From nobody Wed Aug 26 09:51:17 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1779486742; cv=none; d=zohomail.com; s=zohoarc; b=ijg7g3wk9nWLlygxzqMhd5QQSPkloYt952MAF4jm6pgKXfc9YxJwJa4GfWm5D1uFWQMhmluVZQD2M7bPW3JXdLU1KWoP29pe+7MuDKmkeWXaZZYS7LKOuPfgt+QRSzbwSX0KSdnaq8H33aabGME9ePUmaL9UvwONOL5MdfU7+1U= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1779486742; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=SAizpcDM+oHJS7ZMinKUtj38shPnTKxLmJH442fqmaU=; b=dNgKQEDgG+nDk1tPtM5i/Ufs5IjTLf+EDK4icGw0sFko/OO2k1TOJtfqpWXtqeunmBhC+QQ03JDV9ClfCoesOKtSu2Wrzi0QGseTXp48HLQf5eZzNOoUdP+zurIX5vSRJ0jJjGncONOV7LL3giTCzQn0bma40ajiDvEnjYegI4o= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 177948674273980.67169052051054; Fri, 22 May 2026 14:52:22 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wQXlm-0001MT-Cr; Fri, 22 May 2026 17:51:02 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wQXlY-00007d-5Y; Fri, 22 May 2026 17:50:48 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wQXlW-0003Xb-Bl; Fri, 22 May 2026 17:50:47 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 5F2271AFB6D; Sat, 23 May 2026 00:49:20 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 86C8C3B71BC; Sat, 23 May 2026 00:49:24 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1779486560; bh=APXHp0pm6hEEyeHF/aIo5LS7R2NFDUPqmasahR+f6/4=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=mxBXjnWjXkR4w+MTPuUvRv49SA3xOACMHtgzspm+gurjvTx4gLEmMi8YtvEpomK87 t11CX42hWyuyauPQ6f4633ShpNkeeDUpswU3pmoHVheCDLZKy7GHiIqsqIKZ1I49SA wBy6rEac9XzqkDMKpdENLVbeX2IRPcN+bJhTOpZwOCdNpjqNXNU7gDTvwnHqwBCSvs gWTDZSPquBQjA68q640pephT3D/L+h+mN1Hql14o/pAjr16Qeq4kmiWjYX1Eq/6e7U /SbauSnmKYU4T/oKvW1hkM03Ia4bmbkQ/G+y7oivjHLEpyrHQvPpidh8niCz4iL748 xF43lPrEl19vw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Jeuk Kim , Rayhan Ramdhany Hanaputra , Michael Tokarev Subject: [Stable-10.2.3 119/149] hw/ufs: Validate MCQ SQ references before use Date: Sat, 23 May 2026 00:48:51 +0300 Message-ID: <20260522214923.807017-20-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1779486743916158500 Content-Type: text/plain; charset="utf-8" From: Jeuk Kim A guest can program an out-of-range SQATTR.CQID value, or ring an MCQ SQ doorbell before the submission queue exists. Reject SQ creation when the referenced CQ is invalid, and ignore SQ doorbells for queues that have not been created. This prevents a guest-triggerable out-of-bounds read and NULL pointer dereference. Fixes: 5c079578d2e ("hw/ufs: Add support MCQ of UFSHCI 4.0") Reported-by: Rayhan Ramdhany Hanaputra Cc: qemu-stable@nongnu.org Signed-off-by: Jeuk Kim (cherry picked from commit 332ea29787800fff2b49e9b89ec93bd370a11965) Signed-off-by: Michael Tokarev diff --git a/hw/ufs/ufs.c b/hw/ufs/ufs.c index 8fdc0854eb..5fe63b82ab 100644 --- a/hw/ufs/ufs.c +++ b/hw/ufs/ufs.c @@ -517,8 +517,13 @@ static bool ufs_mcq_create_sq(UfsHc *u, uint8_t qid, u= int32_t attr) return false; } =20 + if (cqid >=3D u->params.mcq_maxq) { + trace_ufs_err_mcq_create_sq_invalid_cqid(cqid); + return false; + } + if (!u->cq[cqid]) { - trace_ufs_err_mcq_create_sq_invalid_cqid(qid); + trace_ufs_err_mcq_create_sq_invalid_cqid(cqid); return false; } =20 @@ -775,6 +780,11 @@ static void ufs_mcq_process_db(UfsHc *u, uint8_t qid, = uint32_t db) } =20 sq =3D u->sq[qid]; + if (!sq) { + trace_ufs_err_mcq_db_wr_invalid_sqid(qid); + return; + } + if (sq->size * sizeof(UfsSqEntry) <=3D db) { trace_ufs_err_mcq_db_wr_invalid_db(qid, db); return; @@ -788,7 +798,14 @@ static void ufs_write_mcq_op_reg(UfsHc *u, hwaddr offs= et, uint32_t data, unsigned size) { int qid =3D offset / sizeof(UfsMcqOpReg); - UfsMcqOpReg *opr =3D &u->mcq_op_reg[qid]; + UfsMcqOpReg *opr; + + if (qid >=3D u->params.mcq_maxq) { + trace_ufs_err_invalid_register_offset(offset); + return; + } + + opr =3D &u->mcq_op_reg[qid]; =20 switch (offset % sizeof(UfsMcqOpReg)) { case offsetof(UfsMcqOpReg, sq.tp): --=20 2.47.3