From nobody Tue Aug 25 15:46:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1779486776; cv=none; d=zohomail.com; s=zohoarc; b=FHEd0gEBLoZ/XIs2WSLvyheiTTPLu/eSqgAiiun62RDuRS+kzmQMnYj1FWuNJgI3U/Ao4yobSZqzFjcRpJYuiNC7u337oxe74NEquEnKAQ7WXIl1/GOJbKIUI85wQ0GlDk1bXIzDxpOy95Zhc39Qfm22AYSIF6fzMk1DkZb0I8U= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1779486776; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=+cJY5UHoi7TOXO5BIrIhhopxXneWOOkDLzox5Kru7Y4=; b=XzYxUWR8GSymVain09vMlYpet8fsMnh5SP31htDtqADoiCXaP9Wuheq5dDvPCbfImmKy2rxTvOFB4ljHb5hIHw4MtQSrFcmBLWYFTw6hRTSK7kaOTFlSe337ykouwJU1jTa63UVwkIcy8mV3iz1EAujPhZepsSCTHyhjt5XrmQU= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1779486776396132.5946169464156; Fri, 22 May 2026 14:52:56 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wQXmx-0003ut-E9; Fri, 22 May 2026 17:52:15 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wQXmb-0002qu-UU; Fri, 22 May 2026 17:51:59 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wQXmT-0004AF-0p; Fri, 22 May 2026 17:51:50 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id DBF6D1AFB75; Sat, 23 May 2026 00:49:20 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 0FD8B3B71C4; Sat, 23 May 2026 00:49:25 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1779486560; bh=/l8YcLns4Vdy96Q/u/j3F12L1D8EC3WNVcLrc44P2MA=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=syoZ2gxZQuUFJ1imXkOsNnvyn5WdvZ+0+h5eW2FlyYz3v/Zvfe68EjEsjSsBoh5E6 0clr5Tng9O8V7xWFd1ZdoY5D+JRdq7tcRstpM+stMd1vIMe1WTNyDCxwBvWAwnOTh5 miHnOcp88YEO7Z9BL7cb4WV94PIBDWzIy55oT2Ovr76k3y3Qxv7fEnHlnE8UkApwiy ztZX86nLsR/UJVxmUhrP+y0zzLBWP2eM7lYYYtnKkdWG29qhWiL9yjJElXr2E+O0iA J5BzrxfMpWskswO5/jN/U0le9j7sg1VEdG0WAuG2nvvvBNm3B6uwTG3x/RdE8AfR3Y 59JtL9jxEYXOw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= , Katherine Leaver , Michael Tokarev Subject: [Stable-10.2.3 127/149] aspeed/hace: Fix out-of-bounds read in has_padding() Date: Sat, 23 May 2026 00:48:59 +0300 Message-ID: <20260522214923.807017-28-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1779486778313154100 From: C=C3=A9dric Le Goater The has_padding() function reads the last 8 bytes of a DMA buffer without validating req_len. req_len is guest-controlled (via R_HASH_SRC_LEN register or scatter-gather entries) and values less than 8 cause integer underflow. This can result in an out-of-bounds read of QEMU process memory. Add a check to ensure req_len >=3D 8 before accessing the buffer. Reported-by: Katherine Leaver Cc: qemu-stable@nongnu.org Fixes: 5cd7d8564a8b ("aspeed/hace: Support AST2600 HACE") Link: https://lore.kernel.org/qemu-devel/20260504213421.710035-2-clg@redhat= .com Signed-off-by: C=C3=A9dric Le Goater (cherry picked from commit 534a52755befa7b8d49c921f8dc964185903efae) Signed-off-by: Michael Tokarev diff --git a/hw/misc/aspeed_hace.c b/hw/misc/aspeed_hace.c index 726368fbbc..c7a2731e38 100644 --- a/hw/misc/aspeed_hace.c +++ b/hw/misc/aspeed_hace.c @@ -154,6 +154,14 @@ static bool has_padding(AspeedHACEState *s, struct iov= ec *iov, hwaddr req_len, uint32_t *total_msg_len, uint32_t *pad_offset) { + /* Need at least 8 bytes to read the total message length field */ + if (req_len < 8) { + qemu_log_mask(LOG_GUEST_ERROR, + "%s: invalid request length=3D0x%" HWADDR_PRIx "\n", + __func__, req_len); + return false; + } + *total_msg_len =3D (uint32_t)(ldq_be_p(iov->iov_base + req_len - 8) / = 8); /* * SG_LIST_LEN_LAST asserted in the request length doesn't mean it is = the --=20 2.47.3