From nobody Sat Sep 26 23:53:30 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass header.i=@intel.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1787385966; cv=none; d=zohomail.com; s=zohoarc; b=nhVMOir2oi9x4Q1fTUup6h1ffFiBfhKOgTtFheYk37bE+YG7YTjTwiUyDk9FrSVR78rt9eEAR4UlKCjglg7Te5xQkGwMVxO0ZQz+x7NHuO6x8jnWt9lQNtqubrCxhQc7efgl6TfNKWo2sx2Vbbt3dUnSnxC4cnsCrQofq1X6ReY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1787385966; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=JRvHq1Km6ozg2d05oOiN3KnQjUtff2+zzoG+26m5ZnY=; b=ks9p17/AcY5dMZh7RgSM20hvsJNbhr0hB1stLS3MepGHWU+tBM0gNr9kDbcTWTVyiDEpP3SejiPR8pz9Jgo12OC4P8gIryGvh5N/u6j1c/8g2XG8ILu2wYHzRVhHUIWBbk5OeAhXEBpsNSKAdTC/8D4rRTuqV2J1nHFFwXLXahc= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass header.i=@intel.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1787385966226109.63903718731478; Sat, 22 Aug 2026 01:06:06 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wxgjC-0000hh-Ex; Sat, 22 Aug 2026 04:05:22 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wxgjA-0000hU-RE; Sat, 22 Aug 2026 04:05:20 -0400 Received: from mgamail.intel.com ([198.175.65.14]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wxgj8-0006Ms-Tl; Sat, 22 Aug 2026 04:05:20 -0400 Received: from orviesa010.jf.intel.com ([10.64.159.150]) by orvoesa106.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 22 Aug 2026 01:05:15 -0700 Received: from junjie-desk-dev.bj.intel.com ([10.238.152.71]) by orviesa010-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 22 Aug 2026 01:05:13 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1787385919; x=1818921919; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=ZQTpR5m2HYemScE6+fxCLUrN5DDI2sT+aIhkpWEB6dM=; b=hikNDsQoN1O3elUxRLohC8RXVVOXNV4dDj8zcukS/MWpj9gF3HSPKZHo 0kIpeTcfvl3KbRpFiO42i1vStNlxmXAre15bTmmoYDDr3J9vzL7R6vPGl 7v+c0hMq/3aV1kRv2MMih7xzeyx3B1kGVThagJkPoLkThv/MhhQZJ/bbY j3DIk5DzAncjTv+NYQB+7eSnW1vYIjMIXWpIdox50a0SccoVkbiT4wuSf I+AdjU76x5Kv3YegiSehuY6pseLhDB0J3rIp/BhtG22whNb/idIj9Pzfe g1PtlgVajGqRPu/617p4CpwTIa5h7eg1dOOIeVeyyryyK/HuO2Ucf7EG6 w==; X-CSE-ConnectionGUID: Rt5fP7RZQ6uPPIHOhbzBCg== X-CSE-MsgGUID: lH5WOFXXR7ueEMsjAAQ7SA== X-IronPort-AV: E=McAfee;i="6800,10657,11882"; a="91796015" X-IronPort-AV: E=Sophos;i="6.25,236,1779174000"; d="scan'208";a="91796015" X-CSE-ConnectionGUID: 0ydaDvUJS3WXKU+NoTnpBw== X-CSE-MsgGUID: Y8FloF0nTMKA/9UkbFQ9Fw== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.25,236,1779174000"; d="scan'208";a="265239305" From: Junjie Cao To: qemu-devel@nongnu.org Cc: Jonathan Cameron , linux-cxl@vger.kernel.org, qemu-stable@nongnu.org Subject: [PATCH] hw/cxl: Fix heap buffer overflow in Set Feature cleanup path Date: Sat, 22 Aug 2026 16:05:08 +0800 Message-ID: <20260822080508.300921-1-junjie.cao@intel.com> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=198.175.65.14; envelope-from=junjie.cao@intel.com; helo=mgamail.intel.com X-Spam_score_int: -46 X-Spam_score: -4.7 X-Spam_bar: ---- X-Spam_report: (-4.7 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.341, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_NONE=0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @intel.com) X-ZM-MESSAGEID: 1787385970477158500 Content-Type: text/plain; charset="utf-8" cmd_features_set_feature() uses set_feat_info->data_size as the memset length when zeroing write-attribute buffers on Finish/Abort. data_size accumulates bytes_to_copy across transfer parts but is only reset on INITIATE. Since QEMU never returns Feature Transfer Out of Order, repeated transfers at the same offset grow data_size past sizeof(struct), and the final memset overflows the target buffer. b71a179148 bounded the per-transfer memcpy against sizeof, but the cleanup memset still runs on the accumulated data_size, so the overflow survives that fix. Pass sizeof() of the target struct to memset instead of data_size. Fixes: d88f66741410 ("hw/cxl/cxl-mailbox-utils: Add device patrol scrub con= trol feature") Fixes: 2d41ce38fb9a ("hw/cxl/cxl-mailbox-utils: Add device DDR5 ECS control= feature") Fixes: 5e5a86bab830 ("hw/cxl: Add support for Maintenance command and Post = Package Repair (PPR)") Fixes: da5cafdc4ddd ("hw/cxl: Add emulation for memory sparing control feat= ure") Cc: qemu-stable@nongnu.org Signed-off-by: Junjie Cao --- hw/cxl/cxl-mailbox-utils.c | 22 ++++++++++++++-------- 1 file changed, 14 insertions(+), 8 deletions(-) diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c index ec18338b42..f81b7b3303 100644 --- a/hw/cxl/cxl-mailbox-utils.c +++ b/hw/cxl/cxl-mailbox-utils.c @@ -1947,22 +1947,28 @@ static CXLRetCode cmd_features_set_feature(const st= ruct cxl_cmd *cmd, data_transfer_flag =3D=3D CXL_SET_FEATURE_FLAG_ABORT_DATA_TRANSFE= R) { memset(&set_feat_info->uuid, 0, sizeof(QemuUUID)); if (qemu_uuid_is_equal(&hdr->uuid, &patrol_scrub_uuid)) { - memset(&ct3d->patrol_scrub_wr_attrs, 0, set_feat_info->data_si= ze); + memset(&ct3d->patrol_scrub_wr_attrs, 0, + sizeof(ct3d->patrol_scrub_wr_attrs)); } else if (qemu_uuid_is_equal(&hdr->uuid, &ecs_uuid)) { - memset(&ct3d->ecs_wr_attrs, 0, set_feat_info->data_size); + memset(&ct3d->ecs_wr_attrs, 0, sizeof(ct3d->ecs_wr_attrs)); } else if (qemu_uuid_is_equal(&hdr->uuid, &soft_ppr_uuid)) { - memset(&ct3d->soft_ppr_wr_attrs, 0, set_feat_info->data_size); + memset(&ct3d->soft_ppr_wr_attrs, 0, + sizeof(ct3d->soft_ppr_wr_attrs)); } else if (qemu_uuid_is_equal(&hdr->uuid, &hard_ppr_uuid)) { - memset(&ct3d->hard_ppr_wr_attrs, 0, set_feat_info->data_size); + memset(&ct3d->hard_ppr_wr_attrs, 0, + sizeof(ct3d->hard_ppr_wr_attrs)); } else if (qemu_uuid_is_equal(&hdr->uuid, &cacheline_sparing_uuid)= ) { memset(&ct3d->cacheline_sparing_wr_attrs, 0, - set_feat_info->data_size); + sizeof(ct3d->cacheline_sparing_wr_attrs)); } else if (qemu_uuid_is_equal(&hdr->uuid, &row_sparing_uuid)) { - memset(&ct3d->row_sparing_wr_attrs, 0, set_feat_info->data_siz= e); + memset(&ct3d->row_sparing_wr_attrs, 0, + sizeof(ct3d->row_sparing_wr_attrs)); } else if (qemu_uuid_is_equal(&hdr->uuid, &bank_sparing_uuid)) { - memset(&ct3d->bank_sparing_wr_attrs, 0, set_feat_info->data_si= ze); + memset(&ct3d->bank_sparing_wr_attrs, 0, + sizeof(ct3d->bank_sparing_wr_attrs)); } else if (qemu_uuid_is_equal(&hdr->uuid, &rank_sparing_uuid)) { - memset(&ct3d->rank_sparing_wr_attrs, 0, set_feat_info->data_si= ze); + memset(&ct3d->rank_sparing_wr_attrs, 0, + sizeof(ct3d->rank_sparing_wr_attrs)); } set_feat_info->data_transfer_flag =3D 0; set_feat_info->data_saved_across_reset =3D false; base-commit: af06b5df2610fe5de6c02d17c17bced9e9f0d47d --=20 2.43.0