From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from AM0PR02CU008.outbound.protection.outlook.com (mail-westeuropeazon11023126.outbound.protection.outlook.com [52.101.72.126]) by lore.virtuozzo.com (Postfix) with ESMTPS id 3344B80B0E for ; Fri, 16 Oct 2026 15:26:14 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=tAdhdTcROns03SmZLGYMmDFyYQ80pRSgl6kbqlReA+bd3GTtysfJgPw+7o2nrJ4u8iYie0clzHaUDvMQJXDElPmhJqa07Xjjs/kRrhXdRsIK+J0Y2P26Vab5/8H8oNd4EwWQBsfyx7hkB6zaBfkdaFIUPQ+XHehMIKP9zF36r3eMr/RgjKTL+Q6QK3AKA7T0OxRXCtZYtC5aAsaO5s7w3BVcosNlQwzIPxHfCYdEOrvkZoJ+wU3iL/6/iCJTh+VP49ozGrrlc6RMceeieDCsWGvJpWQspo05xqqTH1D/U12UT66NeamHCmp+pVnAFmWVdqgEwyIHxviod2BByAJQiw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=GpyZeuzxBx/9EXW2jB4YPAzv27x1rv066ytK047XXLA=; b=TpkaYKaDtCDTBbvKS5cPLk+5pHT1PU3lW8quvLWHUcPup+Qp0uwTk6bV+QlJxYy9QWPUa8QkU5RRf3P1k5wisTwPm1aL2NjFCLkiZJIMShBs1WFs+1C4Fl9nMNu6QKf123PEJWLP3rr2XPVyTHrXe8Pw8dS8zLdlX5xQvGSrqU0D2ETFtao8Sq5lImgem0Jcjw1vbbZ8zbgccldMb8C+raqt8/KnQNKeBC3+dLrjdwaEzJvIfaLgOnjklA5mP58zzXR/jVShYj+XOKl7IWjodRzd4bODVAk54VaoAVAzFvmHCTt07aoJP8egIHbBXmrPvGWR+lFngPy5828C9mDXCQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=GpyZeuzxBx/9EXW2jB4YPAzv27x1rv066ytK047XXLA=; b=FxDAWz+Km2MMRdh27pynakSCdd3a0CaTqPPfqPOynY7nna8pbtW07V8b0bcHzBY46wbkLHdgrdBBZS47QJAYJHbG2yrgOwFN8lEKLf83Wmfe4cdfGPIEiWd3YXv631vS9mItkqODCx/emUb4pMUmQ2PMp5rUTylNddJZiZleL1NTrbmJo+9BiShdoTskP2SOH75ugyp03HfQXh5ySbpLMh0tw3Tt25dTR4Ir93WNoKrCC7SPz1sIRyNHJq1GK/3maYdI7JyxLC5TPq71WpG4qty/srLMuANMPPqxbdZlQogQs5Tmil2BIKOnQXBiprZy2m3eB6d9FXCOJUk8U8xllg== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) by DU0PR08MB8907.eurprd08.prod.outlook.com (2603:10a6:10:47f::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.9; Fri, 16 Oct 2026 15:26:12 +0000 Received: from VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8]) by VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8%7]) with mapi id 15.21.0546.006; Fri, 16 Oct 2026 15:26:12 +0000 From: Andrey Drobyshev Date: Fri, 16 Oct 2026 18:26:05 +0300 Subject: [PATCH QEMU HCI-8.1 v3 07/28] vfio/pci: Fix information leak in vfio_rom_read() Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Message-Id: <20261016-vfio_v1-v3-7-47487cb5a8e5@virtuozzo.com> References: <20261016-vfio_v1-v3-0-47487cb5a8e5@virtuozzo.com> In-Reply-To: <20261016-vfio_v1-v3-0-47487cb5a8e5@virtuozzo.com> To: svt-core@virtuozzo.com Cc: andrey.drobyshev@virtuozzo.com X-Mailer: b4 0.16.0 X-ClientProxiedBy: VI1PR10CA0088.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:803:28::17) To VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0PR08MB10656:EE_|DU0PR08MB8907:EE_ X-MS-Office365-Filtering-Correlation-Id: b10c9b7a-9c40-49bd-da25-08df2b99cd2e X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr List-Id: svt-core@virtuozzo.com X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|52116014|1800799024|366016|376014|6133799003|5113699003|18002099003|22082099003|10067099003|261009223027099003|56012099006|38350700014; X-Microsoft-Antispam-Message-Info: IU2Db7RRkQhaMeN88KzkvQ1TXAqYwjL4tGQIE/71B3wilabKn0b0KYPoRTVTd/EYZtpzJqPJ4hBaQTMLK0dkNqdiQNVualRcpkD2cYtQ2DMNcqsaPEFO+rjlIFRerNhbqYo3xPJqwtHMAlMH9WjFqRyKV1y7ZFAsRW1P9KnqEdc5m0MyqqGepsmqGWB+zWcCi1oGOwHNDngJSPGGP6l88dssNcYZqpKpyZIwxhd7xKKYHODxq0QJ8MCulzIB7QLFw3W7PG9eJvQ0wjPfAPlMudwH54DEI3WhBxAZ4KiSJLtq7JK47huzip5bx49Uw3iJvWKQP4lrCXdkAg6N3GtYo8PPfaFMehQjkCqa8uqN2Fs3vtpy2sV/crIZdA2Mt5RJiVX/rm/l7SrDN8o4BB7DTp4bQ0flt8aN2YX2aEy+xJR2MRZl0+b3h8TCMumr4EHbA5rO4jKBogLExOxtBK8/1CYYaU5XnyuQQjsoZsolODRZwLeHLWABrhBFTI6CJt4dF9s4S6idmRn2zxzSuUyu92BBK2iUDsg0d99rCzzbrlDji2eeaZiltpRxzkgUrisVcnMudsuRJZcmZbrCKb0XfJ+Ek7aUE0Ll03UzX1fhEQ0zoQQAaZiWlDh2BJd47ljvdWzbYAiXcXKrC4/lNHbYH1nJQ507u2OIdqnfNNRPqRU= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0PR08MB10656.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(52116014)(1800799024)(366016)(376014)(6133799003)(5113699003)(18002099003)(22082099003)(10067099003)(261009223027099003)(56012099006)(38350700014);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?bE01WlZCaUJLMjJKVHkzMDBiZ1lTYlBQSG1rWS9YZmdLTno1R1VBSklmdHlm?= =?utf-8?B?Q0VseVlFZGl6S1hnVmtIOWp3Ly9abDZ1RkFSelpBYzBSNUVHVGRHbytReWEz?= =?utf-8?B?a2NoN2REMUd4UUwxczFIcUxVTWpKaHMwODJvMXU4aURHVzBha2F3dW1QUEo5?= =?utf-8?B?K1ZnMHpMK2RRK2NnOTRHdnRzQmxFL0lyQnZYTFRxK0svb1RVdThmdmxRVktO?= =?utf-8?B?M3JJcklDNHZPQnp1dkJERW5GaXc4NFBJWkhzcWRUV3hlczhxVFE5Z1ZjQllI?= =?utf-8?B?NmNDT05vMjdmYmVxSUpoUEpYZnlkN1dNczhvbm1uSWU1L3NwaWs1OXhhQito?= =?utf-8?B?emdlRGNCMC9ja3dFTVRsTk5Ub1pEWW1VSGt6T1R6Z3lBdEpnWWZFSVNQN1NP?= =?utf-8?B?TTk2bmlaSDB6WEVWVTJNbUZuU2VxV2xwY01YbVBSNlpqRURDdUlPTzBWNkkx?= =?utf-8?B?dDQwOGRxcWlEVDh1SXpSK3MxTmVORGc4WXFMN0JIcDV1YW9pUGN6M3ZwdUFa?= =?utf-8?B?dUlDeDNWYXJnNXpXd2pEQSs3eXhMVG11TG9FNFRCOElsZVl6Z1pDS1BYMHhi?= =?utf-8?B?TjRJRWJJWkxadVE3eEsvRlhYMTM1MnZidEZaUXZOTDliNWdFMlpBOTBIWlhz?= =?utf-8?B?SENkbTBDR1pKazlremRVUjFDQzYvNkVoYmduY0N5em4xSkduRG93aWxTMEVi?= =?utf-8?B?SVdyS0FydE5BWlRHbGhpMHlOc1EyaUVxY0p2OXBpbHBBdjBKVGhkREZyTFl4?= =?utf-8?B?bU03RXVvL0ZTWXFKbDlqcFZrWG14OWNBRlIrQWxXTmgwWjRYdjlFY0dnTVdK?= =?utf-8?B?dmw2aThkbFBhNmN0NmN1RmNFN1FwMGxXdE9JVnN1Qm5GWGJsK0FCeHFlNXZ4?= =?utf-8?B?QjlxLzVtQ085ZmRkbWtOTzk2MWpmdnpCQ3lPSktXMDAvODJ2WUpnOXI4aVlH?= =?utf-8?B?c04vclhpZWlZZjI0WlA0bXoxdi8yd1U1a2ptNEsvbUxiams0Sk5YalozallL?= =?utf-8?B?aGVhakMwdlhQd0x3YVVxQ05JbVM4R0JHZElSMzh4N0J5NmxNU3ZXNUd1K3hV?= =?utf-8?B?L2hYUlZqQVpiZFBoSkhFalhpL0JvS3NKTGtPYUx5dGl3WS8yS0lEbTRWUE1L?= =?utf-8?B?eWhVcFdJQXVzZzMrMGM0OFd3Z29sakR2anNNeVYwam1NN2dodXhsOThDK2th?= =?utf-8?B?UnM0UkZEc1NxYUM5TzRySjczamxBTHZWRVZFNGFxRGRKVmRjNUcrRkxvMDNX?= =?utf-8?B?cTVHMkxFcXJuenZiOHdXTE15ZVJZYzhPK3NaQ2o1c2k2NldnQzhJUlR6ajdo?= =?utf-8?B?NWU0NnJmSE1TZXY1clh0YUU4STkvRGFyUTZhY3gxdlU0QU53QlF4cS9tR09q?= =?utf-8?B?Q3c2ZlRZYXQzcG1lQjhnSmFjR1F6cWU4TWZRcFE4SXlSRGRSK1NPVWJER0kr?= =?utf-8?B?a0FYV3ZXcG9zcnBtNmJ1U0Frd2drQW0yK2dkR3Nycy8wSG5VSlRLVXZHYnFv?= =?utf-8?B?R1NkN0pHWDFLbkxHMjJTaDhud1EvRzdnRUQxVzBpeURSVU95MVZHUEZ2T01u?= =?utf-8?B?NFZOWXNMTUZRTnEwckgxanlWQ3A4Ny9ZdTlFVUNiRWZZd1lGd2Q4SVhqYVg1?= =?utf-8?B?WkppUWZnMlV0UzVyaEI3cUN0dlFiZjhXUjB2NlRPbldmN0U4L3M3dmVyaHhR?= =?utf-8?B?Uk1nRFBWTHJaazVBQUEweExuNm1QVVlaZTV5bjdRcGVjWmcrZUxXLzBtR1ht?= =?utf-8?B?c3g1K3k3a3JrT2NUTTMzNjlWbXhtZGh2MW8xdUtmakpwNUlCd2NMMjd4Yy9l?= =?utf-8?B?WHU2QVBNM2F1TWs5R3luWis3NkRkTFFRcnJWcCtsTjVQMzBKekNaUGFsL3BZ?= =?utf-8?B?M09hd29DcDhNZFZNQzY4MXdKbitQNzNudFhtUFNSR2huLzU4aGlXaXFGektK?= =?utf-8?B?aTZwdmxzVTRScEJQMHgzU1RBWFllelVmb2VNWStESmQrWm5qeCsySVBWNFlP?= =?utf-8?B?ZGYxNzNJNVZSUkR6SmhIRDRmbFByVVpkdFlRaVd1Q0RPQUR2T1Vxc2diMktL?= =?utf-8?B?N3lLQmIzNW41c0hzT2J0U3pNUDg0clpCVFN2SWdHTmxEM09Oem94Y1d3cnNP?= =?utf-8?B?a0dsTEtJYXpBUytEbHozNEM5alFKZWhUbWNSMnEzZjFDM1JOZVFzSTZFVE0z?= =?utf-8?B?QVRGUS9KUy9qSmZCdjBSNmo0RE5FSFJyMStOSGdTWXhQRHVrZlpNWEgxTmZx?= =?utf-8?B?Rnh5dEc0VmRJeUZ3dUxKeWNOaDBEa053M0dOTmNsVTBTb28rdjQycVdlaXFY?= =?utf-8?B?NjVmWjlJOXZOZE9EcVRSTS90VkgwdUxjVGFSTE5YQktFNzhHRSt2cDkyL0M5?= =?utf-8?Q?IKmsYM5TBt4qhDIg=3D?= X-Auto-Response-Suppress: DR, OOF, AutoReply X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: b10c9b7a-9c40-49bd-da25-08df2b99cd2e X-MS-Exchange-CrossTenant-AuthSource: VI0PR08MB10656.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 Oct 2026 15:26:08.3753 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 4KawKF6DtzcUSt/Okstaw/fRjtI05II353Ghsrr4TgS4JrCDgg8MjEi/bB7V6aiE4QqBjdhMZ2o9xzJmBB8waPjlvVPU1/qrkxlkOqB91SM= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DU0PR08MB8907 From: Cédric Le Goater vfio_rom_read() can leak uninitialized stack data to the guest when a read occurs at the end boundary of the ROM BAR. Fix this by initializing the val union to 0xff, matching the ROM initialization pattern used in vfio_pci_load_rom(). andrey.drobyshev: This commit is cherry-picked as-is, with no modifications, from the upstream commit 402fd5a75659. Reviewed-by: Philippe Mathieu-Daudé Reviewed-by: Mario Casquero Link: https://lore.kernel.org/qemu-devel/20260602074446.1206892-1-clg@redhat.com Signed-off-by: Cédric Le Goater --- hw/vfio/pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c index d930ef46309..fa2ca0d779d 100644 --- a/hw/vfio/pci.c +++ b/hw/vfio/pci.c @@ -1153,7 +1153,7 @@ static uint64_t vfio_rom_read(void *opaque, hwaddr addr, unsigned size) uint16_t word; uint32_t dword; uint64_t qword; - } val; + } val = { .qword = ~0ULL }; uint64_t data = 0; /* Load the ROM lazily when the guest tries to read it */ -- 2.47.1