz.org; Received-SPF: Pass (protection.outlook.com: domain of openvz.org designates 2a00:1450:4864:20::431 as permitted sender) receiver=protection.outlook.com; client-ip=2a00:1450:4864:20::431; helo=mail-wr1-x431.google.com; pr=C Received: from mail-wr1-x431.google.com (2a00:1450:4864:20::431) by DU6PEPF0000A7DD.mail.protection.outlook.com (2603:10a6:18:3::85) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.569.4 via Frontend Transport; Mon, 26 Oct 2026 13:03:54 +0000 Received: by mail-wr1-x431.google.com with SMTP id ffacd0b85a97d-48df0fa43c5so1893193f8f.0 for ; Mon, 26 Oct 2026 06:03:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=openvz.org; s=google; t=1793019833; x=1793624633; darn=virtuozzo.com; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=1IXDW2xarN0zMumYgeEg71qssYVkPGccleuEKGzBg1s=; b=A5zxpTkt4q76ndcdTtzj1Y1afRCF9kGZMSWzVU14ts+t1sUDIFYMmisJZllKh3R8ip pVqdY8eYpPD0Mm6mrK93AhHB3IGyG9FeAIvxC5mzJkn2U4CayWRCgfqRCj52ZlJDImGl S0lk816R5o12hToAzd9ZUQiPmXWcqlgUi7Ii9uFav2fyQTwjIcdm12Wwe9S2Cr0pA21I 4L/L4xsLfZGMLFAqmqDe8wDYrCRsDjfAx1bNQWWR8tZVuR1wnulLuHeuNwokmIUDsvta 6ge8FF25v22MGbBQ0IC5KGE5i8wnU5KAswNog+5jegUHonZDDGjnRlMX15UtvixyXkzs Lb7A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793019833; x=1793624633; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=1IXDW2xarN0zMumYgeEg71qssYVkPGccleuEKGzBg1s=; b=k6uWNHC3nQHdkI28bxDytPMU4lGKJaEBTyQ5kLZtSwkzuynn3ipeIZy5YoYWOhzQMw /AzpPNQBWfSN1fI31LN3e3hnkAO2+xzYT8XC38b5e7/szaf/Bs2R7t/zbySZmjLzAs3w WNVtKJMC0Xn5byoCIUcsST9dr+e91yzROgg1Gmx29BymoFiBT1Ic5FSrkZrZi7Bvt7aV XwRBxegTAMTWLybcT9dgJ8FlqHwZZ//glQLOey6gWgo6Hywd3ZNTtnwf22u9WIaT/hkF diybuGiOkSqtyzAYdO51J6rFCbP83u2kA1aHqbSYg5hu1WupfAjYfo4pwsxYx4B7SAEy CgVw== X-Gm-Message-State: AFq9FYIMXvWMsltHNYqCEexmx1nvEJjul9YHEg9FHqPaOV5I37FfR2H7 fbjF8aXMbezNAgrUeCgEmCt1wD0ld2fh76NW8NAPTGJzM3VSkL9R7iqHusklgBiEEfaldQ== X-Gm-Gg: AYBFou31Nd6hphnb+4h3eLXFCMxRWA04rDofSQXCOBnhO8XO74H07LgCPnKEnRAkdU0 CP/fcgA2g2/K/s3Kub4GQHO4XDCt5FZUJmZDrtq71YrgrVXpNLtq0v3bjLdhxDsdvsqGBOel6vF jXTFGkLGgmlrqajKNIqqueo6IYrESFWPBcSIBGDakXsFCdJeX7LOE6CbGGfwjCi00d3x0km3As4 X4Enc9lMbtnTX9bJOzaLUeM48JINEMtn2nFHV5NXkFhVaNh9OR6ePjz2SBAe/PdbL1t/SoxpQzL OosB8fA+NaJo73i4dt4Ox0rNENAfDPkrsUTrKAWlp8aP2xK2StLAO4y6Jm5bzIbW0XH4614OqPC gRrnW7Zrcxm+wHhxemcOXBQXcCTkh9wUnkjBoRRUNZCk4uaXfggCa0glj3R07VjKnwGsEBcuq4c l5fxQ9ojGUIjoQJBKleLhDuvvSLHwjWZElzUdNMWSQoQdm0kEuYy5ag6pGfXmRFPCwA2uug9yEN +a3Uv8B4D664+JWx3myBLgHI438h4XbiEe1l9v6ghGp+60bgeg= X-Received: by 2002:a05:6000:470a:b0:48a:f4d4:e1f3 with SMTP id ffacd0b85a97d-48e3ed1ef39mr13109632f8f.13.1793019833437; Mon, 26 Oct 2026 06:03:53 -0700 (PDT) Received: from athena.sw.ru ([2a06:5b06:b600:300:1a6:7f7f:f573:ba9e]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-48e3ecd354asm15547596f8f.43.2026.10.26.06.03.52 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 26 Oct 2026 06:03:52 -0700 (PDT) From: "Denis V. Lunev" To: andrey.drobyshev@virtuozzo.com Cc: svt-core@virtuozzo.com, den@openvz.org Subject: [PATCH hci-8.1 1/2] scsi-disk: fix out-of-bound read in WRITE SAME #VSTOR-151631 Date: Mon, 26 Oct 2026 14:03:48 +0100 Message-ID: <20261026130349.271706-2-den@openvz.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20261026130349.271706-1-den@openvz.org> References: <20261026130349.271706-1-den@openvz.org> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-EOPAttributedMessage: 0 X-EOPTenantAttributedMessage: 0bc7f26d-0264-416e-a6fc-8352af79c58f:0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DU6PEPF0000A7DD:EE_|AM9PR08MB6180:EE_ X-MS-Office365-Filtering-Correlation-Id: 64eac97d-4d45-4787-55b0-08df336196a0 X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr X-MS-Exchange-AtpMessageProperties: SA X-MS-Exchange-SenderADCheck: 0 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|61400799027|6059299003|82310400026|9140799003|48200799018|376014|43022699015|22082099003|18002099003|10067099003|16102099003|261021123027099003|55112099003|261022105027099003|261022075727099003|3023799007|261021133027099003|261021121427099003|261021130227099003|5023799004|261021135927099003|5063699009|56012099006|261022113327099003|261022115727099003|261009223027099003; X-Microsoft-Antispam-Message-Info: QEB8qWGTCpaRL8kZAQ0TaF55IqCNFP6VFUEKrhueyIgnAn0U9xaU99k/uLQ0cQANRSCAq4YT2OST+ms4C/UGphTRC7PFNlyK0JDOm5JkaCUnthMSa67XnoYzPSLlpGpEc6h0ChFyLyE1Nz4P3mNSvRgjV+h9Ikw4NUYTMG7U927uXOXVXBqIBMCrqfHqygEs+u2EZg1NV2ZfE/D/BjCQpIiarM9n5pY1lScG/41LECZTJWXK8Ip+iuRU4Nv3wLbGrT43dXHvvurcDJXbXgjhamGwNxr+/vL6L1cPmCKz0iqJ2HEeKdVMRZ+tS9OSr6JTYl+BfhVir3XvQ4rouHFCy3adUy02q8BBZPMgUzLi25dUfl1rTUBzCSCzdRFiZROER669aIU/aidwgW4nMG1Cmh7Fo8QEoV3ubJ8rCTgldyAZJTsdyjYD0UL5uKJsQBn42kjCQ4U3dkw303j1f2W6iCIx9AmeR29umFOry4SYvEUY1UL8BNFetSsAn7qffAubYejuski5E/o83o/l/DLRi+GKhuC4/PgqHtU5hbBE+X9pEpqSsdYKu51GbCh/k9ay1g3wWpk6EMCSAvGYQg2HKv48IEcdztCfACSJSGupxG6AukGgfL2Fp+IFsI8BttkjLj3LZyE/sdTmKPGUvgYkT4wI8g1kUzFyyQpgG2t+niWOgrozD9AvO9qqGqc5tztsNjLvpsCCl7L8+CDA19YsOKIh0S1eTd0BqK4twsrALHSq7HvbqgbaWMgtz7N30pBcn2hgjL4odcz156oJXlRVhgqD0mQTJTRnuee6lFF0B8GLGPHxDjvQ9Noxdrpb9QswrHrqnu4yaALLGuKOrtmTk+Z6keX6HLxH5/3NISg4CidQimZhO4Oq59GZneqI31n9OG+Hsq14DEHYUeFqr6Hq4ZBv8PjZmQa9O9KZbbiDgLKDWJSGgFAsU9SKIz9Tq+1q X-Forefront-Antispam-Report: CIP:2a00:1450:4864:20::431;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail-wr1-x431.google.com;PTR:mail-wr1-x431.google.com;CAT:NONE;SFS:(13230040)(61400799027)(6059299003)(82310400026)(9140799003)(48200799018)(376014)(43022699015)(22082099003)(18002099003)(10067099003)(16102099003)(261021123027099003)(55112099003)(261022105027099003)(261022075727099003)(3023799007)(261021133027099003)(261021121427099003)(261021130227099003)(5023799004)(261021135927099003)(5063699009)(56012099006)(261022113327099003)(261022115727099003)(261009223027099003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: z2IAgx1aWLE0b4g3bF11Qe2RaBv+LTlaPtpQGZ1T9BuC/YTALbesuQCChV/5m2pQ4STcdUnWPlWgAZhb2oxpgEvZOrcS5kKa1HvwH2VI8WWxrMiEoOattWR2bMnow+nFthq3hx4CFJWTHDxFiw/amHlIbhj7CYpOE8XoJrEy2bpc+mN+eXlpqbl0fBP33zUOVt34eEcYeENnIqfsmUstwEgOLKKnZzvI8J7uTmJXyx13tnAXTV/5qPZLCDbkvQCqb0osYjEbcI6P1eQBAAKHL58kdUDI+l7c494Kc6QBBkfL0zSYpYl+Ee+T7LeklIrSs2aBSNYiFRaOrF23Q4FoBX+cqdMnZ7vAFvheKxCxFwLM6kfa3EuoCjPQgStptuXlnXDH+iG6RqRl95hraRIBmmhyRqTMpRRukeixDI4KGAQvSdqJulmBJgDUe195c2tP X-ExternalRecipientOutboundConnectors: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-Auto-Response-Suppress: DR, OOF, AutoReply X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Oct 2026 13:03:54.1741 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 64eac97d-4d45-4787-55b0-08df336196a0 X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-AuthSource: DU6PEPF0000A7DD.eurprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: Internet X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM9PR08MB6180 List-Id: From: Paolo Bonzini A guest with an attached scsi-hd can force QEMU's SCSI disk emulation to read roughly 60 KiB past the end of a heap buffer, copying that out of bounds host memory into the guest's own disk image. WRITE SAME computes the request transfer length at dev->blocksize when the request is prepared and sets cmd->xfer from dev->blocksize. scsi_disk_emulate_command() then uses cmd->xfer as the size of the request buffer. However, MODE SELECT can race with the WRITE SAME command and guest raise the logical block size to any value whose low bits fit 0xfe00, up to 65024. In the presence of this race, scsi_disk_emulate_write_same() will read from memory as many bytes as indicated by the *new* dev->blocksize, and write it to disk. The read length in WRITE SAME must be bounded by the buffer that was actually allocated, not by the mutable s->qdev.blocksize, so clamp the length used against inbuf to r->buflen. Re-validating req->cmd.xfer against the current block size would not work because the race is intrinsic in the SCSI protocol. I am not sure if this is exploitable with virtio-scsi and other SG-capable HBAs, because it should process the WRITE SAME input immediately, without letting the MODE SELECT command race with it. Fixes: 356c4c441ec ("scsi-disk: allow MODE SELECT block descriptor to set the block size", 2022-07-13) Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4365 Cc: qemu-stable@nongnu.org Reviewed-by: Stefan Hajnoczi Signed-off-by: Paolo Bonzini (cherry picked from commit d30254aec93141d6b89262986a62764b2ae07177) --- hw/scsi/scsi-disk.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c index 003ec1ce59a..544f418c40f 100644 --- a/hw/scsi/scsi-disk.c +++ b/hw/scsi/scsi-disk.c @@ -1908,6 +1908,7 @@ static void scsi_disk_emulate_write_same(SCSIDiskReq *r, uint8_t *inbuf) SCSIRequest *req = &r->req; SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev); uint32_t nb_sectors = scsi_data_cdb_xfer(r->req.cmd.buf); + uint32_t buflen = MIN(s->qdev.blocksize, r->buflen); WriteSameCBData *data; uint8_t *buf; int i, l; @@ -1927,7 +1928,7 @@ static void scsi_disk_emulate_write_same(SCSIDiskReq *r, uint8_t *inbuf) return; } - if ((req->cmd.buf[1] & 0x1) || buffer_is_zero(inbuf, s->qdev.blocksize)) { + if ((req->cmd.buf[1] & 0x1) || buffer_is_zero(inbuf, buflen)) { int flags = (req->cmd.buf[1] & 0x8) ? BDRV_REQ_MAY_UNMAP : 0; /* The request is used as the AIO opaque value, so add a ref. */ @@ -1953,7 +1954,7 @@ static void scsi_disk_emulate_write_same(SCSIDiskReq *r, uint8_t *inbuf) qemu_iovec_init_external(&data->qiov, &data->iov, 1); for (i = 0; i < data->iov.iov_len; i += l) { - l = MIN(s->qdev.blocksize, data->iov.iov_len - i); + l = MIN(buflen, data->iov.iov_len - i); memcpy(&buf[i], inbuf, l); } -- 2.53.0