From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from DB3PR0202CU003.outbound.protection.outlook.com (mail-northeuropeazon11020085.outbound.protection.outlook.com [52.101.84.85]) by lore.virtuozzo.com (Postfix) with ESMTPS id 64AC08109D for ; Mon, 2 Nov 2026 10:36:30 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=V2YBrSG2IPJzge3UG2tWStrMNiNZHLfXG4aG1yKmD33BSuaN1szQVCQDJvqCUN7lrrao8Aw2HV278tkQeHLoO9eZXQJOVDEl+1UZbM0FzYzlljr5c3WwGeC7DE0ryLRS+tjHJjdiwKuw4+T4HaJN3Gt9uns644nPkZId3M9kBhBt39mnJcwe9VvF+XmWLSQ0B1wj2CcJNfIIyF6tgciL+phZqMdXMtqyBm+AGvtQ7wwWQQGALqJuRa/8z6lZZLEobvLgK4lwDLleafY6fzc1+ijGoeLbcfN34UEUYv1L4JQOiKD3kGKnnihVnGaJYhMCEHw7INC6v+noG62VMnt/Ng== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=9n/f58Cfww7ExcwPHWCumaxgk4jzvGlue5epPFjzeyw=; b=LWomr05WBazKF/g3F+iC9RQy/mh0F7GOQ9MEewqJSgqo9+C5QastATPkZCsRSyFIE8cr69ZATYWsx3c3zBMcDFjHEFXYFS5aCq/v9wVvfSS+7FcWqTkl+TZarZ2i503F8Ign+mA+beLgGc+IDWOE7RMjs+8nNENT/xEJghDMeSjB1szEpA5WbFa4IqHo07rVb1A8x+vWIuXdWhCNd9wCkY81JqmPQTlcjDre/dmnvj+K/bZ6SWQKqO9xT8Aq9uzRCs7+mmh1xHlcohyWV4Lmd55V2LuASQek52ejkaQbu0PhaTuMFn6NvnJS2y6IfzJzGnIRMiSpWmm05NOWKXABxA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=9n/f58Cfww7ExcwPHWCumaxgk4jzvGlue5epPFjzeyw=; b=HQ7rLyKGnNKesllFR0FF3gpv9Oi421+aCJ6rPQae8ayIC1W2NQE5/ny2si7vTs5fgi2tcW0O//rSy8Xj6aCzIBJNJJGIah5OjGq1YWWIhthNRTey0/e6kpECijQ9bWkkK9mkbAo7IpQmNuyzf2FnaNJHRIXPEw9gmO8gJ8e1Lq11mhObvIG0v3bi1UeptJycNf73HxRIuKs8XLXhmkEs5TANiUC7VoCvf4ja9b7Uak/aNGFuC8DItWocTS7VYIzo4cJT7XO5i5pK33ADDxHcR+Vo/tETbdPBtB7u0toiIb6G67J/aWnrHhnnPC9zH/BLPP/EOgLgftvVJCN0cOfaqA== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) by DB4PR08MB8199.eurprd08.prod.outlook.com (2603:10a6:10:381::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.569.12; Mon, 2 Nov 2026 10:36:26 +0000 Received: from VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8]) by VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8%7]) with mapi id 15.21.0569.011; Mon, 2 Nov 2026 10:36:26 +0000 From: Andrey Drobyshev Date: Mon, 02 Nov 2026 12:36:25 +0200 Subject: [PATCH QEMU HCI-8.1 v6 10/34] vfio/pci: Reject invalid MSI-X Table and PBA BIR values Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Message-Id: <20261102-vfio_v1-v6-10-9bc7cabc850d@virtuozzo.com> References: <20261102-vfio_v1-v6-0-9bc7cabc850d@virtuozzo.com> In-Reply-To: <20261102-vfio_v1-v6-0-9bc7cabc850d@virtuozzo.com> To: svt-core@virtuozzo.com Cc: Andrey Drobyshev X-Mailer: b4 0.16.0 X-ClientProxiedBy: VIVP296CA0048.AUTP296.PROD.OUTLOOK.COM (2603:10a6:800:353::18) To VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0PR08MB10656:EE_|DB4PR08MB8199:EE_ X-MS-Office365-Filtering-Correlation-Id: 59e404d9-9b3b-4b29-22e7-08df38cd254c X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr List-Id: svt-core@virtuozzo.com X-MS-Exchange-Transport-Rules-Loop: 1 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|366016|23010399003|52116014|376014|38350700014|56012099006|261009223027099003|261028144727099003|261021121427099003|261026140227099003|261022105027099003|10067099003|18002099003|22082099003|5113699003; X-Microsoft-Antispam-Message-Info: WWguuTh1WrO0B92jKfWA9ScThRTWt5C6ASG4PfQ4noJ3N4VPFAk5lLq2FfOMTpv30yW7+xDSLjx3TeAw+OEV0wNY881QWXF+BHS/kK9IZ4aTQJzDdIk+R5HxtfCSGDXpUuQ0aHNFjCjHcTy4BpEWlc/kPsWhS8NhQ2Ugn913vJpEFqtI4cU2jJbHT4Kci49xHszYqJDdzmQ7qZWPBxOzVgUFHff8hEj5CHCDmEkzArt/uMUu3dYlvJ4jwudZTsGriurmbNKEah+gcjHugC96DsqKzWIyihaZQp7UYv9UAbjMeIOJb94YdbnFl0iveiGs34Tf1SbXqY9GE3NWXDmx8KKAE2rs8yXVflzYPxx+LBMyE7Jmbd/g2PuBnkt+xppwwEt64WrQwyVX+yczTkxyjZVqNk1hQhXSt+03Sns9b99Ik/B8nuUGBSbetp1NspVvyBCY2nty/LW7Of/02VZnoJ3ZOvkvopCJGusxNg0Zp8n0YAov6y8wpAaXmzA+2xz25tGXu3/+mRZEQHAHJJGh+HOeaNCtrcuK6qox6d7AbqvoVPtOALUBAGSmE2jiGwKBQP9UT6gMx3wH9fMZ8ywxUkzBF2EI3LvoLfzjOHE5NuYjRFiGp1y31kxB0hQ8mMiIy8m+OfpQgli0CxuiR+LOjvsk5186wZ3P97AZbwmuikZBaeGuaVgZkPz2fQGapJBu X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0PR08MB10656.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(366016)(23010399003)(52116014)(376014)(38350700014)(56012099006)(261009223027099003)(261028144727099003)(261021121427099003)(261026140227099003)(261022105027099003)(10067099003)(18002099003)(22082099003)(5113699003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?S2RleUZLL0JqWTlqV0NlQW8zUG5EcFh1Ry8vOHBCTk1xWG8xc2tmYmJMZCtL?= =?utf-8?B?NHZFaTZhM2VVUnkzdVl5NldxNjluRkxhUnAvSkVPWDdBVm1QOGJ5cjdORnJw?= =?utf-8?B?VFZxcVdSTVpNVk83MDZlSWk0VS9FSExDK2s3REFhUk1ZRmZ5b0NrZ3JHRzNx?= =?utf-8?B?dmRjNG1wWmQrUC95OTJudUVhcDdxMElTVW1lRzBLRG83WnZIejZNcE5mNGk1?= =?utf-8?B?cEVOdnB3WGQ0TkN5SWM0Mmdsb2IzTE5XcmJ6dENNVk9tQ0llVGVZYzNIaGQ0?= =?utf-8?B?Sk5SaUVFRlRob1BPenUyeHBPdWkvWEZJM2tSMkx1MnBtZmhjZGVVazRBcEFM?= =?utf-8?B?QkZHOEJTVnpqVXF0bGZmajM5QkJqcVp6R3YwVGZCOFNJNHBPNnhsMUZqM0cx?= =?utf-8?B?bTlzR1FQVjFKVHAxem9XTXdHelJzNlFmU0NJNVN1STh3UGVOMjNlMkJTNWZi?= =?utf-8?B?OUpoQzhFWDkzVVFIaUVHN3BvNStrM0toSFlDWkxUTWY4YllRcHo1bzByOGVa?= =?utf-8?B?dXV4eHBrc0dXRUNjYWdGbW9CcmpsK1NwU09TT3FUaTN5NS8zL1JLQWtBRllI?= =?utf-8?B?YVhRVlEzbEFCK3l5VjNTNnJNUDRlb2wra2FiZjZydnczMWtDeEtDZldiM3BO?= =?utf-8?B?K1dBTVl6RVJ1OFlyNStXa3ZhbTZmL1NpN3VQZWxmUkVZWVJFTitOU0h0K1p4?= =?utf-8?B?YVpBdjdONHlpNmQ1cEx0aktiZFJjSXV0bnF0cUVOTUdZaXIwQTBkS0xSdUNW?= =?utf-8?B?ZmY1TkpQNkI4ZDRpMi9wYUk2NlhKbmphV1JCQ1ZkeFk0YnJVNlpZZzVqT1Mv?= =?utf-8?B?TUJSaTluQXpmR3I0c0pqQW1sdTl5bnZlZGpMb3psTnNJQk1ybmlXbWJmVkpW?= =?utf-8?B?UnRCMkJFaGRzSWdHOVVkV0FVWUtzdC9RME1ZeG5jUVZCbWVLSWpaRGR0Q01l?= =?utf-8?B?Y28rZU9OeHYzSVp5TzY2bVRHN0VzR01ZejVjdHdtSFY1Q1dzM3NHMXJmOVlC?= =?utf-8?B?NThEV1VYd0VUQUFROEYwc1A3aGhrdk1sQy84V3J3NHVBODhad1pyN2xsQ3Jv?= =?utf-8?B?ZnQ2cks2TGtBamw2UGprZVpPMDlqaDFDTGpBeHNWNVhZUWlSZ1JUUmNOcUZy?= =?utf-8?B?ZHppbU5rZ2o0M21lVDhSWjFac05VYTEzTkxkRkp1Z01tbHBLRFJCNjZlSURa?= =?utf-8?B?SnZuQTFKN2QvNW1FaGt6N0piQTdWam1hdGo2dVBobnZLeWx3bFpXUFVNUEJx?= =?utf-8?B?S3VwTGpiZkJuVk9NeGt4T3YzMmZZRDFtQ2N1ZlNNWkxKRnhqcFhZNEIvTjFy?= =?utf-8?B?bVZDeVdwYU4vR2M1azFvL0dENEpWVFYwN2J4ZDl1TzhaTjhObGZCUEtHdG03?= =?utf-8?B?ejVra1hBSStiSjBjRlYyVDJkTFBxd1BJZkJBczZQK2c2T3c4NzhTMS9CbE5G?= =?utf-8?B?NlJra0luT2w1MEsvelBmWCtRY2YzMmt1Ny9xd28vNC8rSWtwR05mWDlKN3VC?= =?utf-8?B?VjRHcU03UDVMTDlCUk96K1ZVaEQ3WDJQa2YzVDJlM0lRaGZ6enN6WGlHbTdG?= =?utf-8?B?L2tFem94M2hvV3hWbXoyYTFHQ1RZWUYzQ0IyVmZNV0hOenpFY2taV21Pbk10?= =?utf-8?B?cFVJWEpYelhUY0RkbFJRRklINjkrdlhUWlZkRW1zRHZGa3ZJaStpKzExRnd2?= =?utf-8?B?U3U5R3FDKytRUHlrMEhSbDBleUR0WWFKZ25wd0JES1BmbVhTRWpTdFNCTTJ4?= =?utf-8?B?ZG1ydEdqMWhzMFMzKzVRd0tHK3FFZ09TVXJaVVNxV0lKUW9oM2c3WjFlUFFR?= =?utf-8?B?L3RQYXpvbWZ0VHhuazRrQyszWEpGQno1STVPWEo3T2s3N0pOV0JSR1pZNWhm?= =?utf-8?B?bHJQZThuTk0vVkJqNSt0U3JWdDFvWWhUS1JvZS9TSTg3aWJhZ0VhbWlEemtG?= =?utf-8?B?anJkNVNhTGtVcWNzcDdmL0F5UndTc1huRXp3d1dYRmFWTXduNzVRd3B5RDhM?= =?utf-8?B?TU5xbzBtZEcyck0wTHVTSlAybm9PRlhpckFsNzV6cUhUaCtFWTlqNndhbDNV?= =?utf-8?B?QUYzM0VxOHpLK1lIaXZ1Q3RlblF0cFhFeERiYnRuZmVlWVB5K1hpL1NFZHBF?= =?utf-8?B?ZStIdE9JekFwb2szNWJ6ZHREbmhwem10VnBxMW9ZZTFEem1pVWxTUDhOaFV5?= =?utf-8?B?d3lHbnZDQlBmaUdwN0JvNTh5NlgwdWpMUWNkdm9mK000aFdOYzYxbGlNV3FT?= =?utf-8?B?YkRjUDRlSThIVDJmZVBEKzUyMXlsdDBERm45NGorR3hJeldkbFdPSWhETmlQ?= =?utf-8?B?MDcwZG1VUEY0azd6SWRCQ09RV2c2TTZ5U2g2ckVLT25UdUphN1UzeWQySlEw?= =?utf-8?Q?Dbb9ETON5IVE45Ds=3D?= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: 59e404d9-9b3b-4b29-22e7-08df38cd254c X-MS-Exchange-CrossTenant-AuthSource: VI0PR08MB10656.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Nov 2026 10:36:25.5963 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: lKJYr2sUtfAXmO4UUlb4kgX4ct0o6Pmshcs5eDb4R1gGpgUbna8xtRRAwzK2J0t1Guw/2a31BBXrViHzO2FO54SHII1v07uGWOqGGR+gcIE= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB4PR08MB8199 From: Cédric Le Goater The 3-bit MSI-X BIR fields permit values 0-7, but VFIOPCIDevice::bars[] only contains BAR0-BAR5 (6 entries). An invalid BIR value of 6 or 7 can cause an out-of-bounds array access (CWE-129) in vfio_msix_early_setup(). Add range checks immediately after extracting the BIR values. andrey.drobyshev: This commit is cherry-picked as-is, with no modifications, from the upstream commit 9daa7347ff25. Reported-by: Feifan Qian Fixes: 65501a745dba ("vfio: vfio-pci device assignment driver") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3878 Reviewed-by: Alex Williamson Link: https://lore.kernel.org/qemu-devel/20260706161334.2165482-1-clg@redhat.com Signed-off-by: Cédric Le Goater --- hw/vfio/pci.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c index 5e281b2e1d9..d930ef46309 100644 --- a/hw/vfio/pci.c +++ b/hw/vfio/pci.c @@ -1791,6 +1791,14 @@ static bool vfio_msix_early_setup(VFIOPCIDevice *vdev, Error **errp) msix->pba_offset = pba & ~PCI_MSIX_FLAGS_BIRMASK; msix->entries = (ctrl & PCI_MSIX_FLAGS_QSIZE) + 1; + if (msix->table_bar >= ARRAY_SIZE(vdev->bars) || + msix->pba_bar >= ARRAY_SIZE(vdev->bars)) { + error_setg(errp, "invalid MSI-X BIR, table_bar=%d pba_bar=%d", + msix->table_bar, msix->pba_bar); + g_free(msix); + return false; + } + ret = vfio_device_get_irq_info(&vdev->vbasedev, VFIO_PCI_MSIX_IRQ_INDEX, &irq_info); if (ret < 0) { -- 2.47.1