From nobody Wed Jan 7 09:17:32 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1767368911; cv=none; d=zohomail.com; s=zohoarc; b=kUvCtLp24WuByIpSWWKY9sJbiKPgrN3Qfmgo/cLi0SDdD+sbp9ADKiydKPah+oYLkZUW+hlgcl/DYJotxKfc/Q5l59RJ05aHVL1dFwb8wYYmsZIxTKaOM/lLXI3pVqk8rF2Pk3G3XXGEy2fuSK84wkP4GZqXwqLE+V9uNiTORGc= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1767368911; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:Reply-To:References:Sender:Subject:Subject:To:To:Message-Id; bh=cgm4dD04jYtQjjRBWvMtOgmiJOWYHkHd/DAtoPh4I28=; b=HRe43WiDxUbjI22QVmejomyzGuwwUNYXgNsEPMCnMsNpL7zOWPNGg1w78xLMO4t3q4XHE2/pjywftIIlrQKiBLhhmi3GzQVWsGbAZ8Qs5p7WnmPGw614+rPi1FWGa4rnokVhlX88n50AV96Pp0VhPvHYnaZ6bMePyHKZkAAA0W0= ARC-Authentication-Results: i=1; mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1767368911686440.6656944152418; Fri, 2 Jan 2026 07:48:31 -0800 (PST) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1vbhNs-00087d-4b; Fri, 02 Jan 2026 10:48:12 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vbhNp-00085Q-AK for qemu-devel@nongnu.org; Fri, 02 Jan 2026 10:48:09 -0500 Received: from frasgout.his.huawei.com ([185.176.79.56]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vbhNn-0002bO-IR for qemu-devel@nongnu.org; Fri, 02 Jan 2026 10:48:08 -0500 Received: from mail.maildlp.com (unknown [172.18.224.83]) by frasgout.his.huawei.com (SkyGuard) with ESMTPS id 4djSk42V24zJ467w; Fri, 2 Jan 2026 23:47:08 +0800 (CST) Received: from dubpeml100005.china.huawei.com (unknown [7.214.146.113]) by mail.maildlp.com (Postfix) with ESMTPS id 0750940569; Fri, 2 Jan 2026 23:48:04 +0800 (CST) Received: from SecurePC-101-06.huawei.com (10.122.19.247) by dubpeml100005.china.huawei.com (7.214.146.113) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.36; Fri, 2 Jan 2026 15:48:03 +0000 To: Michael Tsirkin , , Vinayak Holikatti CC: , , Ravi Shankar Subject: [PATCH qemu 1/2] hw/cxl: Check for overflow on santize media as both base and offset 64bit. Date: Fri, 2 Jan 2026 15:47:30 +0000 Message-ID: <20260102154731.474859-2-Jonathan.Cameron@huawei.com> X-Mailer: git-send-email 2.48.1 In-Reply-To: <20260102154731.474859-1-Jonathan.Cameron@huawei.com> References: <20260102154731.474859-1-Jonathan.Cameron@huawei.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Originating-IP: [10.122.19.247] X-ClientProxiedBy: lhrpeml500011.china.huawei.com (7.191.174.215) To dubpeml100005.china.huawei.com (7.214.146.113) Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=185.176.79.56; envelope-from=jonathan.cameron@huawei.com; helo=frasgout.his.huawei.com X-Spam_score_int: -41 X-Spam_score: -4.2 X-Spam_bar: ---- X-Spam_report: (-4.2 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-to: Jonathan Cameron From: Jonathan Cameron via Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZM-MESSAGEID: 1767368913285158500 Content-Type: text/plain; charset="utf-8" The both the size and base of a media sanitize operation are both provided by the VM, an overflow is possible which may result in checks on valid range passing when they should not. Close that by checking for overflow on the addition. Fixes: 40ab4ed10775 ("hw/cxl/cxl-mailbox-utils: Media operations Sanitize a= nd Write Zeros commands CXL r3.2(8.2.10.9.5.3)") Closes: https://lore.kernel.org/qemu-devel/CAFEAcA8Rqop+ju0fuxN+0T57NBG+bep= 80z45f6pY0ci2fz_G3A@mail.gmail.com/ Reported-by: Peter Maydell Signed-off-by: Jonathan Cameron --- hw/cxl/cxl-mailbox-utils.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c index a64b8ba5351f..d8f62a13a8ec 100644 --- a/hw/cxl/cxl-mailbox-utils.c +++ b/hw/cxl/cxl-mailbox-utils.c @@ -2411,7 +2411,7 @@ static uint64_t get_dc_size(CXLType3Dev *ct3d, Memory= Region **dc_mr) static int validate_dpa_addr(CXLType3Dev *ct3d, uint64_t dpa_addr, size_t length) { - uint64_t vmr_size, pmr_size, dc_size; + uint64_t vmr_size, pmr_size, dc_size, dpa_end; =20 if ((dpa_addr % CXL_CACHE_LINE_SIZE) || (length % CXL_CACHE_LINE_SIZE) || @@ -2423,7 +2423,12 @@ static int validate_dpa_addr(CXLType3Dev *ct3d, uint= 64_t dpa_addr, pmr_size =3D get_pmr_size(ct3d, NULL); dc_size =3D get_dc_size(ct3d, NULL); =20 - if (dpa_addr + length > vmr_size + pmr_size + dc_size) { + /* sanitize 64 bit values coming from guest */ + if (uadd64_overflow(dpa_addr, length, &dpa_end)) { + return -EINVAL; + } + + if (dpa_end > vmr_size + pmr_size + dc_size) { return -EINVAL; } =20 --=20 2.48.1 From nobody Wed Jan 7 09:17:32 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1767368931; cv=none; d=zohomail.com; s=zohoarc; b=BQU3Fc2tH6DvqKN9P5Nj5sihgrmXtCL8+jBI8Ke9152DbcZ7mxtIVdV5s4/umIEWDvUcmKCVtfSBJd1WGjSoYqfHtzXGQxNq+JS7wLK1eDBxRfJbV7+caW5I/RxVILkVHwESUYX2lUz1aN0wYpHQsh5pFIQbxXMHb2qVAqtwON0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1767368931; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:Reply-To:References:Sender:Subject:Subject:To:To:Message-Id; bh=HiXVfxYuPT17jO+bAVDRM6p+mVX7VPmyuQuBDE5Ve8I=; b=TWbNooIAqHYfi4KpbYFgJM/UgVV0HaF+dFeP9yeP5h8Jz0VmGO+YYcXL7SUHnjggqSYeBRLoH4TBY47r0zne6zoaaJS4vccRuLf3XKZkWw8hGZWL+1SE2P3KhUSwUs6tsKIkg6nIQMj/2twojHwC7dbHSly2XjEC5cnGJoqWnKE= ARC-Authentication-Results: i=1; mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1767368931340639.9872805726752; Fri, 2 Jan 2026 07:48:51 -0800 (PST) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1vbhOL-0000Bp-44; Fri, 02 Jan 2026 10:48:41 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vbhOI-00007m-3U for qemu-devel@nongnu.org; Fri, 02 Jan 2026 10:48:38 -0500 Received: from frasgout.his.huawei.com ([185.176.79.56]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vbhOG-0002dV-D4 for qemu-devel@nongnu.org; Fri, 02 Jan 2026 10:48:37 -0500 Received: from mail.maildlp.com (unknown [172.18.224.107]) by frasgout.his.huawei.com (SkyGuard) with ESMTPS id 4djSkg1bb7zJ46DJ; Fri, 2 Jan 2026 23:47:39 +0800 (CST) Received: from dubpeml100005.china.huawei.com (unknown [7.214.146.113]) by mail.maildlp.com (Postfix) with ESMTPS id DD80E40570; Fri, 2 Jan 2026 23:48:34 +0800 (CST) Received: from SecurePC-101-06.huawei.com (10.122.19.247) by dubpeml100005.china.huawei.com (7.214.146.113) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.36; Fri, 2 Jan 2026 15:48:34 +0000 To: Michael Tsirkin , , Vinayak Holikatti CC: , , Ravi Shankar Subject: [PATCH qemu 2/2] hw/cxl: Take into account how many media operations are requested for param check Date: Fri, 2 Jan 2026 15:47:31 +0000 Message-ID: <20260102154731.474859-3-Jonathan.Cameron@huawei.com> X-Mailer: git-send-email 2.48.1 In-Reply-To: <20260102154731.474859-1-Jonathan.Cameron@huawei.com> References: <20260102154731.474859-1-Jonathan.Cameron@huawei.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Originating-IP: [10.122.19.247] X-ClientProxiedBy: lhrpeml500011.china.huawei.com (7.191.174.215) To dubpeml100005.china.huawei.com (7.214.146.113) Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=185.176.79.56; envelope-from=jonathan.cameron@huawei.com; helo=frasgout.his.huawei.com X-Spam_score_int: -41 X-Spam_score: -4.2 X-Spam_bar: ---- X-Spam_report: (-4.2 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-to: Jonathan Cameron From: Jonathan Cameron via Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZM-MESSAGEID: 1767368933405158500 Content-Type: text/plain; charset="utf-8" Whilst the spec doesn't speak to it directly my assumption is that a request for more operations than exist should result in an invalid input error return. Fixes: 77a8e9fe0ecb ("hw/cxl/cxl-mailbox-utils: Add support for Media opera= tions discovery commands cxl r3.2 (8.2.10.9.5.3)") Closes: https://lore.kernel.org/qemu-devel/CAFEAcA-p5wZkNxK7wNVq_3PAzEE-muO= d1Def-0O-FSpck4DrBQ@mail.gmail.com/ Reported-by: Peter Maydell Signed-off-by: Jonathan Cameron --- hw/cxl/cxl-mailbox-utils.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c index d8f62a13a8ec..2f449980cdc0 100644 --- a/hw/cxl/cxl-mailbox-utils.c +++ b/hw/cxl/cxl-mailbox-utils.c @@ -2547,7 +2547,7 @@ static CXLRetCode media_operations_discovery(uint8_t = *payload_in, * sub class command. */ if (media_op_in_disc_pl->dpa_range_count || - start_index > ARRAY_SIZE(media_op_matrix)) { + start_index + num_ops > ARRAY_SIZE(media_op_matrix)) { return CXL_MBOX_INVALID_INPUT; } =20 --=20 2.48.1