From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from OSPPR02CU001.outbound.protection.outlook.com (mail-norwayeastazon11023076.outbound.protection.outlook.com [40.107.159.76]) by lore.virtuozzo.com (Postfix) with ESMTPS id 9607A8045D for ; Fri, 23 Oct 2026 16:54:40 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=NM4U0ESJKFAaa1BtUqcqvsgzWmIViFsxO5yLXOME9NYKxv8ZjctBrEgRRurlSc0IFvvZN0Rs0HKiyax/NDcEBg1VPV4V1M3qVWEXyRLXnoLsW7CtIigZbmGzbO1po4sxR4ryyRSNEpTLSKQKaWLhasB+qhD7I1CLyegYZa/UbqjLU6uTdPi0lv01N94gedRPNRvoQGupwTls9QKZHfuYfCT1DR5FQ/MY5PtaYRrS8AEgA5R6ZWlCyQS7YMyL3qwBxqVa6DnHI2QqWrAESAro+w+EbhBN9ddotsa1LOLadNqe3O9oOT/+o33vZUKnDLwQwcMxGdDHnTj7qvNty0yBGA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=GpyZeuzxBx/9EXW2jB4YPAzv27x1rv066ytK047XXLA=; b=cm46IZAEa9U+1tYFIQGcpT/LmtE5DObw2X+lPY7tIXFW+8gIi8J9afxxqclfcbMiE+UuaomfZdOoOrr3vsSZI00EUH88o+CryQ75NUbCG+YvVzjEF+WCVT/375yYWV0WLjhz/AqxIsgPIxkvCMwcBXpXs/Fr+/iQ571/AL+1hbYy3EFKI+v2NpBc51vmCJskiKZjd2IderlKqPac0uBkqLgIlpeza/FpEKMsDoNoEe0UWn4NY30OjtubcUYGfe1cnutCuH3hOm8Dz2rpCj2kWsOVtgSPKCmwZIpCnzh8hd40Y+23zHVYef7CTlKEpWB6J0AmI4o7PB4pqeDSINF+Ig== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=GpyZeuzxBx/9EXW2jB4YPAzv27x1rv066ytK047XXLA=; b=iyTo9dlxvI/DMdqZ464SaC5wLfB1b5XxbVbwZOCRZHAOWUP2zo/+SONJ9rIWJ31A90aveA6gpzzAa77BbF8n4WcadJ8r9HpIIwVUlaq9OgpinpMz7Cb6nrwPvenZMrl5d/0IDvN4IHvM4hJAaogAfq1lr+1Mh5ubjUl2ZJ702sXOEMmccStoE/Bn2oHBK1TQwt/5kOiQM6J86WMxjDYHALBZa7RB/Fm8EZNGjPVbu5VOyHk1lO4QgPLwRKC9prchmFE5womsf++HCZjHpVv07VrqJG8Dx20Orv+sAWXQkSNoVQNqGT5x0CvndZwONZUMi4PcX72A2QzD79l5Grb3iA== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) by DU4PR08MB11747.eurprd08.prod.outlook.com (2603:10a6:10:646::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.19; Fri, 23 Oct 2026 16:54:39 +0000 Received: from VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8]) by VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8%7]) with mapi id 15.21.0546.017; Fri, 23 Oct 2026 16:54:38 +0000 From: Andrey Drobyshev Date: Fri, 23 Oct 2026 19:53:48 +0300 Subject: [PATCH QEMU HCI-8.1 v5 11/36] vfio/pci: Fix information leak in vfio_rom_read() Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Message-Id: <20261023-vfio_v1-v5-11-ba0bf3c6d122@virtuozzo.com> References: <20261023-vfio_v1-v5-0-ba0bf3c6d122@virtuozzo.com> In-Reply-To: <20261023-vfio_v1-v5-0-ba0bf3c6d122@virtuozzo.com> To: svt-core@virtuozzo.com Cc: Andrey Drobyshev X-Mailer: b4 0.16.0 X-ClientProxiedBy: VI1PR0902CA0027.eurprd09.prod.outlook.com (2603:10a6:802:1::16) To VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0PR08MB10656:EE_|DU4PR08MB11747:EE_ X-MS-Office365-Filtering-Correlation-Id: f7b30e61-ce7a-497a-ba61-08df31264c84 X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr List-Id: svt-core@virtuozzo.com X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|366016|1800799024|23010399003|376014|52116014|6133799003|5113699003|22082099003|18002099003|38350700014|10067099003|261009223027099003|261022105027099003|261021121427099003|261021123027099003|56012099006; X-Microsoft-Antispam-Message-Info: QICgwfSHMDhGnBA2ThjZdziqzqSIEX4Mnvuq1dIQm2jPlosFgNcKuvZ0gEtBYAB6n0rPnfRXuc+GjKe/264/WDqUPGmnqSlCq9IVUcKqLNaKH776/PC19XywGhNDrSMRqRoBWpGzXPd97HqVIRub1SdA+2JDRs+2QcxRhzjGrGpk+XzFy03Mp56dXa/CKNTo90mECYB6KM+l73tJ8uL1PwQBizmZj1pzwyuIM3+fZCHHmf0OGraC5te1napjvTSezh2s9pgi2HXmc97dvA3ROaei5bJ0Ao/vxbH8VZYnrirUdAgrrHSQC/M+RZl2FU9NZwkNREo+t88b3hGsUgWGGyPV7vtPKE15YroHh3jnI9hL962eYBLGSgYXhy0KSUrotBcLiT1m8ykmgActilTmfrH7FR110rk7O6qDXLrOj9DZbfIy1XxnO7ejB4sgonWWQdpTFB7D3UjbswdZyL+1/YhhFSYp0DOLL2bcr8KAJTZhDDJkmqJKJ/j+SDHfr1v8ro090hIzty9B/EKxsN/3TLFzAVI7M5/NYzxlAjqO7L6nmy9iQSw6orlZGzP6jnq6B/IHl3gPaBi4AT6jL7GO5gyozh0n6xB9LJJzE8Jdfd1Oz8hrz1FrNBEKAGasokEsVUiD9lmL1HPlT1EgE9tlcjwM24uuUvg84iPftsgqD5s= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0PR08MB10656.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(366016)(1800799024)(23010399003)(376014)(52116014)(6133799003)(5113699003)(22082099003)(18002099003)(38350700014)(10067099003)(261009223027099003)(261022105027099003)(261021121427099003)(261021123027099003)(56012099006);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?N21QSGdmUGt1VW1EQnVKRzVja3ZLSTJuV3NZOFVQb08wZ0toSmlrUGV2a2ky?= =?utf-8?B?VDNXWE9rWWVpSW9Dcll3b1FiWk5DWEtLS1VBYUhLQmxkcCtYWEFqa0M3OFNV?= =?utf-8?B?cGFkVjRnd28rbTZlWHB1c1BQNFBEdUorSEJBanJDMmJFTlM0QjRZTnMyZ2Zh?= =?utf-8?B?cTNuemlNSFdURC9jem5EUTFWaDk3UXNsZXFtVTJrT0lZSFJoUGlvNHRNbzRD?= =?utf-8?B?WVlXNjRmcXhHNk0wMzI1U0txZlhNOURQQmE4TDZPS093ZlFJdUNuM3NYb2tV?= =?utf-8?B?RkNvWjlwNHJvMFA0bldCbG1qQjR2QXkzVERlMFpmTXdSRE9CSkQ1N1hPVGRX?= =?utf-8?B?N2gvSG9yYUVwenFuTVNoelhXT2VqRHNZeXY3WU5QdTE1NzhLT3RJalkzRE9x?= =?utf-8?B?aEdqZGtRc3dzTVU2Sm9PYi9XR1BiMStEd2hCeUFyZmM4VklodGFtNlQrckxw?= =?utf-8?B?aGxISFIxV3d2Nk5QTWE5aURLTjBWZ2VJaElTcDFLNkhtd0dCak9KWFJsNU1N?= =?utf-8?B?YU00NDRPbWwvdzdVZGw5VTdKdzVsOS8xMTZ5M0hzY3dPVjJUV0J1Y2hiU0hW?= =?utf-8?B?UmhTYk1lbSs3N3QzUkR4MWVRYTVvbW02b1dEa0JHSWo1V0thREZNK2RSRm1D?= =?utf-8?B?WGlHOU5iQ1JXZkgxR0dKTlRSNjdMMmlTdW5XUHlyWFVJcTJXN3ZiUXF4Qmhv?= =?utf-8?B?YXFjMXVvbTdnUDhGTGtHbHpDOHdZRXBuaEJqc3JjRHAvSU9CZFl4U1U5TWdw?= =?utf-8?B?czJ1RnFOTXFvdUlSaDdGeG1nSlliK0dYa0hMMHVGam84amRRSmIyT1FwUWlE?= =?utf-8?B?RmV0dDk0bUFoeXkrR1AvZEliSE5JRVZFSDZJckk1VHpvRkYxM0VWQm5MTVpw?= =?utf-8?B?MlJVd2ZxeStnQjdyQ2pVT2xFUUNOQ0dDaVBaZzZ2Y3I4MjBLOFg1c0cyS0Ja?= =?utf-8?B?S000L2dUZTlCOFFIZDdCeFZ3dC9EUFozaVdiQnpiRWtJc29qaWFaZjd3WWtH?= =?utf-8?B?WUExTDNOYW9BeGdvcjFpa0hEUmtkOERrQ2ZCaGgxWDQxM08yUU9RMm1wV2t6?= =?utf-8?B?OExjNWoybW55cENPSEFsdVlXODA4ZFZSRDBQUFNnTnZiVGlaTU9mVnczYnJj?= =?utf-8?B?ak44RTZRNkFwWEVhUmtvUHkxWlN5dFNhdmREMDA0K0E5QU1LNEFmYVFZNXA1?= =?utf-8?B?aUE2RURPc0N4QklKb2Zja3prYlYycjFENHEvTy9Xa09JdHFaT2VhTzh5WFZl?= =?utf-8?B?QWpUY1dBNERCRElDUEdYSVQybTlsTmdKWXdNeEhUbHpoaGxER0NLcGorYytK?= =?utf-8?B?Y0praUNsaE0vb1BybSthZFljelhwTitzNndQUTZkVSt5d1pxczd1dWViTTNK?= =?utf-8?B?NTdsSWNySGtkUUVVck1uQXBtbGh3NnY4L0VTeVZDTjFuUWw4MnkyTHQrSDVC?= =?utf-8?B?SHZFRm51Mzc2SFVqNm9DMzZZQjVtU25CaVE3b2l3TzFTTmZKMkJ4VkFFWGZt?= =?utf-8?B?MjdOVXhqSFZUY3QyVUx4enM3TzZpM0JQSWxoNGlVUmtsZXp1VjNKcTRTV1d6?= =?utf-8?B?L0k2Y0lUSGJ4L04xZWo0a2RmdUtCVS9CSHZtSUtsMEY0UVZKOXovaUJndHVw?= =?utf-8?B?YWI5eG1WY1FKNURhUmRDcmRBNmVBK2JrcUJpMC9vSC9pbXJ0a1JmVUt2Q2Z6?= =?utf-8?B?TFFIS0JmRHJvTnpWT2I1SGlWTysvZkhGd0lXTG0zMVBWMGYrYVMyMmh0NXRt?= =?utf-8?B?M1l0ZTh0RXorWENWYk90QnVjc0t3SFp6UkIrOFY1d3RIaUJzdVRmTlNlVHg4?= =?utf-8?B?MHhYcldNUFdVbDBUS0ZGTTh5VzhNcFUwQlg1ZzZuMmkvZVN5RklHWlQ1QUFL?= =?utf-8?B?UEV1UjhtSUNnNlhKZVpNa2dRbU1Va2k2ZUtKYmFxSDI4WVNOa2dNLzhGQlZX?= =?utf-8?B?T2hOQUlBeThzd051ZWY5cS96ZTVzUTZGT1M5Q1AwYTZJVkduWjBZR3V0YlJ1?= =?utf-8?B?T01TU3l5TWNyVE43NyswTW0xa2xuZWJBL2pKU1huYVQwenF2UmxDRmpRWkxv?= =?utf-8?B?c1NTdXVyNzFpMGd4VGEweHRSY2NURVR3Z2xWa0UybnB2bWZMZXdXYUw5K25R?= =?utf-8?B?clEwR3RTY3FsaTBlQTlUMnJkWjMyZFNITHBQNk9uWWZnSzlOMHU4MEhCUTZ2?= =?utf-8?B?eGZheng1WjZRWHkxdlVjUUNvRzRVd1NCY2xvdXRtWGhIS1BPVFhHVjc4WVJT?= =?utf-8?B?V0ROYXZuaTVjZ0hFNk8zazFTY1BtQ3k2SWxZUUF3MUkzRStEVGZYcG1sQmFh?= =?utf-8?B?MUJsZzhLdUVOeCtHNE1oQ3lpRDJ1NkhUZ29uL0RDNFJSSWZZNGt4a1hXNUNW?= =?utf-8?Q?f+lrXKoVeUpDt8Fg=3D?= X-Auto-Response-Suppress: DR, OOF, AutoReply X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: f7b30e61-ce7a-497a-ba61-08df31264c84 X-MS-Exchange-CrossTenant-AuthSource: VI0PR08MB10656.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 23 Oct 2026 16:54:27.5391 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: YhORM1vD+k7C6oDItxifRLTl3WrokDCa946GMSwBJ35x/gnKqR+gsOm44Kx2Z5B0rob5vjSc+24n7c1nFcNtqKawh5Fhn3SZ9ofkEdKw24w= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DU4PR08MB11747 From: Cédric Le Goater vfio_rom_read() can leak uninitialized stack data to the guest when a read occurs at the end boundary of the ROM BAR. Fix this by initializing the val union to 0xff, matching the ROM initialization pattern used in vfio_pci_load_rom(). andrey.drobyshev: This commit is cherry-picked as-is, with no modifications, from the upstream commit 402fd5a75659. Reviewed-by: Philippe Mathieu-Daudé Reviewed-by: Mario Casquero Link: https://lore.kernel.org/qemu-devel/20260602074446.1206892-1-clg@redhat.com Signed-off-by: Cédric Le Goater --- hw/vfio/pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c index d930ef46309..fa2ca0d779d 100644 --- a/hw/vfio/pci.c +++ b/hw/vfio/pci.c @@ -1153,7 +1153,7 @@ static uint64_t vfio_rom_read(void *opaque, hwaddr addr, unsigned size) uint16_t word; uint32_t dword; uint64_t qword; - } val; + } val = { .qword = ~0ULL }; uint64_t data = 0; /* Load the ROM lazily when the guest tries to read it */ -- 2.47.1