From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from DB3PR0202CU003.outbound.protection.outlook.com (mail-northeuropeazon11020085.outbound.protection.outlook.com [52.101.84.85]) by lore.virtuozzo.com (Postfix) with ESMTPS id BA5C080F25 for ; Mon, 2 Nov 2026 10:36:30 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=YY0fdlhi/XLv0FAEJK0PNUVgRKtnaPON7Cq+vgX5FmnS0CDlvdA03DVrznwPt7F6S9r7n3lF/7EMFs/8y5KjEVNH/jr3vS4EotDsqjRyKXduT3jn+WhrVQCVkkTbG9YILiHVtExz3oYAdWx9qV7jwM68TaR6QpBPxctqSWwjYKBHJrBUB3a1wcb7SIH/CdIXlrFdEIB+iGk6CAV+jSvNMITil/QbVoPLekMkhimTs4FCiVOJPZHAB67eSBqpv8s29FPsOFfFneSqdyQydp52R8gQygbBmq4DNEjd/dNooAH2V1gJsSjexUP8D6ZBRVo4T+JuwsbFgbTSlg2Nam33Qg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=GpyZeuzxBx/9EXW2jB4YPAzv27x1rv066ytK047XXLA=; b=IevViXM0JjDN3YfTbmkK8AcppQlgMxvY2Pu/WuQHAxSzFspUT6yhuio0jbnV4l/ddR+/1zwQ9clEloiKg365nJ+n8JuSuAX/MP2q5cjisVoeiMx6zW1v36TM67LFYFMogarhfoDwpE1Gcc4LQ9jZyJtzENUwcl/clD9mjQCdXOnEnV8ZqTW5K+Pa/rxdY/5u14AcvlIjwMxU1i1kQGCF8aO97rwg6bnmac2WdO5NhcNQ7fASuoZw8BAJ2yj5jFv7xEn7oUrJJpZ/OMlpqX/u3GsThAB6H3TyBL7UHhFuEatyIzff9N1Y+5+xYKSXf6V5mfrdGsEM3EreqcM7E2re0A== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=GpyZeuzxBx/9EXW2jB4YPAzv27x1rv066ytK047XXLA=; b=vNDESO3rM2tbq5pHXv5/hb+z5aGchRdLi821e09xCLvLKsrxrcQIhTWTJcoMPOQS6Q8TauTRmblA0lFhzmYNDdRkYWx2bN6FIgWD1ppj8wNR35/0w8cIVDfO428kYkBmPBfGxWLIh8GJn9CEUHaIh56esKO1sf3eP1vpfBn6jn0K30pBdmNmgSuAck+amiD2xhZl55GnpA5uSuiU/gSUUa02z0jkxgdoxKaiQ4EcF2bEt5XkhXK0RELHew/L1rnKMzrUE1Nj7NeAGvOGckx213W7vaTpD3NN+qKPZva3Z4cu7VQJUd/A6ZYhNbCa70j1qDGI6iR3tIR9xs7m2s9+TA== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) by DB4PR08MB8199.eurprd08.prod.outlook.com (2603:10a6:10:381::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.569.12; Mon, 2 Nov 2026 10:36:28 +0000 Received: from VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8]) by VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8%7]) with mapi id 15.21.0569.011; Mon, 2 Nov 2026 10:36:28 +0000 From: Andrey Drobyshev Date: Mon, 02 Nov 2026 12:36:26 +0200 Subject: [PATCH QEMU HCI-8.1 v6 11/34] vfio/pci: Fix information leak in vfio_rom_read() Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Message-Id: <20261102-vfio_v1-v6-11-9bc7cabc850d@virtuozzo.com> References: <20261102-vfio_v1-v6-0-9bc7cabc850d@virtuozzo.com> In-Reply-To: <20261102-vfio_v1-v6-0-9bc7cabc850d@virtuozzo.com> To: svt-core@virtuozzo.com Cc: Andrey Drobyshev X-Mailer: b4 0.16.0 X-ClientProxiedBy: VIVP296CA0048.AUTP296.PROD.OUTLOOK.COM (2603:10a6:800:353::18) To VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0PR08MB10656:EE_|DB4PR08MB8199:EE_ X-MS-Office365-Filtering-Correlation-Id: af0b3069-f579-4ffa-c4b5-08df38cd257a X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr List-Id: svt-core@virtuozzo.com X-MS-Exchange-Transport-Rules-Loop: 1 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|366016|23010399003|52116014|376014|38350700014|56012099006|261009223027099003|261028144727099003|261021123027099003|261021121427099003|261026140227099003|261022105027099003|10067099003|18002099003|22082099003|5113699003|6133799003; X-Microsoft-Antispam-Message-Info: Lde3MOioNunCQSvNMKKRmF3SKCoQjZemVIH50lHIIgTX+KmoQM6vrhcTU03ERf75l03+VSQLXV0CX89pKoBH7ilo4iD3tk9uxXY+0iYnAP+rybR324XuHU6DW6FEVoltBycO5uLi80ubDKnkEhRhqVcP5xxpTkEYEX3v3jhwKfhx696Aznu2JchmeWDXjklrFaJ8Mb2+SkKKbEMVptcsHzAPimE/sE3WNouwD0p9/JSxG957HW9FLhRVUKyg6MiQKX0W7iqTz82JnYOIEqGT6yJXqyqBhWawwJA528oCPAafVnnfQqffd5ULenoXyAFXOLQW1VKRhoAHoFHgT7nPw5N/0bEZGC2dcqx8Lp9L/XRqtfOCY8f0kbLRBnsiGmncRupN7LKvdnny9v039LLoM/CJMNKYw2+3cF+B2pl58rPF/hLjA8q5qSOEC2+zeH+8D/EKN0TuLZM7cQ2NnnBxXIol6veKlc4OLrCWFhT+cV2Q1a1SnEZPfHLbnZWduJyM6mr7HDiB41Mq81+TifaTaXFeeGnvexCq3dmngBmDYYND7wV2i0Fg1m+mHy5rTnDcosdo94OVovdyu7ItdK+r3D4z2XydYj2YQHG10I7zH0ZVlILGPokWGx4ONkalqbheers75lkycBqS+1fDOzTgym4/q/SqR4Fh2NtUWuH29pIW4EigmlNLfgDEcbsQ3ryo X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0PR08MB10656.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(366016)(23010399003)(52116014)(376014)(38350700014)(56012099006)(261009223027099003)(261028144727099003)(261021123027099003)(261021121427099003)(261026140227099003)(261022105027099003)(10067099003)(18002099003)(22082099003)(5113699003)(6133799003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?dkhlZXl6andXOTdnZ1RNK0xGdEVYT1RBRHpLQ0ZVTVB1ckZWWE1RWThvMUc4?= =?utf-8?B?dVFIb25VRkU0aFdiWGN0bElzT093aTBHV0dSQUtWNEExL0c4Y3VtdlcrNzkx?= =?utf-8?B?RzlWWTdmV2c0eWMydFUvWDhpSUI4V2ZucjBTODNJNktsSmpYV0ZRZExQa3k1?= =?utf-8?B?WmtmNm5RNVV6LzhmSWJvSTBwS1h6RXRncEtZSXdkNDFCVlhMZEg4WGZqNS9O?= =?utf-8?B?YjJ4YTcveTJ5MCt4UlZqbGJYMUlZb0laWDdyMndaUFI3SHFGK0pTTWRncE5U?= =?utf-8?B?ZVJkejJLek5VSG9iSDZFUlpqY0JQS0wzUDhUT2VVS2JyK0xXRFNTNTVoMDB2?= =?utf-8?B?dDA2UDJmWCs2N0ZGd2diUCtpR3l5VEpQSnRGRW1hOCs4d09WU1ExamFuUkVo?= =?utf-8?B?ODdtdFREL0RsU2NLSDV1Q0ltQVltWEgvZWZ0VmViMTg4UE94VUF2WE9tRjJE?= =?utf-8?B?U3FNbWtqVTVaWEIvYVM3cW1Oc2lyUEdueE9qVGNEcFNxT2NPc0s0MnhBVmJh?= =?utf-8?B?WDBUVzNNTEdpZDNrVUpZK2h6cnM1QTQyWmtQUjFRaTBrd2pYYlRkR2plN2Rw?= =?utf-8?B?TWxvd1Z1Qk1ZZFoxcFZUUU9oc1g5eFRma2p2S2lCNzVTdGphUklUZC9GU2Rn?= =?utf-8?B?RWFJeFl3c29SVHJKYzZlZzEyY2xVSzFCbTZkTlRuQ2plSU14d256ejh3NDND?= =?utf-8?B?Uk5ZTnpuemUrbzc1K3VTdmhjSmlDZURCaWVSMG1pd2J2UFg1dytCYmZIZ1dH?= =?utf-8?B?Yy9KbGUwajdQMlgwV3RsVzBtRWo4NzRacEtQWFlya3JpOUw4UVE3UWg4YjY4?= =?utf-8?B?MmJSaThHTzk4YnJ2MkVnZFZ3Yzd4YW9wMm1pMnE2dVI5YzNsaW9WSThaaWlG?= =?utf-8?B?eXZ6Rk5mMEJxZExrbE53dlk3MWhSSXBGbVg4VkNiUE1EU2x1a0pobnhYNzNU?= =?utf-8?B?SnZ6ZTJvM3dzK0g5ZnExemlzeDZqWDhrc3RiQkFjNDNGWGdRVm9NNm51cVVt?= =?utf-8?B?SHZ6UVJlbTV4OVRhbmFlU1h2NE9DOWZFcnpaOUxsNm9oelJRaGJsakRocHdC?= =?utf-8?B?cWVHNU9CNWlJUkJoN1lERzg0bjlIei83NFdTNmxWTEljdGVPN3lUaGxHZ253?= =?utf-8?B?Qzl0NXRpWEU5SWxET3hxVDNWQUZZbTdVTi91am5ySHVVTFdydUJQUGdTT3RG?= =?utf-8?B?eWpzRWRkcG1RYldYUWpjTGFBZ0U2bDFBMEkzdWNpYkkwcHRVb2pXR3RyQ3o4?= =?utf-8?B?cEZCZzJLaFNYenNxYkdjWlM1ZXZ4OTcrQnlMVTZmWEt1UldtS2VranovZlFu?= =?utf-8?B?ejhNL3JhVkQ0WVhmVjlyb1JMK1NuL0pQaStWRnN5WCt2MVFVeWVXaWZPd2cy?= =?utf-8?B?TWlFSzYyU2MwVDlCYlpmUnBIekdWcy9mU1RnZUROdDN2WmlWNDhGdys0dnFX?= =?utf-8?B?TXVFbExtR05WRStJVDdYNWxTYUx3S2p0MWtxSEUvUzloL0Fqa1BwWTRVZDYx?= =?utf-8?B?UmpPQ3cxZ1QyOXNaTGJHVDVJWTlwTXMyc1lGOWxGaFUyYTRWbzJtMCtFNy9m?= =?utf-8?B?TUx4TFRURDVqSHI2N2JQTjF4d0kxSzFNZnpNRVlxb1FYTHpHY3J2ZFFFbjVn?= =?utf-8?B?ZGVwYXpNN2ZnaTFKM1Z3dlNtMzBiVDA4aUFuSW5BRmZ4TVJ4L3VLUElUaTFI?= =?utf-8?B?UVlvMDJlOEdOQThjQ2hSVkZHVEkvdzRsbjhqREZDbGczRmkvejJKdVB1dEJY?= =?utf-8?B?T29mQ1FMOFY5NW0wSk5uMkcwNzhCZFFEd29vbGs1cGo2dmp6c0l3ZjA0YzdN?= =?utf-8?B?UERNWnZud1ZWRmdrSVdBNW5OVWhyVHA1bzJPYUJGc202aEdsQlJCeU1rMkFx?= =?utf-8?B?dTdzMWRyWkJhMWNYQzNPWUw2Q1FsOHVzY3JNdDFBL1hXUVFWU2xOSGhHdTRB?= =?utf-8?B?YXRwcG1MSWltK2ozakMydlFldmxqanZCTm1PY3Zvbkw1QTZZc1VUM2RPS2RT?= =?utf-8?B?VitTSDFraU5KbjVSd05hUkpUdEtJWmlwNTkvUjkwUVkwS0Z4QTRPOUZ1cmI2?= =?utf-8?B?d2Q0UTdZdFFiMUFUMm1ZNkwwRXVyTmZRSTVOVUk0YzZrdXY1SUMrRTZEWmtP?= =?utf-8?B?djk5UG5oTVZ0SENUdnh5KytNTUVoMUlZWnprSzRSVytobU8zWkFkV3VYZWsz?= =?utf-8?B?WXBOc29wczdob281VUdoS2NBNmxpNk1HVkNybE5GTUV0cjlqalAvK0NLQXRT?= =?utf-8?B?dkVmeE9JcisyTUFvK0FLVGVsNkM1K0dHTm5jWXg1VmNaY3VrdlowVGsxK3hu?= =?utf-8?B?M24rVXN0MitBWmswcUdMTlFWaExzdDVtb1kxTTVVNEtuSlM4RGhoOGZ2Z1dI?= =?utf-8?Q?DdNHNb2FaniXOXXs=3D?= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: af0b3069-f579-4ffa-c4b5-08df38cd257a X-MS-Exchange-CrossTenant-AuthSource: VI0PR08MB10656.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Nov 2026 10:36:25.9231 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 3qXqoLDftBvmpYpefh3Co5idBuZ1f2PmUw6zpzNXlkUxMka+WPBsvdL+gJRJdxjssgEVj8FvvnMFbJEjmjEtbsf//Y00knIG4Z64Tn7oLsk= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB4PR08MB8199 From: Cédric Le Goater vfio_rom_read() can leak uninitialized stack data to the guest when a read occurs at the end boundary of the ROM BAR. Fix this by initializing the val union to 0xff, matching the ROM initialization pattern used in vfio_pci_load_rom(). andrey.drobyshev: This commit is cherry-picked as-is, with no modifications, from the upstream commit 402fd5a75659. Reviewed-by: Philippe Mathieu-Daudé Reviewed-by: Mario Casquero Link: https://lore.kernel.org/qemu-devel/20260602074446.1206892-1-clg@redhat.com Signed-off-by: Cédric Le Goater --- hw/vfio/pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c index d930ef46309..fa2ca0d779d 100644 --- a/hw/vfio/pci.c +++ b/hw/vfio/pci.c @@ -1153,7 +1153,7 @@ static uint64_t vfio_rom_read(void *opaque, hwaddr addr, unsigned size) uint16_t word; uint32_t dword; uint64_t qword; - } val; + } val = { .qword = ~0ULL }; uint64_t data = 0; /* Load the ROM lazily when the guest tries to read it */ -- 2.47.1