From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from AS8PR04CU009.outbound.protection.outlook.com (mail-westeuropeazon11021092.outbound.protection.outlook.com [52.101.70.92]) by lore.virtuozzo.com (Postfix) with ESMTPS id 29F2B80A86 for ; Tue, 13 Oct 2026 15:28:12 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=XNcNERb5pQCTCJIGUnXSrsXjtX2muxgTeItDzrnR+XRA8BfVcv6mLVbojsK9J6Q7mOH5RrKdF6A0qsiS5vAmSsWS6wncooa2HKV8iaVC3qMbupp6w2c7BlvC56H21l3/5E1UDqCIBOK54gtfE6p0X/NiBGogryx+ypVeE8Jtcl8fcv/xSNwMrOGrEjpXyEvPJaGxbHQBhqBI6JxKtqEr2T/ks3wYLfxfGdriMaH018zbvZJz1822cT+yJSQKNo5Sw5fuHRBKIK90kalIuDf4WI3wpjzmvBSu2DiGkqCUQhaPQhqKjUd0zIDGCW44GD/emZE19R+PQjn0ePqPpLQ1Og== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=GpyZeuzxBx/9EXW2jB4YPAzv27x1rv066ytK047XXLA=; b=EW0TxoWNkdGmCDpZyQy5fx4LzS9TGVmB2Cb1MV/dHMaEUeA6fnfYXwgmDcZWiwpGB5GgJKMFb7KW5qxQ7b9qtZudibylT8OGUeWKz1JUnER2CfkD2LGZOTuWtnfU3CDMjGHpox18US6osVLUegtbRtR0c8pugcp3cJgTWVkHEOJHOUhakeonridzLh5FZqv+2LI19f0ANs+o1521q1dqQXuk4MONDjYFLn/I3wpTimHZb55GRUi9lTiqhY681JUpB5d7+XJfWJP8vc9d83MfxiDaf1eTGRvsMhx/2x1iPW+oZdLQ4+ORabKvCaeM21+INJg4kvJFKLLOal4TWpwKWA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=GpyZeuzxBx/9EXW2jB4YPAzv27x1rv066ytK047XXLA=; b=oeJEy5TKQCfLjpuhPzdByzK/ihgfulPKKGOUkeye27LF9RWx7X1UizreM0rDs3LmxhVtk+7A7RvdhX/LnhY9G2ovA7IXu+C/rJipG5HX0I9POcudMh7B6y5S/wl997etHmwKnf3J8M+5jGNe0cBFweGpjLshm3AgyXrXF32OSpIqSlhPYhsFjnt8ECQsvZAN1Nft4zH3vUe/QGk79R/yEY5IrQTKD3XpLz6gPXjMiVKes+Gj2OqEazIBBjswykbl6yPTwqRWAmw90LdfW2qsxNuwL0OC7OqQQiekoTY5Q63mRFHBHTTv+jCIrHWdw67sB64taiRAya91tWozQMoJPA== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) by AM7PR08MB5448.eurprd08.prod.outlook.com (2603:10a6:20b:106::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.522.11; Tue, 13 Oct 2026 15:28:11 +0000 Received: from VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8]) by VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8%7]) with mapi id 15.21.0522.008; Tue, 13 Oct 2026 15:28:11 +0000 From: Andrey Drobyshev Date: Tue, 13 Oct 2026 18:28:08 +0300 Subject: [PATCH QEMU HCI-8.1 v2 04/24] vfio/pci: Fix information leak in vfio_rom_read() Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Message-Id: <20261013-vfio_v1-v2-4-433455c0a294@virtuozzo.com> References: <20261013-vfio_v1-v2-0-433455c0a294@virtuozzo.com> In-Reply-To: <20261013-vfio_v1-v2-0-433455c0a294@virtuozzo.com> To: svt-core@virtuozzo.com Cc: andrey.drobyshev@virtuozzo.com X-Mailer: b4 0.16.0 X-ClientProxiedBy: VI5PEPF00000939.AUTP296.PROD.OUTLOOK.COM (2603:10a6:808:1::833) To VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0PR08MB10656:EE_|AM7PR08MB5448:EE_ X-MS-Office365-Filtering-Correlation-Id: d620998d-d8dc-47f7-372a-08df293e96ba X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr List-Id: svt-core@virtuozzo.com X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|1800799024|52116014|376014|366016|10067099003|261009223027099003|38350700014|6133799003|5113699003|18002099003|22082099003|56012099006; X-Microsoft-Antispam-Message-Info: +qCk0HlG0LQxC2dr4zIMq5pH1ozX+WWF/xshWFpkxxTKLkNFKGunnoVU0yO0YGNF9Pl2au3fMNJFdJCCujDb0VcfKApjXnOLxWy9RKZku/k+9nq40VUox4vwEwHgAFTW0B+ixhDu3EiUN9m4frkx1LP5bkgiJjh/Oip+L5GNoIM1whikqgFTakrjAeLFdvjyg9ubGZ95D4Srpk/T5PIVVAOWtE2jK9jiS8T0pW4tNAzTc+0HiHcaGMN5Dg1GnlBPntsY3vWMSSKxp8gA/Y2+P0NwFD0tVCrbTpojonfnu6prJXg/IimWLyFspMNZBASD8/b1X1evE6jNsiPJ4F3KnKTx6t/+ivJsO9bQQV+EUpfrPQQuIHlhbrZ28KDlGF7e+udvEEa0oCRf1SM4M2D2qgF5OMrJFjsVs94alxUPzQB7piEA2f+SxdBTJlzrEB2S/fOV1Gw8MdfAc/GMXrHAGRafloY1P971jA/O+9HomS4nsBkXXedI1WLPEa5b+3d8RzGa8QgOI0l4g3ii5QYW7vEeeXH1fJ2BPAYqsf0VlbTFNCCsDQjd0B/IlqjH9NFbxhDldLGFPKvbFjHbdZBDDV9b5LAycxBWgEKj6q+sp+hvVhaEQv2whzGLV1HcAyDizmmMuZUnRWfoZ/OFGqiOHu3wxz8xCi5ZT89AcqmOtUw= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0PR08MB10656.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(1800799024)(52116014)(376014)(366016)(10067099003)(261009223027099003)(38350700014)(6133799003)(5113699003)(18002099003)(22082099003)(56012099006);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?V0pxcGMrblFsWGU2VkU5TW56bG85M01Ha0VmbVAzNmVTTmFPeDhRUW41Nk1k?= =?utf-8?B?UGJPLzVNcnh0VTBUdjhPMWNtb1ZETndBdk5id0lOTXloQkYzYklLY0FCZzd0?= =?utf-8?B?d3hCWjFlREVYSytsdnluaTRzb05wUW41MHpzUzZqbXRENDZ4Qmw4SEJ2NGFO?= =?utf-8?B?bzNDc3drd1JObVplNHRMdzcwMS9mUGUwanZ6NGNIN3EzUnJJV1N3S2hTaVhC?= =?utf-8?B?KzlSRStUaU84TnJZU0N0d2VvT1pFOFF4NlZsVEVJTVBTR2pVaWgwSDJJa2Zp?= =?utf-8?B?bjVreXltVDY4YlRsKzN4emJuV2lSYk1selh5RVJOalFxYkVlcjZXcncydVlv?= =?utf-8?B?VzZIZTVoVmUvZnlOSjVuYWNLdlFrQnVDR0ExelVYOUhRM3FKL0U2VnlDRk4y?= =?utf-8?B?WFFCc3B1dHhXL3VDWGRQZ0JPZFFzcHo4bFIxekc5L0VaZU5YNWJWQXBGOFJG?= =?utf-8?B?d01WZzZ3WVUvY3poQU8yRE1YR0JJbEdkbFpqWHpJbjgzOElOR002UE0wSUsy?= =?utf-8?B?SU5GL1dQb0tNZ1FjTnkyTTV3Sk84Y05IdHdsdGZDcldqb0R2RXRXMGhSdmpH?= =?utf-8?B?Y0FlZVlaVko2UEZJZmVnTnFHMzFaRjl2NFRBUGtjZ1BiWkRUZmFEQmozS2dS?= =?utf-8?B?eXhZOEFPb0hLVVRBUW5JL1NhNHdOdldUUytyMUhySE5BYXNSdm1YY09jL2dC?= =?utf-8?B?L2VjcmowQXNpeHZQVDhQK2d0RjdzN2xDS0VnM21PSUxCckVOZWxpd2F2ZWdE?= =?utf-8?B?NWZGWElHU1FKcE93Tmxkd3JncEZlRktITzRZc3pGKzQ1ZUF4NUFQdFB6ZTBZ?= =?utf-8?B?Zm01WlU4YUJxa1ZZRVRWTk42V1JlL1A1Y2h5Y1FrekJ3alBwZzY4cUluakcv?= =?utf-8?B?QWxKby80Tm95YkQrZzhJMkNOdU9HU0lOQVN3eHZ3T3plMmVzTkRsTlI3djk3?= =?utf-8?B?aWVEV1o5RGl6alJlMTJraEZIT3JHM04zRTh6RHFuWXhyb3lGVWhDUkV5enJS?= =?utf-8?B?bWlOQVlNNm9oRzczK2VzdE8yQXF4OUJWN2NGOHA1dlZqdFlXRmdELzBydkxH?= =?utf-8?B?WFNQTjZvNHE2dWlFUXJlWWJOUkJFVE5naXU0a3hhdytFMGtLRTlyWDk0Z1E4?= =?utf-8?B?dU5YLzZFbFNUeDlNMC9pbHVJQU55OC9OcGQwMUxONXJyOFpLSE9wVTVUdzJV?= =?utf-8?B?MkR4Z0ZDanFyL2k5R3RRVWNJb0MvcFZsNk9nYzBucUtWWnZ6VENIRC9UZU5n?= =?utf-8?B?bnVSWHJmajNqZE5UVFlUWWVXMjJlR0lWRW5RemFoNE5qcXl5K3l6dFNWUUUx?= =?utf-8?B?MjdTZ2Y4Z3dCOWdueEtiS0RuVFdBUGlKUDRkcEpqS2wzYnNkMy9uTDZ0KzRm?= =?utf-8?B?WW9OYXlGTGtRUlFIUE9hSWRuUkt6ZDRSYlUwWkhUR1U1M2NoWkZSb25lZVBC?= =?utf-8?B?SHphb21vZjh3RjFoSCtXeG45YnVqSHBwRjZCbzlEQ2ZLcS9hMnlCZElNWmtw?= =?utf-8?B?cTUwNlFvNng4RytBZ1BFSk0rMXdOOHBsV1dhQW1UcjY3ZW9icjR4K3d1bnRq?= =?utf-8?B?OUdBdERPc3pYTEFKUk5KdUVJNzdrQ0NrUHlBT3UvUVd4azRheU5YcWhBQTVt?= =?utf-8?B?bm1UeHJ4Z3R4L0FEQjNlZ0FHdlcwZW1qMmJpaXhGem5IUjFoakNWZk1CYms5?= =?utf-8?B?eGtwK2EzenRZMTRVYTdTUGZMdjc4SjVZVkpNZzhXMjZKcVZjZ2xhWWtxUnJM?= =?utf-8?B?ZHJka2V2NE1DdGNBdW9nRUF1ZExjK2YwTFhCVFcrWExJeWxpRGpyRS9YNUFM?= =?utf-8?B?RTdHWWhId3gveUtCYkNKbEZCU2d4NzVVQUc5OEVFMGxVaWFZMEQ5NjNQdUNu?= =?utf-8?B?SExycWdpbS9RUXlodW01a2RRQlY4OEVtRmVUekd4NWVnUjM1T3JmNDhBTVlr?= =?utf-8?B?NGd4TVN3eDRuUlJrSXluOUhSaTV3emR2YzdSeERORndGQTIrc1AzYzl0WUV4?= =?utf-8?B?ZDZwRGJRVHJqTkZIQ0pxRGxWbjVlRHUzeXdUdW5OWEZHNkxiZjBoM0Z4eXNo?= =?utf-8?B?ZXd0RGRxYkpDR280Y3ZUR3FKMlFSdEZOY1Vodko2N2NFMERCdURUU0RGeTI0?= =?utf-8?B?VWZJWFpORWxJd0FUdlV6dmtTTytBbnJLQ1pDL0c2bCt5QXRsRXo0L2VuUDFa?= =?utf-8?B?ellBUGdLZFB5amxvMFU2UVBDMS9lczRXSXN6bjNjTGVnR1VMNEdiTVRvM2lx?= =?utf-8?B?LzlabUdzb1EzNW55ejNNdHNZVjd2WU8vT2hMSWw0MnJ5bi9Nb29ROHFmMWpN?= =?utf-8?B?SkZhZ1ZNZHVURzhpREFOSElVd1RmWTNvM0c2d2dxQlhTaWlIMXRKUUpSaUho?= =?utf-8?Q?sNzLl5sz259EHbxQ=3D?= X-Auto-Response-Suppress: DR, OOF, AutoReply X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: d620998d-d8dc-47f7-372a-08df293e96ba X-MS-Exchange-CrossTenant-AuthSource: VI0PR08MB10656.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 Oct 2026 15:28:10.4409 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: WGiL9S3Gp+zfxaZyahXV6i4VTy45q6ZbZwZTvc2dSsG0wgKbF57FEybchHIaenjCWfIqS46TJBYiMEiGvJ2yohHbaPCPMz3ddQfP1cjuQ4I= X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM7PR08MB5448 From: Cédric Le Goater vfio_rom_read() can leak uninitialized stack data to the guest when a read occurs at the end boundary of the ROM BAR. Fix this by initializing the val union to 0xff, matching the ROM initialization pattern used in vfio_pci_load_rom(). andrey.drobyshev: This commit is cherry-picked as-is, with no modifications, from the upstream commit 402fd5a75659. Reviewed-by: Philippe Mathieu-Daudé Reviewed-by: Mario Casquero Link: https://lore.kernel.org/qemu-devel/20260602074446.1206892-1-clg@redhat.com Signed-off-by: Cédric Le Goater --- hw/vfio/pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c index d930ef46309..fa2ca0d779d 100644 --- a/hw/vfio/pci.c +++ b/hw/vfio/pci.c @@ -1153,7 +1153,7 @@ static uint64_t vfio_rom_read(void *opaque, hwaddr addr, unsigned size) uint16_t word; uint32_t dword; uint64_t qword; - } val; + } val = { .qword = ~0ULL }; uint64_t data = 0; /* Load the ROM lazily when the guest tries to read it */ -- 2.47.1