From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from OSPPR02CU001.outbound.protection.outlook.com (mail-norwayeastazon11023077.outbound.protection.outlook.com [40.107.159.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id E53C780E7E for ; Mon, 2 Nov 2026 10:45:40 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=olTWAx7rv5T/cOyY7A3yDVDhsCH1odxbLh9xWQ1ctpZOZPwrdt33G/zMzgU8U1nVYm//TLIrXWioXjxJAgpBFdfWCC2TymZGrRgg7B3ndd+nmes1radCgKS1/BW/aoTp0eFHkbWN0PoAFhxRZ4M8k3f7A1xYKwKqBLmUv4D0fPTFU/CpwlryjgoVArgJAhNzhFAMFnxYAlESubcO9KEHW8fGWb+M2K0um2q5xM7FnglWwYNAUKsDn/NbHa64zu8Q1Mfz46Dk8ZmzKFvkm7BgzS9jVWlKADO6a8xOvtRBhs/z08Xai6QJ72f7Ztbb1MBDP+QX0uqSUZaDvcgdzUwAhA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=y9hmoxz3J6fQZKLg/4Gd6ieGuZce8jRRwf7NFT2sf8U=; b=B+iqkBAi7W60unjyuQn7yhqTWQBewjwtWlKnWzo3cvd13p4mwG554d1OLs6SWsprDlAlLZkqtyER4Rs09U3ajtgG9Dat05r7JVU2AuQdzR97SkfTGKHFuE9sIFtokIysujvZHZLV6b1caY3oELhlONmIStkv+33/xKr2cy2sE8dhNXWO0lS0jIyHdGw1Qx4dJnwYpZkUBm6b7c7FnyiaXfJj0tylLnVA9aYij/4VpXSlRsqoUCTFtt7ljL6bCONWc2C45WbuhfnAw2AlN5weBdOXS3KUjtP5ll5+jLb/gZ78GqaAHStOBy++ZHXbh16lzNcMlE3n8iV2iYHihqcDdQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 69.169.224.2) smtp.rcpttodomain=virtuozzo.com smtp.mailfrom=eu-central-1.amazonses.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=sashiko.virtuozzo.com; dkim=pass (signature was verified) header.d=sashiko.virtuozzo.com; dkim=pass (signature was verified) header.d=amazonses.com; arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.onmicrosoft.com; s=selector2-virtuozzo-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=y9hmoxz3J6fQZKLg/4Gd6ieGuZce8jRRwf7NFT2sf8U=; b=Ht6CFzvRqp28uenftcYSReRQN5PFMFdptyX04aHhiOQY7Evz2NmpTV91pSwgYQaVU5fYNGQU8Y1xydsXpLDKrrW4Z7iJ3YrpoWpU4GezVt3GQx0LLYAMEWx9bQXh79UczV4Yixl5P8cC9m5tQZkxESPj5VyP1IeSQBa3YFoZRSs= Received: from PR3P195CA0003.EURP195.PROD.OUTLOOK.COM (2603:10a6:102:b6::8) by PAWPR08MB9759.eurprd08.prod.outlook.com (2603:10a6:102:2ee::5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.569.12; Mon, 2 Nov 2026 10:45:36 +0000 Received: from AM7PEPF00000051.EURPRD83.prod.outlook.com (2603:10a6:102:b6:cafe::93) by PR3P195CA0003.outlook.office365.com (2603:10a6:102:b6::8) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.569.12 via Frontend Transport; Mon, 2 Nov 2026 10:45:36 +0000 Authentication-Results: mx.microsoft.com 1; spf=pass (sender IP is 69.169.224.2) smtp.mailfrom=eu-central-1.amazonses.com; dkim=pass (signature was verified) header.d=sashiko.virtuozzo.com;dkim=pass (signature was verified) header.d=amazonses.com;dmarc=pass action=none header.from=sashiko.virtuozzo.com; Received-SPF: Pass (protection.outlook.com: domain of eu-central-1.amazonses.com designates 69.169.224.2 as permitted sender) receiver=protection.outlook.com; client-ip=69.169.224.2; helo=b224-2.smtp-out.eu-central-1.amazonses.com; pr=C Received: from b224-2.smtp-out.eu-central-1.amazonses.com (69.169.224.2) by AM7PEPF00000051.mail.protection.outlook.com (10.167.242.37) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.592.0 via Frontend Transport; Mon, 2 Nov 2026 10:45:36 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=23yjbh4k34hwzfubhuiim7m4inbd3ick; d=sashiko.virtuozzo.com; t=1793616336; h=Message-ID:From:Subject:To:In-Reply-To:References:Content-Type:Content-Transfer-Encoding:Date; bh=MPyvciO2BtljuggPPxSnNvNDc1E1Wzil2ejKJgyoIro=; b=UP6AVtDsfvz7zeM+b1OzivUv2EOsxeBz759DgZZIlSRkqoT1olEwBatxqOsVnFAk VY3BX9A5N/RqzN+/yUrq7t3PIcz1uxsfY9F57qV3+MQO2NpBKDR/yCV/K5C+gvaDXF9 MN0F+FTj14Zt9Q2P5iV6exFV76JwOpVGbUtfmgodhozYPX9qHCSw+5lwNLioAmC5Lq5 sLzWnh/O8xRF+QJBxIL0H7Lp9QxUQOBhtG7ZDebic7PZmtv5nL3xO6FeZlnWBIzXK3a s+ZMtZ6ujs1Oppg3P/uJAHuqmAOJ4iVcJTGXktb8RgeogI6BwqbZ21+oH22cmbggVUE dnbLFXSK8A== DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=qftdzk2dqsatjnlrq4r5brjbihpfcrsh; d=amazonses.com; t=1793616336; h=Message-ID:From:Subject:To:In-Reply-To:References:Content-Type:Content-Transfer-Encoding:Date:Feedback-ID; bh=MPyvciO2BtljuggPPxSnNvNDc1E1Wzil2ejKJgyoIro=; b=AYdUxn6ziEvQn55Df28jWuHx6Swkq0I0rkOBAalCpD2h+eEpMuK0sAm/Md3GX5cg o1ZWfRLrt1hz0ZiZYvWN9zm341h68wNKfrFcm+1zqP6h09kT0heQ8V5GIF8PuVYWm9X kzdS4KG2wZFwmeRjRhxz0KXM+D3Ogsdv9tZ6ffcI= Message-ID: <010701a19bdd550d-fca98e6f-0e7d-446d-b641-bf6bf78a0b17-000000@eu-central-1.amazonses.com> From: no-reply@sashiko.virtuozzo.com Subject: Re: [PATCH QEMU HCI-8.1 v6 10/34] vfio/pci: Reject invalid MSI-X Table and PBA BIR values To: Andrey Drobyshev , svt-core@virtuozzo.com In-Reply-To: <20261102-vfio_v1-v6-10-9bc7cabc850d@virtuozzo.com> References: <20261102-vfio_v1-v6-0-9bc7cabc850d@virtuozzo.com> <20261102-vfio_v1-v6-10-9bc7cabc850d@virtuozzo.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Mon, 2 Nov 2026 10:45:36 +0000 Feedback-ID: ::1.eu-central-1.2wRQJBpg9g1fGRYexx3dUuYGS25Bux+2TEOx72/m6U4=:AmazonSES X-SES-Outgoing: 2026.11.02-69.169.224.2 X-EOPAttributedMessage: 0 X-EOPTenantAttributedMessage: 0bc7f26d-0264-416e-a6fc-8352af79c58f:0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AM7PEPF00000051:EE_|PAWPR08MB9759:EE_ MIME-Version: 1.0 X-MS-Office365-Filtering-Correlation-Id: d82885d3-9552-4564-06ae-08df38ce6dc5 X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr X-MS-Exchange-AtpMessageProperties: SA List-Id: svt-core@virtuozzo.com X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|32142699015|61400799027|48200799018|376014|9140799003|4143699003|56012099006|5063699009|261009223027099003|261028144727099003|261021121427099003|261026140227099003|261022105027099003|10067099003|16102099003|55112099003|18002099003|22082099003|4113699003|5113699003|13003099007; X-Microsoft-Antispam-Message-Info: v/RFchmJ1yLNL1M+/OoR57+zVkJhnOYxqcEBUn0H6ToYOoVt3/AZoWLkYBdA6M4873z5VHurS1UFTxF1gVxJVs8ovqhvEqHHRT2BICUyDd21Ee/Z2mt3e2MoFlIOnu1TCyflhObpwH/SElMfHOaZaZyK53s86O0b/sqBdUw689e2Gxomg0WGf+bXs5Ew0xE5LGOhHqsK2n83hMaWZixn2DSTcZJ0WyUJs+GDykuErqoIIGzFz69tTKn4G6UUkboDwN8kXGvoNPAHD6+DE+GsVZd5vgkJJueXt3S1G2lp86kH+FGSDbiSJlRP7rYkptZQ2Hao4lTy7xlQULsoiyeFn2d1OnIa+sVxOIqrmPcPvIcx1Olr4s1BwsrL8OguGWgsIk5not2tyJv1gtUjBuqdH2hrWLteYEpwGrai5FSXa9c6rVEweX3hOpKi158r8Jnkrp1ZdWeCUQROmWQYFPVVQKs1QtyP0xCEpE8DnDAKeMpuA4YAuJ2wmo6tjzk+l7NrvFM3/yy1Su2jRPLsfMwczCRvlsp0FLzTdifhv95/2rsh6cb8StMEBVXgDbkg7pPrHYtkcfHvNJGYhTOVYszcN1a/C7aaW6UWuLO7XaFNpL81cnBHVPhJk+dYanzzKE5pcQq6sIGQhTFoJ1/W0zQynp8UGNPx6vbTg19MKwiK6fUAzSJommrjfUI0LCTT/vUE+V11aXt5jqMG1a8RaiLTDBOZe/Mq5NIdtyNGND5fpSknoCigjBnfUBLw3SMjDPwiC7AQciXOTuJFMUqbzQpaf6/zqGvZv8LFaoOs6OiYEyUkU7VzpahRUfD1ZG/dxqxzwxDKFflD6ViO6w1s+JpaXFuE2zPgvUMCcypNWyh98rOD3YfvSaGB+5Y5XkDq9h6g3ujyv6U9/bXKGu5J55uKYL6TLxZ5T7uO2TyJVFHerrhw26An5ieWVFpCOFCj7CNH X-Forefront-Antispam-Report: CIP:69.169.224.2;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:b224-2.smtp-out.eu-central-1.amazonses.com;PTR:b224-2.smtp-out.eu-central-1.amazonses.com;CAT:NONE;SFS:(13230040)(32142699015)(61400799027)(48200799018)(376014)(9140799003)(4143699003)(56012099006)(5063699009)(261009223027099003)(261028144727099003)(261021121427099003)(261026140227099003)(261022105027099003)(10067099003)(16102099003)(55112099003)(18002099003)(22082099003)(4113699003)(5113699003)(13003099007);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: GG1WQxkfL03X0bZWpw7vT2SHH5NkD7kCccyuoZQbNsLqZxhkExVQyKrDAO3c742O6iWfTFEP8MfwieQ+YeE0Eq1UVf3vBRRg40VEzjauzkFTupoIMBqi1DDw/98q15byiv4iDB7oaTe5XYSL+4b36c8HmR0eNQu7zdxMKwuYa2hc5CxyIfyEXx//+DwX3Zc1qfPeqf3mh7InoBtPdYon+qgfnRkWaqrD1TRbtvA0IVZG4+eTwiUblBuyfSrSd8cME4ehMMKVDDHCv9k40p8urMRfUqP2OXRhm8znyzbIkJ5vaE7KUonTHIR7O53PUJrboyKqVvYSm8AFiwv4r4qt8tBOlV6xMBFurIgmKFuhdxuhSifQRox3azXVlzjw9TOErkejQWbEcGYi5eo3RmOdYNMH0mvvZ3gX9twjMbH/5nX0xhRNvdMeqs/SbOqIM0jl X-ExternalRecipientOutboundConnectors: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-Auto-Response-Suppress: DR, OOF, AutoReply X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Nov 2026 10:45:36.5230 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: d82885d3-9552-4564-06ae-08df38ce6dc5 X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-AuthSource: AM7PEPF00000051.EURPRD83.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: Internet X-MS-Exchange-Transport-CrossTenantHeadersStamped: PAWPR08MB9759 > From: C=C3=A9dric Le Goater >=20 > The 3-bit MSI-X BIR fields permit values 0-7, but VFIOPCIDevice::bars[] > only contains BAR0-BAR5 (6 entries). An invalid BIR value of 6 or 7 > can cause an out-of-bounds array access (CWE-129) in vfio_msix_early_setu= p(). >=20 > Add range checks immediately after extracting the BIR values. >=20 > andrey.drobyshev: > This commit is cherry-picked as-is, with no modifications, from the > upstream commit 9daa7347ff25. >=20 > Reported-by: Feifan Qian > Fixes: 65501a745dba ("vfio: vfio-pci device assignment driver") > Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3878 > Reviewed-by: Alex Williamson > Link: https://lore.kernel.org/qemu-devel/20260706161334.2165482-1-clg@red= hat.com > Signed-off-by: C=C3=A9dric Le Goater Sashiko has reviewed this patch and found no issues. It looks great! --=20 Sashiko AI review =C2=B7 https://sashiko.vzint.dev/#/patchset/20261102-vfio= _v1-v6-0-9bc7cabc850d@virtuozzo.com?part=3D10