From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from AS8PR04CU009.outbound.protection.outlook.com (mail-westeuropeazon11021124.outbound.protection.outlook.com [52.101.70.124]) by lore.virtuozzo.com (Postfix) with ESMTPS id CD6C98045D for ; Fri, 30 Oct 2026 14:45:48 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=SmFopG663HKEqocUQhEGFfg/zkiwHenDmOa2cho/oIxa/kodb8XQV1ijTovaaLAlqdcUv93K2fpoefwNiIcH5TSUmE+g7BczO2Jrd8ezJcHVp6KQf+wITpDTntqAzRacV+zmZ9KObUQbGXckWl9XiHdJEM+wcXWMviDeg8ouHLnoJkoDlWyM1hZ+s9nc8mWZU3oC5KcDyJ4oTeyv2BFasOZinifJ5ewnEwGa3SkSFpBD7+fTvr0O3z6iys3VbNLO4oC8HXiTBxXJKf+O/aZWXJU5i4HA0Cl04JAgA/EwVr3n2NKvGHX2HeRZk8uBjKkduLXCONyMypYV86zT9coFYg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=GpyZeuzxBx/9EXW2jB4YPAzv27x1rv066ytK047XXLA=; b=Er2WBt9LGeuZtAn3QVwZxFglPaXyor6DAJfjkrhopAIGcGbNUP2OjPqxsEB7XZdCuql8RZjOZZLxkmcTKCJqvNj05kV4/BXls4amcKOQYw8snVXV3rZhPFj15PpTnZ1wGGMIYoPEsXJp/geCwyHLAei6JrHb/SUUISDvfhXCJNUAK41pMcLK80Dn6aq2WdygVD3Q3wHJ5TqL/h5e40h5r6euND6ODXW6oSLZJB4uXRdgSKJ4ayFASb5BvIQaeGiHCr/I+zp8L1tSXVmV0C+cfg5m6c8Kyll/W6g3sJG6cHlkdIkBSuAEupk4Uc3qhiVD3D4pd5M46mGPaddZd1kzcQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=GpyZeuzxBx/9EXW2jB4YPAzv27x1rv066ytK047XXLA=; b=ITQi8uMTXeMxr3kW0H8wCO5fNVrecf5u/VAMgZwpOoc3JR9oOQWMIdoV7ZXnZSFWSNsfwRPuSmBWTp3AZiWa04KVmlUrB6pq69ZEFyhFhCKKzJ1KhXZLFtSvfGDfxrJpbKjcRGEYdRon+Z5V022zucD8XDBrFjynp+ut7OyJReHJdULMATNg9z1cLx18hk8j7wZh56mYZR1VGupCbqkVemSH4QL42tY5Yg+Z8aoYtuoYrafXAMhm3jtaqv11TpDil/wG1FnerbJI2aF+gtk+6d0dYOMZJaVG7bS5eWOkjG6+zf+qmus31TIQdsTg/aaCKb5YNmgtXfSlt91LHViVow== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) by GV2PR08MB9373.eurprd08.prod.outlook.com (2603:10a6:150:da::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.12; Fri, 30 Oct 2026 14:45:46 +0000 Received: from VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8]) by VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8%7]) with mapi id 15.21.0569.008; Fri, 30 Oct 2026 14:45:45 +0000 From: Andrey Drobyshev Date: Fri, 30 Oct 2026 16:45:42 +0200 Subject: [PATCH QEMU HCI-8.1 v6 11/34] vfio/pci: Fix information leak in vfio_rom_read() Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Message-Id: <20261030-vfio_v1-v6-11-45de246bc92e@virtuozzo.com> References: <20261030-vfio_v1-v6-0-45de246bc92e@virtuozzo.com> In-Reply-To: <20261030-vfio_v1-v6-0-45de246bc92e@virtuozzo.com> To: svt-core@virtuozzo.com Cc: andrey.drobyshev@virtuozzo.com X-Mailer: b4 0.16.0 X-ClientProxiedBy: VI1PR0502CA0031.eurprd05.prod.outlook.com (2603:10a6:803:1::44) To VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0PR08MB10656:EE_|GV2PR08MB9373:EE_ X-MS-Office365-Filtering-Correlation-Id: 4530501e-1e40-427f-801d-08df36947a8c X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr List-Id: svt-core@virtuozzo.com X-MS-Exchange-Transport-Rules-Loop: 1 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|1800799024|366016|52116014|376014|261021123027099003|261009223027099003|261022105027099003|38350700014|56012099006|22082099003|10067099003|261021121427099003|6133799003|18002099003|5113699003|261028144727099003|261026140227099003; X-Microsoft-Antispam-Message-Info: 4iAJtcEWxvmC1ccnpxcV/InnKOES42vhNfbr48ArAMu5oTndtrM/th5hFhSyWkvrRLI9jx9CsG/oI6A5B9qhlqzB6I67p+T4Cj6S5Br6lkOUGZb82VhGlXyFnPqVVvxk97xaA8znP2UpmCcFE1fOi7ijRxea6Bb+7QUBHP8n/1NAClfhlIEkQ4npS9z6RjWjnblXvUJWJpZryEV/JLHywQ6s/4n9tu8umR5vKR68A3YckM8IOeK+jNI47+kyTFQPt14zsbKneQ+DKhdOYMzK/kMbdHjT43Acu+gxLuBfmeBgPMcgFmXJaC+M1rA639o98xkO12321U6G0kAKLGcwO9Nohs9Yvv2ynelxkdYWjkgmLoFt71/iblBjZnw4+aTDgoI3IGsyKkrkbZFvDTe52TkyEKQa7rvka684CEK/Hb/1X+3aTB99H5lDN+4tgshwf/y2bI7UBT7J8MMZ0ns13+QOF6WGzpTTAU8JGObCzvKCMket7UXDQJ911APv2UiCc+TVNP0Ood+d1A1bmikL/CGnhEHQpdcaPLzwKRfERPO8dAWK8OXPc3Wz47WWZpzMUOIzOoDU0bpAFIhdqxZmy98Zwf4IUIJL+Vh+LKK2fPDocmdpO/U/7n3y9bftiDay0slvUjUHHatYAagABNBWOj8mYJN+Rk0PSKa2NiMOqD4= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0PR08MB10656.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(1800799024)(366016)(52116014)(376014)(261021123027099003)(261009223027099003)(261022105027099003)(38350700014)(56012099006)(22082099003)(10067099003)(261021121427099003)(6133799003)(18002099003)(5113699003)(261028144727099003)(261026140227099003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?NFVRRGVMODVwNmFsZ1MxWHpqR3FraUNJK3VGb21ORklYdmJxUmRXUjMvODF3?= =?utf-8?B?cUhmaDFoL1E5dVZ2Tll4UExHMEI2OWcvVVRzYnJVRmVZbzQ3Yldzbm93T2w0?= =?utf-8?B?R2daNUw2UU1HQXJGSE5NSWtBbForWEd5dlJZME1UTjEvQ3dlcXh3ckRMemRa?= =?utf-8?B?RGY4eE1pL3QwZ0xzd0x0VTRSYmxhYUFPK3pMM0JCeERBVDgvUVJBSE05elF1?= =?utf-8?B?a05QWVdqV1R0eTBNYlNLYXM3T09hZjlwQjhHZUhGbGtDelFQYy9Fa3FUbTJV?= =?utf-8?B?Qlo4ZjJBWDBzUTNwUXZPWDAwNys1ampBQ0N0SWtKQ2EzZm9pUHRldldvTTZY?= =?utf-8?B?WC85U3dIWEZHV0dxYTRoVVp3UWdMU1VjbjhGUHdJbklOTkE3ZVVoNkZNNlJT?= =?utf-8?B?OTF5Wk1pZE13WVhhVG5xeHRTU0tWenc5TmxOV2VmTVVUWkFoSVgvQWJ3d2Zo?= =?utf-8?B?R0k3SjhsaHBraWFhY1RIT24rYjZrQ0NPSE12MTBZMmI5Y2tOU3BpTjVQMFdF?= =?utf-8?B?Z3BEclhLdTkzNmxMbmlvWnZpZGphYS9XL3l0RlozTVhBUGY1L2FwUDVpNVlE?= =?utf-8?B?T3NmakJaVmczNUltREdqNVRxNGdqbER2VWJYNXcrRFk2ci9ycTk3dzdVQ3lu?= =?utf-8?B?RXlEMXVZYmhLd1ZtcHBhejZUeGxPUndva3kxeVRlall1bjdSSDZncU1HOHRh?= =?utf-8?B?R1hPOHdRVHhPQW5wQTNuaHZjT3JNcXMvU3FrU09UeVIveFZ5KzdGcW9qY1A1?= =?utf-8?B?c0Q4ekludUJMVDdXT0VMOFNOWGlwbFE0Ymlmd1pvQUhRUy9nV2xqWW4vVDJl?= =?utf-8?B?ZHNXRmtROE9iUmFiZXhFUitQdk5sc01ndEVhUkNjZ0UxTUZjSkxVeENyL3dL?= =?utf-8?B?bzQxT3BVc2s3cE1vcWtCSy9TeVZQYmdna0JIc1ZVb2Q4TnJIMlM0U3RZZjZZ?= =?utf-8?B?WkZjM09IcS9VQVRNSnZUcmxyQzVSdDFLc3pteDFuazBnRVp4aDRvWlJnQWxP?= =?utf-8?B?VVhOMHZzZUVCQ2tJQTkwN29ZR2wwMFMwMElIWlJxL2w4aWlSbUx1bGdsZk5a?= =?utf-8?B?NXluZEduRjY4ZkZTK2Zjc1E2UlRFd1F6YlpJUTdWSThZcmpxSHIyOGJyTEJz?= =?utf-8?B?K3JZWjhHNUZRTXhtOEZMLzFGeUQ1dWhwUUt5K3ZXTnR0NG96Q21iUW9GUTY4?= =?utf-8?B?b1hNSGQ2eHNmakl6YzVEMU81OVcvQi8rYW41N3ZHRi96VDBxYXpEaGU5Y29X?= =?utf-8?B?bFphbWppS01yUFB6Z3pvZ3Nyd3lXUDA2R3VIL0dtUkRrQUs5TUFlM1BFdVYw?= =?utf-8?B?M3lYYlBxSDBYeDRiTzlwQXM1aUFYS3VCZVlERVZ1UWtrZXViSzFGOGlpMitY?= =?utf-8?B?YlJKZUNRb2ZUUjREWG8vOFAxSjJkUlI2S1lTUFE0dWk1Uy9DejJWdVZab2hq?= =?utf-8?B?Z0tkbS8xUm81QlBpTS9xT2lZdE9uanpkV1U1RVBJZE80eGxxc0JyVVBPeDdQ?= =?utf-8?B?QktaZnYvM1VIQmhwSUpzcW95L0w0RUd1MWNDUE9EcFpCOCthZU41cTAyZjFr?= =?utf-8?B?cm5DU1BQQTFKNEpHSTNtaVB5SlU3eXVNTGFFWWl1MWlYWmo1VER0WkVuQ0dL?= =?utf-8?B?NUFlZ3laVDlxc2dxUUo4dXM4dVBrRXAvZ3VmSklFMTZyZzJSenRBbGNHbDdI?= =?utf-8?B?bi85UHpoTFBBS09pUEFqODF1djJENlJMM1NhSmhjeW5ZZW50YjBzRzg1RXBm?= =?utf-8?B?Q2ZVcXdoZFEwczd2d0IyUlhTRlFZMFZERHBZVTlNZ2l3N0NMUWZDYk9HaWZ0?= =?utf-8?B?Qm51U2t1NHRBd0NzM2lpOTVxaFEyVk5jWDgzbTRJa0lEYXBncldwR0taVGdx?= =?utf-8?B?OUpqMzJYcFg0WkVMbGNhdk5SbHdxam9EaFhRU0FucDZmYktxM1dsaTZsSVRJ?= =?utf-8?B?VlhCKzZrdXBiS2gvNVJpNHozdzVZSEhOL3p3RmNPKzI1QnEzR2xVdG10Um9a?= =?utf-8?B?NVRueGVCa29BbW5KZ2MwcFl1Mnl0VXhJUGQ2T2VXRnhicGpObnRBYmJmdHFO?= =?utf-8?B?aUlxZGdnZGN3REtRcHJRK2hEVU1pRnVXbS9aYy9uY3JUcEVQSmlaeXBqOW5K?= =?utf-8?B?YWVNSnJhQmszZmVvNUw0Y1dsZStTWW93T1M0RVFSamNtNk1vRUkzajdVYzZx?= =?utf-8?B?dXdzQmlFUUxmUnFvR2lIYUtlUmVKQ1FwQ3RSd0tFWUFwZ1NkbklxZS8wVHJF?= =?utf-8?B?eDNQR3QzS1NMV3JTc0dQT2N5WmQzZ1MvaVpwTHhZQXdsOUljMSs5T0xIOTBZ?= =?utf-8?B?VGxzdUZlZW5BVVB3Skwxc2FiemlmTmwyWTh2bEJNeWRLOCtTR2VhbWJCbEtn?= =?utf-8?Q?DyakBTiI/pjsI1uo=3D?= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: 4530501e-1e40-427f-801d-08df36947a8c X-MS-Exchange-CrossTenant-AuthSource: VI0PR08MB10656.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 30 Oct 2026 14:45:45.0034 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 7JK1lXq2HqeWE0uvt9VRf/yTAa6rpFgjJA1zWwnCb3vGaLhtYSUOGXccAsxWZCXfP8/EBBKRc9khp9iBB6sDwy/rtQyZdF3aP75kbiLQiIc= X-MS-Exchange-Transport-CrossTenantHeadersStamped: GV2PR08MB9373 From: Cédric Le Goater vfio_rom_read() can leak uninitialized stack data to the guest when a read occurs at the end boundary of the ROM BAR. Fix this by initializing the val union to 0xff, matching the ROM initialization pattern used in vfio_pci_load_rom(). andrey.drobyshev: This commit is cherry-picked as-is, with no modifications, from the upstream commit 402fd5a75659. Reviewed-by: Philippe Mathieu-Daudé Reviewed-by: Mario Casquero Link: https://lore.kernel.org/qemu-devel/20260602074446.1206892-1-clg@redhat.com Signed-off-by: Cédric Le Goater --- hw/vfio/pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c index d930ef46309..fa2ca0d779d 100644 --- a/hw/vfio/pci.c +++ b/hw/vfio/pci.c @@ -1153,7 +1153,7 @@ static uint64_t vfio_rom_read(void *opaque, hwaddr addr, unsigned size) uint16_t word; uint32_t dword; uint64_t qword; - } val; + } val = { .qword = ~0ULL }; uint64_t data = 0; /* Load the ROM lazily when the guest tries to read it */ -- 2.47.1