From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from AM0PR02CU008.outbound.protection.outlook.com (mail-westeuropeazon11023127.outbound.protection.outlook.com [52.101.72.127]) by lore.virtuozzo.com (Postfix) with ESMTPS id 3AF028105E for ; Fri, 30 Oct 2026 14:45:49 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=b44F2WWPc7i33Q3fAtuXftMP/ETtgZ/BZyppmGFvcpoWRH4N0q+b1ehRI+UamqPVA+tgBRNwSmX4qmCD9qiCo6RcFLPDWfgZ2Gm+ZpKkVMA7zEwZ4aSG7b96sZxN9H1BEUVCJbq6yVmkMVCvVF6v9pwGbWq+wHDamGQWFYHg0iOIlp2XZGl4VQMNrfQTriMUk0KAOFAkmbArWqQ1OObWmYYToU9rLl5e4QlR8gli5KY2ykWGYVPEd1E+D27sbQZYKyl7OmupX6zve8aSBzkWzFtaIvSNg3Jsa8uLdOHfcyeuojQuWtOwxcSeCh4zH3sVT1hQSm3Mc63PUZW6WUxJBQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=9n/f58Cfww7ExcwPHWCumaxgk4jzvGlue5epPFjzeyw=; b=QG35EnvSDLH1ESFtwTfs/+2M4xwbAFKEaHbk+6H/aEO0CqplFqL68Qh06N051q0amGzyqaQ8xg6lhbiaaoU49zAmrVTYn8UbLeD0DUHk/T5Cn4CQEIJAAzhbzv22/8L5uZp3wiGL0VefSIB42uoQauQw09uoNZ3S3Se82UrZIMOD80rtjGXsiyFq3tmNNDonKfiohzGNyHaeHafaq3W2bfmYakY5wzfMUwOJ+UZqEGVfp+Cxs9hse+pv1fX0aVAtnZH1MzW7+L7KyhFVbzLoGvWMs3eiC/0U6oouB/ho3YfNrOntDcdJBW+U0B9v6+065/RZfn0JNQRv999bymivlQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=9n/f58Cfww7ExcwPHWCumaxgk4jzvGlue5epPFjzeyw=; b=gNo1+fY7DAne1G5B+XK40gL8mRZoSEtsksaiJ+ZFOohKzfv82dI1+J5Xc07wiGfVqllT4NM5Laxr5JOuLHAWhAfIPZOMCo/b3wRpZCsI6FdqLJZ6adpXKM/B66F1hCCwNTcrHjZ5N4d9N8zpf74aHDJy847MLpKLe8muSJ3K/yzqze7dsDa9jB6aQydOgN69oAqZFTqpxfW5EpwQSx/el+xxdgS7EM45VwS0j1EHf0k70WMie491PKUe7qGx15Ge5W/MqU2pcQLcTzTGw6z4rit+6G/s7cn3UCzUwcSgBpdbJPb0O1tg2ePyIaWiovfIf0/3oR3xg8MDUzeCRUvSlw== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) by GV2PR08MB9373.eurprd08.prod.outlook.com (2603:10a6:150:da::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.12; Fri, 30 Oct 2026 14:45:45 +0000 Received: from VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8]) by VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8%7]) with mapi id 15.21.0569.008; Fri, 30 Oct 2026 14:45:45 +0000 From: Andrey Drobyshev Date: Fri, 30 Oct 2026 16:45:41 +0200 Subject: [PATCH QEMU HCI-8.1 v6 10/34] vfio/pci: Reject invalid MSI-X Table and PBA BIR values Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Message-Id: <20261030-vfio_v1-v6-10-45de246bc92e@virtuozzo.com> References: <20261030-vfio_v1-v6-0-45de246bc92e@virtuozzo.com> In-Reply-To: <20261030-vfio_v1-v6-0-45de246bc92e@virtuozzo.com> To: svt-core@virtuozzo.com Cc: andrey.drobyshev@virtuozzo.com X-Mailer: b4 0.16.0 X-ClientProxiedBy: VI1PR0502CA0031.eurprd05.prod.outlook.com (2603:10a6:803:1::44) To VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0PR08MB10656:EE_|GV2PR08MB9373:EE_ X-MS-Office365-Filtering-Correlation-Id: 07e0b13e-d574-44b2-ca16-08df36947a50 X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr List-Id: svt-core@virtuozzo.com X-MS-Exchange-Transport-Rules-Loop: 1 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|1800799024|366016|52116014|376014|261009223027099003|261022105027099003|38350700014|56012099006|22082099003|10067099003|261021121427099003|18002099003|5113699003|261028144727099003|261026140227099003; X-Microsoft-Antispam-Message-Info: dJu9scvYV6KK4Yaa3sqzvzZSvAeUQFTzqlTH+3I1TkADtgZ3kO50GaetA36YNa/MlV9e4LA3OUQTSSL5Nmlx7rinXTZ4BwclAv6a4+3HD6MkXa596aW2bkkgE8B1d2mMBnOU4tQfVqZIqJIsejUVzFMmqHOo2TS6Gkdxx3p82X7QXqOjo0VKvUF681bIgvhInwDyTKggn2z90w5mvnS39CL1tb9zXThKcHbjs1DZh8w24MrhgtiVGvixOjxnA3pkeI88U9CFE/nc8rx/8OleVHJXs81rkiRLk1zyig3Uhz7owiI/zJ+2sS0tLBsriEd45EkSE7Xs/7FU8YILdjV+eRPQVIg2OGSP2R7B93kpq3G+wRIGrFgqOK/eBrEvlzSVBMCC34twti2MM33j8l9xW944YzgADbz8p6IleUN07O/d6tU4o2/9ti/ZESW4DO/D/oU/ZKQVp0mnAYMLFum2LCBKkEEj/boMbGXNOR+RKE99B/kD/aR/CfZhtLUa9lSHx+UuROUPJtvhwnLf6T3uJVsTyaWZBt2+u7E5nDChiVRmRFDBQL5QaWgk7X3jWuWkkjXJ9HNGt4LqUsvWUHlkeSVbRmtA4XQsFrdla4JogYea/WuBVrOQ958VbSnJxs+oXqvcx6tur0VvPPdCx0gpNu9b7BYKne2fPVH8MXzStwY= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0PR08MB10656.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(1800799024)(366016)(52116014)(376014)(261009223027099003)(261022105027099003)(38350700014)(56012099006)(22082099003)(10067099003)(261021121427099003)(18002099003)(5113699003)(261028144727099003)(261026140227099003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?ZWxCNnVDZFJyZC9Jc2QyQkJvLzFMU2M2dENyQThQKzVVR1pCcFJrVHkwNlAx?= =?utf-8?B?b0hMNVVPQ3o4bXV1YzlBRDRNeUdhanBCVUhaOThhQndrNWt0K1BSdVViVE1P?= =?utf-8?B?QmtsY2VkdVQvUmhkbVZjM1ZhWGJLSnFRWnV3KzJ2ZVBuMFRER3p3OXlZVU1E?= =?utf-8?B?R3lrY0poeGdIQVJFWm5PVkxpcFdvYm5wb1p3M1ptL3lhYkI2QmhuY2JvMHJM?= =?utf-8?B?Rk02aTM2b2JEdG50L3Mwb3NoOGdHek90dTRZZzErN1Qybm9CV2k3ZHdORE1X?= =?utf-8?B?UXFJOTdhb1ErZVBxZVFqUm0rSWlBM0h0b0JNK2RHcXllejJqUjIvT21wK0ZP?= =?utf-8?B?cnB0dkpCV2xucWhQRWVSQ1BJcHQ1bFNnODBjSGc1T0JkQWJnTEVKamRqWmxn?= =?utf-8?B?YTU4T2JiU21XOFVYRDB4ZDJ4Tk1aejkxdVQ4TDFDUEVVaDVOeTVUYlljejJG?= =?utf-8?B?ajBKQTgxcWxRTXFoeGplTzdDVjQ5MGliNEZXbGNQZ1FYbGxPR0xDcG9RUlF1?= =?utf-8?B?dzZtY3ZzajNEOXlYYUFkamNySkc3TEtiWGE4R0hLaWZZeThpdGNXSERxZGJ0?= =?utf-8?B?aVkxTXFTUmN2Q2ZCcFpwLzI1bnQwK2pIdDVaenl3T3JrVkNkR3RselY1UUpk?= =?utf-8?B?WFpoN0tNVi9GVnl0TXJDK2pUNFdQTDBqeWdBdjJabUY5c1JhMGgzNkNwQlVS?= =?utf-8?B?MVBvaGxzNC9LNHlvSWNyK0FMZHpLbWNENlVoNWptTXpWRlFvWkxsaFhTa1Y2?= =?utf-8?B?L3pZNVlWSThRemREeUNkMUxXOUhjM0F6ZHp5dVNZdTh0SlBsOVRxRnp2RGtD?= =?utf-8?B?d3lBTlFnMG5PaEVaRXR2eUoyYjlNdlZmQWJlcU11bGRPK24ydkc2YnAwUUFk?= =?utf-8?B?eEY5TWQxVHMwbkh4ak16Z0kvVnRaTjhQVHN1eG8xcEV2dVlXRFM1VmxwcFFz?= =?utf-8?B?Tld4emlSSEsxbmR5N0htZmEzSDJ5T0R3cXgwakNqdzF0NjMraUxRekdCUndY?= =?utf-8?B?aXIvSGJ1UW11MGR4Rnp5eXoxbTd1OHlLcU9yQzl1WFFsdkhRZTJMdnl0RlJx?= =?utf-8?B?V04vSWhYN1pOMzZwR3FZdEdYOUxBMDJmeUpURGNMSkt2ZmY1eWhlSEYzc0xG?= =?utf-8?B?UkIxSXh0SUYyMkc5bjMrY2lYV1k3RmJvYXdFVFlNb01vWVVmY3NHYkNZcHl1?= =?utf-8?B?T1hDU3MyUWZnU1FnWFY0YWhMb2o1dE9USStBcWFndXpHdThOZ1h1ZDZJNGFw?= =?utf-8?B?M25OMjRndTJMUTJCQzZaVU1oQmdmSG10Mjk2VENTY3RxZGFyaVRjZkZQc2cr?= =?utf-8?B?SEt6Q3pVL3VHeWVaZEFZdkY2TzgwNE80ekZJeldmWVcxRFZEVWZWWFpIM2dq?= =?utf-8?B?clFtR0JVOFFTdWtwcWNZWmlneXZia3RjeE0yc2hoR0hxS1prajFuTUVKaUdl?= =?utf-8?B?bnlDdGVJaTNEbm5zVU5Cb2l1MGxBN1ZkSDI3TllMQkY3ZlpPM0xyMGh1Mkoy?= =?utf-8?B?d1NCVG5ObDJhZHBlUmhOZzIrbG1Wdmw1SzAxSU1IRGxVaGNVVW1OeGhtNU0z?= =?utf-8?B?cm9KWTJRc3lZM1Vma0Nwci8zTnFTNUJDY01uVzA3dmZsamNXY2FDYjdYWFhM?= =?utf-8?B?dm56T1QxMnJEem9mQVd5VzhJTXJXVWxDSWt1L2RMdW81RTNHNnpVS0lCZS9p?= =?utf-8?B?TmhjYnVXQXVjMGtYTUhwV1BGd3hvSWU5UURhWklibzN2d0N2ellhMGdVWkc5?= =?utf-8?B?b3lyMjRUV3lhUDNiQ0VXWnh0bkxmR2ZyMjVxUnRZdGFGbUZSRzF1RVZTTzFn?= =?utf-8?B?SjJrMTljTW1oK1Z5TndPaTZkNlZNd2pSZDdUNHhaNWY1dlZrZzdRY2Jtd2lR?= =?utf-8?B?OVhDalIyWmNOQStNamtHM2N0TjFMZXNITkFWTTRsYng1bXUyQjZVRytEZlh2?= =?utf-8?B?aUduaUoxRlVYWEJZaHJqZjR6Q3RSRVJqUmpYdC9UQWFzaE1XOTc4TFFhSVpY?= =?utf-8?B?OG9XdGVTVDNhYnp5TFdvVVowWjhzUXhmM2grMkVpbWptYXlUWC9SeE9EMUJC?= =?utf-8?B?RDFhaUV0cVQ1cEpkOVhNOE5sSE9jTUFOVXhoZ21Zc0tEM3JPRVlqNFpMWU5J?= =?utf-8?B?dWcybVhNalVORm91SE5nRmc4OGdTdVo4ZW90eTRHUDhUOG1FeGp0WXBVMGtI?= =?utf-8?B?RVNnZ3Q5SXYyNVhlS3pYeWdtZ3JqV2hCK2czcXkxMW9SaENMTWk2L04ySWJN?= =?utf-8?B?WXJIcUJtZU1td1ZjRTEvMEFDMWFSVlN2ZWhNL2Y0Q0xSYUxMcy9XMnZpWndu?= =?utf-8?B?V2kvRkxMclRPM2ZNeUlUcE4yeXZjZm54VkwybzdoY3NuTTNMWXhNM2drZXFM?= =?utf-8?Q?OIKp16yX4IHSQ+zE=3D?= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: 07e0b13e-d574-44b2-ca16-08df36947a50 X-MS-Exchange-CrossTenant-AuthSource: VI0PR08MB10656.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 30 Oct 2026 14:45:44.6422 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: Fk5gjmaA/6dvARXSiqrBYUE+7/17IXednpzqOPoS3fuixWPqlsvdUMLxyBsPF6FwB6UdHFxrcC5LLEDaGoltrb4cWeX3+qFTV94MrfKDFWo= X-MS-Exchange-Transport-CrossTenantHeadersStamped: GV2PR08MB9373 From: Cédric Le Goater The 3-bit MSI-X BIR fields permit values 0-7, but VFIOPCIDevice::bars[] only contains BAR0-BAR5 (6 entries). An invalid BIR value of 6 or 7 can cause an out-of-bounds array access (CWE-129) in vfio_msix_early_setup(). Add range checks immediately after extracting the BIR values. andrey.drobyshev: This commit is cherry-picked as-is, with no modifications, from the upstream commit 9daa7347ff25. Reported-by: Feifan Qian Fixes: 65501a745dba ("vfio: vfio-pci device assignment driver") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3878 Reviewed-by: Alex Williamson Link: https://lore.kernel.org/qemu-devel/20260706161334.2165482-1-clg@redhat.com Signed-off-by: Cédric Le Goater --- hw/vfio/pci.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c index 5e281b2e1d9..d930ef46309 100644 --- a/hw/vfio/pci.c +++ b/hw/vfio/pci.c @@ -1791,6 +1791,14 @@ static bool vfio_msix_early_setup(VFIOPCIDevice *vdev, Error **errp) msix->pba_offset = pba & ~PCI_MSIX_FLAGS_BIRMASK; msix->entries = (ctrl & PCI_MSIX_FLAGS_QSIZE) + 1; + if (msix->table_bar >= ARRAY_SIZE(vdev->bars) || + msix->pba_bar >= ARRAY_SIZE(vdev->bars)) { + error_setg(errp, "invalid MSI-X BIR, table_bar=%d pba_bar=%d", + msix->table_bar, msix->pba_bar); + g_free(msix); + return false; + } + ret = vfio_device_get_irq_info(&vdev->vbasedev, VFIO_PCI_MSIX_IRQ_INDEX, &irq_info); if (ret < 0) { -- 2.47.1