From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from OSPPR02CU001.outbound.protection.outlook.com (mail-norwayeastazon11023081.outbound.protection.outlook.com [40.107.159.81]) by lore.virtuozzo.com (Postfix) with ESMTPS id B3D6D8122D for ; Tue, 3 Nov 2026 13:57:45 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=daGW6/ShxKngMy+2XWWlyTo5DOwccyFPrmybOfscsRNy/SUQ/ri+3PGM96cNSrrLeKX478+nltNPIdBF5l6tJRko9laqWla5Aw5iiHSCkJuxUKezflF+qjRfUI6+GtI4kgk/w81NF0ODBPce/8Bc77eaW3k22cpS/W1O2hliS18plgtEvNRdoOOvbc3g5/HYlPIP4wYPoNaAx5AnokNUOsf9bwkrbcYNXTDEOdFnM0kRvgFPZqi1d0CZ10whVFrwrW3A8d6QPxjt863y61RURrJ36f8utot2fWjm2rGbAPuFd1UllRXhHjjQfc+aS1EEc6xA9CJ1k7rlgJTSpRYujA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=9n/f58Cfww7ExcwPHWCumaxgk4jzvGlue5epPFjzeyw=; b=LLybXo/tBZON6XihtWtDvcSLfdb6R2c8ulPlWLW8TdEQeZ6YP9qDTy37sIIGOsGxhsfVUCQjZic+IMIYtU1w7p4AywlviVRi6w2tcw+HcPgpwvvivoiCZC64U7JpfNgXl4SGEISZAnQTOBuskrhz4wNUqcRg3iCOkbLRLl3mBuL4Pbx0FFjSsH0F73eD23N8w16dc1i06p4ZBFzcMmx9WyWc3jI47A1vYHaSU78yayivA7WCq6a50sC4GDwAQk89EQp4GqbuZINCef+LiGnliW/HTJP1ESHXlZNof0GgzFdojIh6Cado6psqzs+lusNSt3u/p4X7spUBLRkKuaOL6A== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=9n/f58Cfww7ExcwPHWCumaxgk4jzvGlue5epPFjzeyw=; b=LVLLsW6jINd71xJTeWaTMBVn6ajp67rtVSXC6yBpElPPVibtqDiGfz8L2KS9GBnGVQ3oZGindeOMl//kHFjXPd+vUrpQ+8m+tFZT3c10wt+c6cRDRMewksOo/bDogQslT5fu8ZXdCDrQgJ2r8W7wappXahNtiZoyLGi+OSRy7XJwHkKaIjVndNb92PpJQopPL3kHmS3Be47/SaL0OUmNJowCpiUoWLMai+YqLFCOdkSstMWStYPWtOePj6a6arYBMY/6bM2WoIg0Cv4XJsHFY7RYLW3YlqKwL/aP8EfSLGznZ3C2TQzaizJsv8Yubng7qGj/9cr5f0bgvxSeGU/wZQ== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) by GVXPR08MB11741.eurprd08.prod.outlook.com (2603:10a6:150:312::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.569.12; Tue, 3 Nov 2026 13:57:40 +0000 Received: from VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8]) by VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8%7]) with mapi id 15.21.0569.011; Tue, 3 Nov 2026 13:57:39 +0000 From: Andrey Drobyshev Date: Tue, 03 Nov 2026 15:57:26 +0200 Subject: [PATCH QEMU HCI-8.1 v7 11/35] vfio/pci: Reject invalid MSI-X Table and PBA BIR values Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Message-Id: <20261103-vfio_v1-v7-11-4467fdccbbe6@virtuozzo.com> References: <20261103-vfio_v1-v7-0-4467fdccbbe6@virtuozzo.com> In-Reply-To: <20261103-vfio_v1-v7-0-4467fdccbbe6@virtuozzo.com> To: svt-core@virtuozzo.com Cc: andrey.drobyshev@virtuozzo.com X-Mailer: b4 0.16.0 X-ClientProxiedBy: VI4PEPF00000153.AUTP296.PROD.OUTLOOK.COM (2603:10a6:808:1::86f) To VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0PR08MB10656:EE_|GVXPR08MB11741:EE_ X-MS-Office365-Filtering-Correlation-Id: 0aa6a8c4-1b1b-4c81-9ee7-08df39b265f3 X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr List-Id: svt-core@virtuozzo.com X-MS-Exchange-Transport-Rules-Loop: 1 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|52116014|23010399003|1800799024|376014|366016|38350700014|261021121427099003|56012099006|261028144727099003|261026140227099003|261022105027099003|261009223027099003|10067099003|18002099003|22082099003|261102123227099003|5113699003; X-Microsoft-Antispam-Message-Info: F0BKgJ3sCYtimaq41bsg2gmaj2+pu9gWCrK844c63re5R54pmvTCmiB4dmjH7wU7K56eV96PxAewOSZ263GcKDXQ4czCDzSCyNRvWjZFYHnDV7q+ZfqenVZvfkjowyDbgwS2mdWW1yDmpMbz4KqWcynS6o6LRm96kWXUGuOu52ZnyAAzs/r6FUe26n+pyEEcJv9JpAGPqEqGuWEjjyXq8gKkRn5XafI+ZUyAZPseT4PgtnrbyyuwY9Oux/LhXccqeQBDxjIXP59qIR3Cwmo80rg3PfLzxwG81SaVmO6kh7JQhr9QM3RQSZRL9wz+AXG34fsJfcFwHZDSLEcJ+cUrzXTSqVnXeRHKEwphbyKUxoNmK7bjddsydV9sCXMTiXZi8xXPtu5G7U5/sFEQEIL2BiKgecdeel7K3M1pIEapYNZ/6uqxNcI3vJpe1VV/60Ub1sbhnPSsj5WGAtXzOmk+bb9n2WKeyQVkUg0IY53UGZdQU5p5U90MS2Mhfe+HLWVzJq1JSqwrZrDzo7lXA18W0kqPnkLcmxYKRzAUKYu7QfkWH4IpUJYiinTnDK2cMKAXtnlMImmgSQwmI3AciYmS+JHDmOnLsam/wMWYYtAm6oUNN4eUMmIBwKs61efdOdn0j7ZDtpqYs+o9PxdcagxKXOzfHCo01cdGKeHPRhZDE/E= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0PR08MB10656.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(52116014)(23010399003)(1800799024)(376014)(366016)(38350700014)(261021121427099003)(56012099006)(261028144727099003)(261026140227099003)(261022105027099003)(261009223027099003)(10067099003)(18002099003)(22082099003)(261102123227099003)(5113699003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?cWpwSzZPejNuajVEZXpnRmlWQ2t5aDVqVzhZNHM5QStlNnkxdTN3OWQ3STJx?= =?utf-8?B?b3g1RUk2b3hQRWJNQ1ZucDdUaXB2MmFLZm1EakVyNVNRa1crT1NSemJURm5J?= =?utf-8?B?TXphRU1NZk5yTHZUY0RubzRSOXNienRYVDFPZjc3UlNZRDE4VW9ZVzZCZG5a?= =?utf-8?B?QnZyVEs3UkFNM1lPQSs4ZFl1enQ0WWVQSjRqQjlJMW9acmVQRGVCekFRc0Fm?= =?utf-8?B?UmlNOGRxd1lDVDh2RXlrM1NQZXExQk9naDdheUVwdjZiODBVeEl6T1dLSTZz?= =?utf-8?B?b2JJdGhnTXBseVA2ay9YR1ZzeXhTTFR0a1VGem14cWRjSnMzN1VUT09haG1C?= =?utf-8?B?UXVaUWdObE1mUXdyRGhyRTRxVmxZL2hpZTY2ZUxHa2l5bk1lNUhDVUZsNkUx?= =?utf-8?B?WHRQM1o1dFRORjloeUo5NEJVVTNiTEJWaTM0WXN6TnpYVmNPL0V1NEIxVGxD?= =?utf-8?B?TFJiSUFKM29GUk9uOXJuaGREeEZ5aFF1YytlWFViMitTY3VIMzVnWTdYRlR2?= =?utf-8?B?UWp0QTN2SHZBcFFwS3N4ZUJDUmJ4Y1dCQlhSSmNjU08xcFBuaEVmSEN6YTIw?= =?utf-8?B?RlNWZmZTMjByS00vRmZjY2phQWlLQkwwS3J2MXFPTFlUZytkU0o3LzJqTm1E?= =?utf-8?B?M2sxR0xDUktqMWsyQnh4Zy9mV05HS3B2MVh0S1BCSHNOdXJwdmo4cEJQUDUw?= =?utf-8?B?V3hwZkdkSHNJaDJESE90dWo4NHp1UmhLL1l2WWlvSFBCRERBN3FwaDY0WTFx?= =?utf-8?B?V1FYSzlzS1BrVldKMEV2cjJiZjJua3QvYVVrb050YjR3NkovcVY5L0daSnZ5?= =?utf-8?B?cW03WWgxcDUzbGNkcEJBUVczNUF1dTQxQVVYZXFDOWt0eEJDaXBtcTgyMFNS?= =?utf-8?B?a1hyYmNnVzk3Z1loSUhxVHJFUndmb0xHdUttdXQ3cVZxM1orbEsxS2hIWmZ3?= =?utf-8?B?dW5SdDJiZnU5WVhPS1VuWnVCb28vMFl4TDFsMXAxY0FqSjNlMTlIazV5SXVG?= =?utf-8?B?OUN3R21PU3NEaHhVTHU4aWJRdlBQM2x5OUFJa01oTHpYU2hSTDRQNHZtUUZS?= =?utf-8?B?cFdMYkc1cHJHYU4xSGVyalhSNi9ET2srcXgyN2d2SHBaWDNhVm15Y1VZYUpU?= =?utf-8?B?MXVxL1h1Lzl5dTRUVkk4NVQxU2EzdzNBOFZ3RG1hbFF4WjdFKzdrQXN6MlFI?= =?utf-8?B?TUtnT1Zqbk52VlF3OGNVN2xhSWdzbTJSVDJDYVNXRVk4NTNxWlVVaFMxc0I5?= =?utf-8?B?UlRBMSszcFYzeHRZa01UN1BxSWxHWDQyL0RSYVg4dXZGVEJWNURFR1lJOUcw?= =?utf-8?B?Zk53QlhuOGJRTWU5ek8zNU84aDJZV09TRy9PdmVDbzFiNnF1N21GUVcrWUIz?= =?utf-8?B?ZDJJY1NPTCt3aGIvd280d1F2MlNoTlZZRGhocjNLeGpUOFFzelp1OHVpU3hl?= =?utf-8?B?OXVJdnBvTXdMVVMrUTVDaGdyaVlMVElOK1YyVDk3T0dycW5nVFp4NW1ZVzRL?= =?utf-8?B?U0ZUcDM4NG5qMENHNXlmYmlFNXRFU2IyN0g5OUpxR2pDeGhwZ2hLd0hnMmtB?= =?utf-8?B?WEdMdkk3eGs5UU9TVm1FY1F0dW1SZ1BBTmhzRCtlRFYvTzM2Y2IxSkRlNWVI?= =?utf-8?B?OSs5OG44NGhuRGdNdXNnekt6SHVJQVJBUFlUYzBrNzQ0NGxvMkVCS1JGSG85?= =?utf-8?B?SzFmc0Roa3dLVXhJWHRQWGYxVEhCSnVqaWplZkpUMEQyTzRKQzFzczQyQUhL?= =?utf-8?B?Y2M2TS9wV1FMblFKM1FZdkMrcXoyczc4WEU0d2p2SDc0UHE4UWNiMUFFTnQ2?= =?utf-8?B?K1FORjVldlR5YjdlaE51V0hwMFdicURLZC9aVnNMY0tFVmhhYjIzVHFDemRn?= =?utf-8?B?b3crSkN6TnZhLzhMa1BpK2g4d1k0WlVveVcvRjlvS3hLRTNybDd0aERKTC9O?= =?utf-8?B?YS82a1VId0gxU3M2ODhjSXgwR2RDem1KNGZaSVpsVEtZS3RVWWhBTGJhSEEy?= =?utf-8?B?d01XbkVTclR0MHkxNituOENwTjN4SXdJdlNzVFVkeVpQRkUyMWhUUXBwVlFJ?= =?utf-8?B?eDhYcEVjc0Q3YXg1V24vaDRteHNyVXl6QjhDTWFHb2hQZ1h2alFNM0JpRjNT?= =?utf-8?B?U0t4eTFvTllWUWhZemd1Wll0bXRGd2ZlaFpQeEVORGpKSzR1V3NxN0o4L2Ir?= =?utf-8?B?alhlMUJ5Mi9DT05ZNXUyMVlwNWxCcHAzZnlNcHlia1dXb2p0R1lHcjlEdHND?= =?utf-8?B?OHhibzZFRUhPb09RSklKY0lTUFNlakRmRDVvbTRXZFdBS29ZVTFabXAxUTZO?= =?utf-8?B?M05GZjIwWktoc1ZDVXQzbWlwTjNKdDRZbC9pYVdQYi93UjRkaE1pdzFkN3p5?= =?utf-8?Q?JgnxTgVJn5cgDk1c=3D?= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: 0aa6a8c4-1b1b-4c81-9ee7-08df39b265f3 X-MS-Exchange-CrossTenant-AuthSource: VI0PR08MB10656.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 03 Nov 2026 13:57:28.8310 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: faKPuJbGS2DBCrtyoUYMFahHpEPl4sMeIs67VkXj5yEalQkvWRP5ypawaHwslCaZWn8oIig5bIeoruAFCLgbf4u1wlFUn5/SNJ0LR1NotZw= X-MS-Exchange-Transport-CrossTenantHeadersStamped: GVXPR08MB11741 From: Cédric Le Goater The 3-bit MSI-X BIR fields permit values 0-7, but VFIOPCIDevice::bars[] only contains BAR0-BAR5 (6 entries). An invalid BIR value of 6 or 7 can cause an out-of-bounds array access (CWE-129) in vfio_msix_early_setup(). Add range checks immediately after extracting the BIR values. andrey.drobyshev: This commit is cherry-picked as-is, with no modifications, from the upstream commit 9daa7347ff25. Reported-by: Feifan Qian Fixes: 65501a745dba ("vfio: vfio-pci device assignment driver") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3878 Reviewed-by: Alex Williamson Link: https://lore.kernel.org/qemu-devel/20260706161334.2165482-1-clg@redhat.com Signed-off-by: Cédric Le Goater --- hw/vfio/pci.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c index 5e281b2e1d9..d930ef46309 100644 --- a/hw/vfio/pci.c +++ b/hw/vfio/pci.c @@ -1791,6 +1791,14 @@ static bool vfio_msix_early_setup(VFIOPCIDevice *vdev, Error **errp) msix->pba_offset = pba & ~PCI_MSIX_FLAGS_BIRMASK; msix->entries = (ctrl & PCI_MSIX_FLAGS_QSIZE) + 1; + if (msix->table_bar >= ARRAY_SIZE(vdev->bars) || + msix->pba_bar >= ARRAY_SIZE(vdev->bars)) { + error_setg(errp, "invalid MSI-X BIR, table_bar=%d pba_bar=%d", + msix->table_bar, msix->pba_bar); + g_free(msix); + return false; + } + ret = vfio_device_get_irq_info(&vdev->vbasedev, VFIO_PCI_MSIX_IRQ_INDEX, &irq_info); if (ret < 0) { -- 2.47.1