From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: <010701a1a1bb1986-2f983c10-1b57-4161-a771-6386c1f1cfd1-000000@eu-central-1.amazonses.com> Received: from DUZPR83CU001.outbound.protection.outlook.com (mail-northeuropeazon11022091.outbound.protection.outlook.com [52.101.66.91]) by lore.virtuozzo.com (Postfix) with ESMTPS id 1E76180E7E for ; Tue, 3 Nov 2026 14:06:00 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=We/NHdZI11DG5PK4S9tDm4xmtFz3mTXo5P8THxPy/g9vQb+AmY7ZMwTryCPhiFaOB8FEzze7RUupdvkVU5BqFxKuk12kKnVmvUpIpA1Tjs/wP66g/Jk8LhxPozHNEA0mtuE2jlFM3iednQMwVRTckAWslZc+KY0dAYg/7CQ/H7keUkrBlLJG6DSvzDIwG6rVB8w3uy5y2lpEFsQ0gS5ypIB3iltLktvSEjAgSIQCtWwgYBTWI7XtpBgkaK1n/loHembVZlJ8Iq0kqv6St8ais36siK4iF+x6spIMF6YFWQbyU5OantPOvom22y99MoWL40zw3qfGk+Sf8p3WHeFACQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=iumMNAaLnTE0J72gXPhiTpHoCW+n1rxdEdG2CSmCI/s=; b=BeHjsbFpD2FrMlNIKCTkJBRtzYJ5s4T8TYSehSo/KdpS90itPjhBnHKj3XIieTA+3qpD8oW4H2ukB4iyA/FWWifStH2yxnk2wVvXZkDCL7UNLHFbFALwrGWomxt3TSZVhhkn3ZZbNjMLV3e0BAs9G65baKEqi+q5lCXGRla6gT06C0RdCyo0wpXCFHWTVSgXiAwTni9oPyWd/qrCe31Bc6VzxUDsoBCwyncTL6RltCJIcvJudAN+/A5umHdzw3C3JZ6DR8ouMycfYDNPi25svIayxV1RcAA36K8pwtSlZ+Jeh2hI+fno1z2YrRPnAc7/IBONe4X4Gj1b2P9C4Tjz/A== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 69.169.224.1) smtp.rcpttodomain=virtuozzo.com smtp.mailfrom=eu-central-1.amazonses.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=sashiko.virtuozzo.com; dkim=pass (signature was verified) header.d=sashiko.virtuozzo.com; dkim=pass (signature was verified) header.d=amazonses.com; arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.onmicrosoft.com; s=selector2-virtuozzo-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=iumMNAaLnTE0J72gXPhiTpHoCW+n1rxdEdG2CSmCI/s=; b=Y54V1IRuu9SHuFaqBX7T/TrMOPnHUayMMqpZdwDFQyqu3bMmTlNBujKgrM/5v2qoEWo6OXNSNSPINqtDxotAJoyDy8Zvb+xlaOhc4hLjy2zdF1q6uCxlPSVe2L6MzLEBbzKxZs9kULLhnH2xw8ytomgR7rA/MlXBg4LH+8MGfmY= Received: from DB9PR02CA0023.eurprd02.prod.outlook.com (2603:10a6:10:1d9::28) by BESPR08MB585688.eurprd08.prod.outlook.com (2603:10a6:b10:144::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.592.8; Tue, 3 Nov 2026 14:05:56 +0000 Received: from DU2PEPF00028D02.eurprd03.prod.outlook.com (2603:10a6:10:1d9:cafe::a9) by DB9PR02CA0023.outlook.office365.com (2603:10a6:10:1d9::28) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.592.8 via Frontend Transport; Tue, 3 Nov 2026 14:05:56 +0000 Authentication-Results: mx.microsoft.com 1; spf=pass (sender IP is 69.169.224.1) smtp.mailfrom=eu-central-1.amazonses.com; dkim=pass (signature was verified) header.d=sashiko.virtuozzo.com;dkim=pass (signature was verified) header.d=amazonses.com;dmarc=pass action=none header.from=sashiko.virtuozzo.com; Received-SPF: Pass (protection.outlook.com: domain of eu-central-1.amazonses.com designates 69.169.224.1 as permitted sender) receiver=protection.outlook.com; client-ip=69.169.224.1; helo=b224-1.smtp-out.eu-central-1.amazonses.com; pr=C Received: from b224-1.smtp-out.eu-central-1.amazonses.com (69.169.224.1) by DU2PEPF00028D02.mail.protection.outlook.com (10.167.242.186) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.569.4 via Frontend Transport; Tue, 3 Nov 2026 14:05:56 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=23yjbh4k34hwzfubhuiim7m4inbd3ick; d=sashiko.virtuozzo.com; t=1793714756; h=Message-ID:From:Subject:To:Cc:In-Reply-To:References:Content-Type:Content-Transfer-Encoding:Date; bh=NwKE/3UI7p13284I02KFa4FkdbFbmNXRVYwe7OYOWBU=; b=Pk/4TvnAoe7plIkiTCBMG3wGL8QCvqAZ/zYl2kITL1Iq2vi6uSEnEhPprymSb/E5 XSdQqeYwR7IQfI1fRpHwtEXMgfmI2oyzwchx+/HlZ+nSllFcdOeeDdYgfAxiWMhWILV ZKWAF6Xktknaj3acpkA3fCqZIPCHHw3zZTOl7a77d2ceaXzTAnn0Xv3MiORTfWUVmB1 jxPp0JO2kCxaIX4OHgDtNDzvZpxyYL5X8LqmRtZV2Ws9obklk/9u6ed+Zqaad85GSy2 LJ8FTEFp0imyVx6BX5FDAUfOXP3iEm84J7edZR2MU9WXDjs7fFcbIGjVxoxd9jcoMZs MqiEXkFVtg== DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=qftdzk2dqsatjnlrq4r5brjbihpfcrsh; d=amazonses.com; t=1793714756; h=Message-ID:From:Subject:To:Cc:In-Reply-To:References:Content-Type:Content-Transfer-Encoding:Date:Feedback-ID; bh=NwKE/3UI7p13284I02KFa4FkdbFbmNXRVYwe7OYOWBU=; b=UJUADajSUnPlF8Afi1o7vJYzjcyMrnDuKX0D8DywPqDJcgMMjs87jdRCWnuFL25/ CExaMQm0J78yFjzv3irpgUNFGiUFSQV4cTOtOvSXjHLwNdSsd7s+rMgfClh+JezdbGT FUibrEwZfFrTc/qpRzH2dJI1UvXMzIq4iQ/tQ/w4= Message-ID: <010701a1a1bb1986-2f983c10-1b57-4161-a771-6386c1f1cfd1-000000@eu-central-1.amazonses.com> From: no-reply@sashiko.virtuozzo.com Subject: Re: [PATCH QEMU HCI-8.1 v7 11/35] vfio/pci: Reject invalid MSI-X Table and PBA BIR values To: svt-core@virtuozzo.com, Andrey Drobyshev Cc: andrey.drobyshev@virtuozzo.com In-Reply-To: <20261103-vfio_v1-v7-11-4467fdccbbe6@virtuozzo.com> References: <20261103-vfio_v1-v7-0-4467fdccbbe6@virtuozzo.com> <20261103-vfio_v1-v7-11-4467fdccbbe6@virtuozzo.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Tue, 3 Nov 2026 14:05:55 +0000 Feedback-ID: ::1.eu-central-1.2wRQJBpg9g1fGRYexx3dUuYGS25Bux+2TEOx72/m6U4=:AmazonSES X-SES-Outgoing: 2026.11.03-69.169.224.1 X-EOPAttributedMessage: 0 X-EOPTenantAttributedMessage: 0bc7f26d-0264-416e-a6fc-8352af79c58f:0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DU2PEPF00028D02:EE_|BESPR08MB585688:EE_ MIME-Version: 1.0 X-MS-Office365-Filtering-Correlation-Id: ac5db7da-9a29-4d31-24b6-08df39b394b0 X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr X-MS-Exchange-AtpMessageProperties: SA List-Id: svt-core@virtuozzo.com X-MS-Exchange-Transport-Rules-Loop: 1 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|32142699015|376014|48200799018|9140799003|61400799027|5113699003|4113699003|10067099003|22082099003|18002099003|16102099003|55112099003|56012099006|5063699009|4143699003|261021121427099003|261102123227099003|261022105027099003|261028144727099003|261026140227099003|261009223027099003; X-Microsoft-Antispam-Message-Info: HUQ+36FN3gRumOgA2koAfbB9seQZYGYtKL8GUpY8cTLBhqG+Fao3KbqUkN1UO7n9UyMRncJ/Qd/hMWhejuCVi97qXLIpb0AIefIFtXfz/mB2N5ATi9Y9jJ0mCWaY3EunfulhXQnC9yQVqmz6RfbaXZqzHhqv9SIj8MAyXjHZIJxZsQJrQTqXx5ydHz8w1Gn9Lj/iKhPf072O5ahxoPBHrkY3ygvfpJSB9XoopFm3RlZTSUww6j33JsErz33BhcZhcpjzSTlvrn4pkwVokuBeml+mgw71D6URg/SI238O5p2nw4xz8JJM97DaNG1IvPze+XcnuLpsO7EDvLyBIBUdTwKh7vA1UymdySO/DRtwpd18TvdJjX9xNSNn5T+QIc8McrAu6vm0PHgn4VztQUTf9ahYKfrmphDtxxAgv0IxviWJUMmV4p+VWIfbx7gCQizoMOGJ1kOZ/r95iNbNHYPlfcvIG3qms1OeEH1lwi0u3bfuLYUhzDUxyDR/QsisM6YxcWZ1w/17AqGcbLMYYwKIWzrV1mnOBSF+6H1psusfoCxnrm0vUobJR3LOehZuuThT2vmgvVQkpczPwe2m2DBzUbL614+ORvruOhU1vJWexTwIIIP8Vg5sY5uZFlkr3lhMU4tobQDJTBHfyXCu5R7DDbqEAkhs/uxUl/BB7AFYWs/zztcfzcvT+Z57x7gNd2mPj84fknq06ULPefBkAEyLSYt+vEYZxsOqunrZqSGH0drhcl0AatZ8EMHQhRfRy1HktlMNsYSKeBOap8XdJ0KaORGggHzqnthSENTGJS/TqWehmOtaMGvRQRVK6bX+wZPy1KB42mvSTjB603RJfR8NlC95bB8JWBm2DEIMJkldED+sHl7wnJ1RjicdtSSSW/oZifXXFYyAFHMhQUhvKqVNIxgzKJyiOexVf8CTr/eXBKkxDQU3AsxBCbhYyenibqWZ X-Forefront-Antispam-Report: CIP:69.169.224.1;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:b224-1.smtp-out.eu-central-1.amazonses.com;PTR:b224-1.smtp-out.eu-central-1.amazonses.com;CAT:NONE;SFS:(13230040)(32142699015)(376014)(48200799018)(9140799003)(61400799027)(5113699003)(4113699003)(10067099003)(22082099003)(18002099003)(16102099003)(55112099003)(56012099006)(5063699009)(4143699003)(261021121427099003)(261102123227099003)(261022105027099003)(261028144727099003)(261026140227099003)(261009223027099003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: 6WFHHJxiE+8NH/IuVb4/pvPOWvNG5a6CuYrDPI0xgRgqiVrwDvXT3OCL9DVnAr39UXhRTO18mTy/PdxabMvMOy6Ip3r9spGdIZ0CFyNXjtYFL/b1wllsn8SVjLOIqA28TbF1TzQnFpcMJxUagBc6s1hygvN1UcyFO/DT07kD+4ky7YPQ0B+aZ1TIqvJt5nsd4agzNoRNiLjvVpespqLEgbjTh0zgA6drQnaszT/3MOLYIvsLj0N9fXL9sLdF4Sl2a9p5WVyYcRttbjaY2ixh+xWAWNbENnZLcVs+zvUv5PzdpBtebkKM4+T8GyRQoMPld94l52r1NFRNU2huHzw/3pyEuxlcQg0cJBS2LldH/t+ZzRO5LP3OpWAub/ktk+G98i1JKb5oKiZ0jvEpdkIrz+06pebUrc9jgPy0HFsxrVTpZAcm/srPytL/wMdWRONa X-ExternalRecipientOutboundConnectors: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 03 Nov 2026 14:05:56.5414 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: ac5db7da-9a29-4d31-24b6-08df39b394b0 X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-AuthSource: DU2PEPF00028D02.eurprd03.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: Internet X-MS-Exchange-Transport-CrossTenantHeadersStamped: BESPR08MB585688 > From: C=C3=A9dric Le Goater >=20 > The 3-bit MSI-X BIR fields permit values 0-7, but VFIOPCIDevice::bars[] > only contains BAR0-BAR5 (6 entries). An invalid BIR value of 6 or 7 > can cause an out-of-bounds array access (CWE-129) in vfio_msix_early_setu= p(). >=20 > Add range checks immediately after extracting the BIR values. >=20 > andrey.drobyshev: > This commit is cherry-picked as-is, with no modifications, from the > upstream commit 9daa7347ff25. >=20 > Reported-by: Feifan Qian > Fixes: 65501a745dba ("vfio: vfio-pci device assignment driver") > Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3878 > Reviewed-by: Alex Williamson > Link: https://lore.kernel.org/qemu-devel/20260706161334.2165482-1-clg@red= hat.com > Signed-off-by: C=C3=A9dric Le Goater Sashiko has reviewed this patch and found no issues. It looks great! --=20 Sashiko AI review =C2=B7 https://sashiko.vzint.dev/#/patchset/20261103-vfio= _v1-v7-0-4467fdccbbe6@virtuozzo.com?part=3D11