[PATCH 0/2] igvm: fix byte_offset handling in parameter directives

Luigi Leonardi posted 2 patches 3 weeks, 3 days ago
Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/20260902-fix._5Foffset-v1-0-04b18f7595b2@redhat.com
Maintainers: Gerd Hoffmann <kraxel@redhat.com>, Stefano Garzarella <sgarzare@redhat.com>, Ani Sinha <anisinha@redhat.com>, Paolo Bonzini <pbonzini@redhat.com>, Zhao Liu <zhao1.liu@intel.com>
There is a newer version of this series
backends/igvm.c                | 56 +++++++++++++++++++++++++++++++++++++++---
include/system/igvm-internal.h |  4 +++
target/i386/igvm.c             |  8 ++++--
3 files changed, 62 insertions(+), 6 deletions(-)
[PATCH 0/2] igvm: fix byte_offset handling in parameter directives
Posted by Luigi Leonardi 3 weeks, 3 days ago
Several IGVM directives (memory map, vp-count, environment info, MADT,
device tree) _can_ place their data at a byte_offset within a shared
parameter area, letting multiple parameters be packed into one area.

Patch 1 fixes three handlers that ignored byte_offset and always wrote
at the start of the buffer, corrupting earlier data when several
parameters share an area. Found while testing an IGVM file where a
device tree overflew into memory map.

Patch 2 adds validation of byte_offset in all five handlers, since a
malformed file with byte_offset > size would underflow the "remaining
space" computation and cause an out-of-bounds write.

Signed-off-by: Luigi Leonardi <leonardi@redhat.com>
---
Luigi Leonardi (2):
      igvm: honor byte_offset when writing memory map, MADT and device tree
      igvm: validate byte_offset before using it in parameter directives

 backends/igvm.c                | 56 +++++++++++++++++++++++++++++++++++++++---
 include/system/igvm-internal.h |  4 +++
 target/i386/igvm.c             |  8 ++++--
 3 files changed, 62 insertions(+), 6 deletions(-)
---
base-commit: d2e570cc0f97b936902a5b1b86b73c0f5998b475
change-id: 20260902-fix_offset-a268cb12aafc

Best regards,
-- 
Luigi Leonardi <leonardi@redhat.com>