From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from AM0PR83CU005.outbound.protection.outlook.com (mail-westeuropeazon11020138.outbound.protection.outlook.com [52.101.69.138]) by lore.virtuozzo.com (Postfix) with ESMTPS id 09B8F8017D for ; Tue, 3 Nov 2026 13:57:45 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=RbUO+o77q4lcn6JOXzx6VvCmpAGUaQcxJCYWLl3wAoPwT5olsmJkuk/ygfpwItmcbKycVSph4emuSV4AQAOEJyrs0n9i3tu1qU/JcOVPl5kyJk2RXK9rQDD3g8U1c4w9x5wi4IyZwKaZL+ukxCbPrM0uGDPnH5lloYaxYYYwSoD98/Ymsx07pSHar+YoLWadohWD1D+E0NPgq4k5UgF8iokBiw9ZMBpLfYCTi1bctMamenuLIUpLDYH/hNz5lhPg0EpQBjLRoXi79cyWgzl6bdjiKrprIiWvjx32FWmkg54fGt8727fBpoM56bdhSwfZwCwArgrWq7OZL/Vdnh7WTA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=GpyZeuzxBx/9EXW2jB4YPAzv27x1rv066ytK047XXLA=; b=N+zWyhldC9zxqTspGVvwDOvHcy26cZfHsVOw263JyfTQrWaOkDneyvSi4GeSHD+iVAi7PAX4sFFCdJJQe6lwFfOijGxw6Ioagcax+DzOhWMmcpT7a8uypODLgGLtwHwy/XWQQg7lflboEm/ccUImrm8X0hlvTCJSBpownkNza46aavz98zf3WvRDIKTSsltElNUOM+7rYcz1ksJWRDanGqvRqDhmRXcUxslSjWAf7C1oMnn1xDi6nv/ihRYNPbX2dJew7DSSitXf4H/4nOnwjfzDDkmKzcs9UVI6nFHUhmIxxXN98GrmNfN8rYB6es+scv9OdTwHSwdGqEdK4qmfRg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=GpyZeuzxBx/9EXW2jB4YPAzv27x1rv066ytK047XXLA=; b=YjpQF4DnfsVm0HejXhjVnAoJbcUK3pwj5XKXF+9xe7OK5KZAB/3l2vGVSMhZFAG5i4ydmVvqrTONw86vIyGL3oj5i+Vny4X3Qda9BiGGKmMYdKDevh5Oyd1j8x8E81FN3HapWx1nXzv3/GTaS6ERrr0Psf85kGYCudGYiTfw/w2H4l7c5WCn52ByJtMGdJpYMPfXdXhjZ4BrnkuJWeG5XbnbfhgNM9SZisezJKp9cXRIxjqtg9irA5OOle9e7rRcf1kc6R6QBn8uERBXOepGslrFS3uTESvuznq1QcHI6g6PNpxjuo4SQbRBJZZexGIyKXSilwl/0pB6xnWPH6YpkA== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) by DU2PR08MB10280.eurprd08.prod.outlook.com (2603:10a6:10:491::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.569.12; Tue, 3 Nov 2026 13:57:41 +0000 Received: from VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8]) by VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8%7]) with mapi id 15.21.0569.011; Tue, 3 Nov 2026 13:57:40 +0000 From: Andrey Drobyshev Date: Tue, 03 Nov 2026 15:57:27 +0200 Subject: [PATCH QEMU HCI-8.1 v7 12/35] vfio/pci: Fix information leak in vfio_rom_read() Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Message-Id: <20261103-vfio_v1-v7-12-4467fdccbbe6@virtuozzo.com> References: <20261103-vfio_v1-v7-0-4467fdccbbe6@virtuozzo.com> In-Reply-To: <20261103-vfio_v1-v7-0-4467fdccbbe6@virtuozzo.com> To: svt-core@virtuozzo.com Cc: andrey.drobyshev@virtuozzo.com X-Mailer: b4 0.16.0 X-ClientProxiedBy: VI4PEPF00000153.AUTP296.PROD.OUTLOOK.COM (2603:10a6:808:1::86f) To VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0PR08MB10656:EE_|DU2PR08MB10280:EE_ X-MS-Office365-Filtering-Correlation-Id: cfda2385-e534-4aa1-22c6-08df39b26625 X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr List-Id: svt-core@virtuozzo.com X-MS-Exchange-Transport-Rules-Loop: 1 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|52116014|376014|1800799024|366016|38350700014|261026140227099003|56012099006|261009223027099003|261028144727099003|261022105027099003|261021121427099003|261021123027099003|10067099003|18002099003|22082099003|261102123227099003|6133799003|5113699003; X-Microsoft-Antispam-Message-Info: Th+AzwC3I+ONlc6zkJ0CNnRfgjUlerzlxDe3LIEPn6Yqy0J1G9ecBdoASnObKWiTYcp1jhcWzdVwLPDR5Ow8JlZ+io/GlrQSF2dhUtbMGRmAsplACa0kFBcHDeLRKSvfbiTn9xt0MG3ioqc4PA9AvODjjqLEA0VFjV40YWk80H4RUjGcR5OnFJqDwXifze+ohk8/NSbYDUB4hXP3XSJLRlwCaos/YkfM/r+9PrDO/zElzynJxdgOF9qQxKlqNjvwIgOfvumNDncjis/6G+YPPcY1ZZEVtxxf2Rle6vAgmlgTJirYZqKNFmadZMi+BHVzm0VDLCkJ0pruOfKLYqWlgPBCyLpu7vgtwX0rlbSLr6A/jiIBzUqGKUk7ehFdvLuezpwRFTEx9lmIpj3J4jn/8w9brgkf10R2ifztpLxS78QuJ7qC08DdDxoQfKNMJ9A54pKX3je2PEcbAZAkMmgI+2vaKsIs8ET+lRrHwrCKVjRnXTJ6NnTOqoM1mRaoDoA0zcgY38wTu5ZonElSbPgDvtGh3ruEildmXcgZ34arFtHAU05BJ1rlVspJHmAgcGhvc9gYcwmFRcLjCOoVdkqX9teShi1p/h2lm+mT9bK3q2GaACddSJPEoxJsYekWERXAMJ3MZ8g+HuBY5fsKR4KyDvTMwzzd/Ppt2kwYFsGdL8w= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0PR08MB10656.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(52116014)(376014)(1800799024)(366016)(38350700014)(261026140227099003)(56012099006)(261009223027099003)(261028144727099003)(261022105027099003)(261021121427099003)(261021123027099003)(10067099003)(18002099003)(22082099003)(261102123227099003)(6133799003)(5113699003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?QnV4TnNwVXQ3NWZxT1VzU2RJbGVLVXJONzhXWEVwYXhpNVNRUWl5SGUwRm43?= =?utf-8?B?SmxRZytHSmZOT3RDVklmczkzMHZ5SlYxeTRseWZzR3JDMEpHRHlqVFY4UnBr?= =?utf-8?B?QWthdDZDYUhkL3cvSllITjkrWHBhaDZTbG1hUk5ReUtZU1h2OUFCYlVNTXBY?= =?utf-8?B?M1UycDlOV2pzSGlnMnNWSGJJSkx4eFNwOU9KS0FPVEdqM25vVjhzSzBPeDg4?= =?utf-8?B?T1FiOFBVNTArSlh1Y3JVYVFEbkwxZEhOK01pbXU2enZFTnU3Y0VyMmtUeUJC?= =?utf-8?B?R3dXQUk0YVRwMDhFZUY2ZDVaWi9INFhwOHBVUkN6bU1sZ1Z6RzlpdUNFUHFJ?= =?utf-8?B?T2NsU0t5R1hOWVRrOVBkUDM4RDlUM09Ldy9JR0VmRjVVbHNSSVpYMk4rRU9R?= =?utf-8?B?RWFma3hCRVlsbUhpbXlxT3N4VjBGVFRwVVNWT1Jhbyt4eGc5OXFaQ2JmcHQ4?= =?utf-8?B?TGFOVjRxVUR3dXhvTWRrSzNsT2FFZ0s2alJBNEozK2R6NEhvN3F1UHJ3eWNM?= =?utf-8?B?MGZ5anJYdlBkVHBXRnFFNFdDNlRPamtoam12cnNwNlZLSWVqck9DTTBHdm1l?= =?utf-8?B?QkcrTTRrVnFRV1lrcGkzbnJob3JOaXFkcW1xb3BuSVNTWDV3TXMvd2xNMnRN?= =?utf-8?B?d29hekc1SlFKRjFxZlViU1hBV2hmK0laYjNFSmhKdE90dmZhYURsUytObzIw?= =?utf-8?B?SWhtVUVBUGxVSENNL3B0Q1NTSWRSa2htdTBGenVmYnBoaTA2blV2ZlFoMS9R?= =?utf-8?B?bWxsZ2VQY0VzNlZuK01Xd3JUSTVYdlM5MGJySktzM2VETG5UMWtid2tUTS9n?= =?utf-8?B?d0txYmJsZ3RvdkhpUW9HY0ZMc3ZXSlUvbUloZ1Q3R0ovTnFBOWYvd0FiTUE5?= =?utf-8?B?aCtVWS9lUC9ack1TM29pUklSY3pteXRiK0FhN0FtMUd4WXI5a20yVlIvWGNj?= =?utf-8?B?bm5jZlJ5Y1hWL05ZYXFCRFpIRlp4MDg1N0JxY1cwelBXRTJDQWIvM1B5VkpQ?= =?utf-8?B?MVh5U0VwdlF0TFloZmMwcmNIencyd3NWSVhhYzBPL2NqenJVbjV1YXBmYnRn?= =?utf-8?B?Si96djNLWGhYckhVKzk4aStPaDRNNjFHdldOdHF3ODBnbmNIaW9FcWlGSGdC?= =?utf-8?B?dXNnNmcrQ0I5b0lxa0x3NXp5SU9WWjl4UmtXVkwwUlYrL3pOcFdRVVBGV0hv?= =?utf-8?B?S0ZrZGVmMjZDNUhKajMzMFY3ekRSYkZFTGttSEV1clFkdHByTzl0Q0dubk1I?= =?utf-8?B?SmRiVmNIMlJNSUFLeW9uZG45WmZZbEVyeFN1d0huN2tiZjNuZ2VCUGlNYjAx?= =?utf-8?B?TUMvMlZPc0tKWXJ2Q1RYYXZIRFJLbk1UaURJTmFLTzkvcUl4RlN1ZnVJOWl5?= =?utf-8?B?QUJOUGJBYVdjR0hhZzhhOUM1NG5TK3FhVS9hSnppNDhoWG14eGZIdXg4Z0NK?= =?utf-8?B?V1NGeWNsQ0MwaE56ZSt5TkpvNGtMS0dNQ2tydlNYS1pVcE0vWXA1d3VuczZl?= =?utf-8?B?a1ErOUJVa3pmWGdlUGdycGZWSHdYZTUyTnZNa3dtL1VzdDk3NTQrVnVOZ0Jp?= =?utf-8?B?RWhGVVNiRU5rWjY3cVpVbWdvSXR2YzEyWTlad2tYWHNxMXRHa0VJd2gyUkNm?= =?utf-8?B?OGNLY2hMWVpBTm1VcVZpQk5JNEJnMGdIWVhTU21sM3NsNlZHd09tZEJDUjJT?= =?utf-8?B?Q0ZqbXJRS1NIMU1OaVp4dHNpNS9iNUVxdk1KRUhEeHpTa1BXLzVTTzNNeDNy?= =?utf-8?B?aXp4SjJNYW42YVIxT1k4Znp3VEZXblY5UUYzdjIwUk5uWm5ZanpCZy93RkI1?= =?utf-8?B?TzRxRHZOcWVBblRCNm8vbFZiUGxiOTlRZnNKNy9vM3pucFc5TzU5VHlwVEsw?= =?utf-8?B?NlczdDdmeWE4L1I0M3dNWWxnVm9sL2Z5VUI2dllXOWJZcldTMTF1andjQUNE?= =?utf-8?B?cjM4ZHJLa2l3ZEhpMm05dHZpMUswQjNtcmwxUGlZa2hJZnlsQTFUUlJLbzNo?= =?utf-8?B?eWxCLzJ6eU1jQXpKQ0E3KzhZc0FqbWhlTEhTWkhwYVpwaUZFUDZvWTNQNDJz?= =?utf-8?B?S29FQm5vVlkrOWQ1MHB6NmluS1RLUldCZVBTTEV1d0pIelZZSEhyR3dXelRT?= =?utf-8?B?QlRmRmNxZkQzclBJYVlzMm1LSmpUcUN1SkswY09NWDJoSW5GOTNuL2Q0UDcy?= =?utf-8?B?ZndKNHRzUE13dmtJQjNtYWFEZWNNa215WktqaHlXeFE3d1FvUURCdG8zOTk0?= =?utf-8?B?RXZvQkpGNmpacG40a0FETEhzcWhxdlBleERqVmxGRVFuWFZqR2UwUnUxOXZX?= =?utf-8?B?TWptQ3lFQnE0bGZYUS9vTmtuaThsZng4RWlrWU9BUHdKeGUzVUFSenN4TkRi?= =?utf-8?Q?UqlUgcAiW1Bkof7w=3D?= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: cfda2385-e534-4aa1-22c6-08df39b26625 X-MS-Exchange-CrossTenant-AuthSource: VI0PR08MB10656.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 03 Nov 2026 13:57:29.1808 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: cRjmADaGYGkq59jHHuqQ9kaj1ROg1JKsUboo/WXXoeZ/JVHl4Gqm+mqawXw1cJjc3x0WlzoUwjIDDTxVrMgAG5Z7I/fV0S1FP87v35vahTo= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DU2PR08MB10280 From: Cédric Le Goater vfio_rom_read() can leak uninitialized stack data to the guest when a read occurs at the end boundary of the ROM BAR. Fix this by initializing the val union to 0xff, matching the ROM initialization pattern used in vfio_pci_load_rom(). andrey.drobyshev: This commit is cherry-picked as-is, with no modifications, from the upstream commit 402fd5a75659. Reviewed-by: Philippe Mathieu-Daudé Reviewed-by: Mario Casquero Link: https://lore.kernel.org/qemu-devel/20260602074446.1206892-1-clg@redhat.com Signed-off-by: Cédric Le Goater --- hw/vfio/pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c index d930ef46309..fa2ca0d779d 100644 --- a/hw/vfio/pci.c +++ b/hw/vfio/pci.c @@ -1153,7 +1153,7 @@ static uint64_t vfio_rom_read(void *opaque, hwaddr addr, unsigned size) uint16_t word; uint32_t dword; uint64_t qword; - } val; + } val = { .qword = ~0ULL }; uint64_t data = 0; /* Load the ROM lazily when the guest tries to read it */ -- 2.47.1