From nobody Sat Sep 26 22:14:21 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1788358970; cv=none; d=zohomail.com; s=zohoarc; b=HJYpHnyWC0mwcSraK7zDw9JWDG86DYYC1G4F4g5Frx7zG2NCSZOHsQU367KbaIxJBHzf8rCjdb+eDwD/C5Tv2kRho7iQHwwqgpaPTPqNg+hk4lsuAaCTnM4j9Y7RCponpXCNgHmRM4aUTY7ZKLU5iy/ILRdC8MWbvtHFO4L94lg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1788358970; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=tw8TwJDaX7Bk5mufpVz3qufCLpdhCKwiUCd0A049V2s=; b=bPjJws6GmY6UbVethZWBIM28sX/j9pbc7XstKxMut/ue6AKB9aLLq+XJrmWWl6woWWix48uxlQY4IdAyB1mRH5wEvB2qw56JouXjY8sxpzfXirDbj16HqfDcoat59QTqXwjpwBf4k/+6DYfIqbmC6nPunG2s2xmeTmqgnuY/M/U= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1788358970860527.794825354567; Wed, 2 Sep 2026 07:22:50 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1x1lqx-0002MI-Gs; Wed, 02 Sep 2026 10:22:15 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1x1lqv-0002LX-VE for qemu-devel@nongnu.org; Wed, 02 Sep 2026 10:22:13 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1x1lqu-0007sw-A4 for qemu-devel@nongnu.org; Wed, 02 Sep 2026 10:22:13 -0400 Received: from mail-wm1-f70.google.com (mail-wm1-f70.google.com [209.85.128.70]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-99-c-DoPxO0OnGQNq0Fw3KPzQ-1; Wed, 02 Sep 2026 10:22:08 -0400 Received: by mail-wm1-f70.google.com with SMTP id 5b1f17b1804b1-49b8c651ac0so13109865e9.2 for ; Wed, 02 Sep 2026 07:22:07 -0700 (PDT) Received: from lleonard-thinkpadx1carbongen13.rmtit.csb ([151.29.41.106]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-49ce4776131sm80871685e9.11.2026.09.02.07.22.05 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 02 Sep 2026 07:22:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1788358931; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=tw8TwJDaX7Bk5mufpVz3qufCLpdhCKwiUCd0A049V2s=; b=MpdB3NtZwiy5iqMN751gxbbz1mhBRkmIaXfqXe20yBHehe7pZx1uLkj2AZx5GSnU/mzjJp oPVLlHVNg4yW3lrNCtXx0q57QCUDmfzJNyUUOobi50gPE7bqA5DUw7PUjgEeT2RbfAgHpk Hf8QOcfjs3hHrCsedQk3Cbbg3dw7ifw= X-MC-Unique: c-DoPxO0OnGQNq0Fw3KPzQ-1 X-Mimecast-MFC-AGG-ID: c-DoPxO0OnGQNq0Fw3KPzQ_1788358927 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1788358927; x=1788963727; darn=nongnu.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=tw8TwJDaX7Bk5mufpVz3qufCLpdhCKwiUCd0A049V2s=; b=iWtcRX4OWCls8ikO8WIsM1iNl30QEn5L7zaBxpkBDagRK3oZJBI4sK0sRuY0uOFqVe Ix75DOLCC9OiYbauoUNAXYdEtCf+u+HUQA9D/p2oE4zEnjPT3Ec8FYEuCnt1Sbdr0ywm MJKRv9RQto5y66PZkP7JJryI5wSHitmKiuvyAXMNIxiNkNZDIbkYzTrPOLSHt52NSwLj T9/M7Alzw6ejObzTLF5n8tOYgrQ6jZGhaopQOcretexzLb9+xY7jv55TUSooDFrYXcQn OdcnM5mEo0zgJNFmnpPj7kfMGXvwNRvD+rfkkz+w2RNiIKQ8vgaUtgC4wf/JYeJiYQ9Y jZ4g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788358927; x=1788963727; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=tw8TwJDaX7Bk5mufpVz3qufCLpdhCKwiUCd0A049V2s=; b=TTdRRxnaR39BpIlmWsgOWIypccah94aUqiwCACo1kpmT9C91mw9OXbqAlA/R1uDsG1 PB/Fb6DD19L8efT3zsmSa1TEhMlVIaMj5IazPRzD2bjjn9QDgMuHjAtLO/nqXdGGxlGq CagWa8DBQ6OTD3mAxlrAt8sPxX+6OnZzil1qtVqU7I6KWvrxz4Xb6OGXbhF1qxDperiv PZGsvVqyv8eN1yYLHYaKKi9jax0+PWrma+xNYwz4eZRXFGKzdyxTc/Qtx3VUmJv6jIoR PHJe1HHDPO39TrgWTq/ZeZEofesvE+EvOJcT33x7viB9TJ5jWDzzgp9HsL0oMTSy+EAg NPRQ== X-Gm-Message-State: AFuF++lG3DVSCSAwwAigpsCnB4FhiPYBAAs6PQOpuQoMZ/J3hE3jA2n8 VqkvaNuyhF9I1jJUag+S2pFzl4RxBtXXJWM52nY1PL6k+AJMPr0PFyVLZ6gO7KVFStdMi7wB4Fw 8oKmrdK3uipXU5iRGpx8gaBlZZqOvjPkhHJsD9+wR+94AyKdn89fPPVeV X-Gm-Gg: AR+sD12IMmjGQCz012nJI2ou5TFPLOgxRtvThHjGIFHWBELAXKubf9rS2aQmHevXwIT hEbxPq+4ETsTVvWmftFdGO8cL4JiohAE40sM091e0YWkclkcPfbIS1chNbIg0pUoD7MJnYYV+Xt /I7sHmEXWlYXbgzK1PL+3+R6wsbqvsfQJpH1AXq7RRqc1Bfs3U0YWSiq1ZD0M82z02j6mcaH1Vb 9CZROnMrN/d6c3S0y4RU5XUr6RGbMtClXoBT3Vf0ZDG7YT+NMC2rpl2ryVTBiDgsvveHtHd7Svd EMmGHZS/HLGPISiujeFqthz3WZmXcK+B9Nm4rjNqhRnUGVo4ldIVh4WRb1QU8OSPa8oFV7VcV1/ va/hULV52zJA+62rRwn7GqwOD9Hp2ZSS0GTyao4jL762CQ1gTfCXIOe4sbpPQZDsVK2IJ X-Received: by 2002:a05:600c:3f06:b0:49c:ee1c:d582 with SMTP id 5b1f17b1804b1-49cee1cd69emr1465765e9.14.1788358926636; Wed, 02 Sep 2026 07:22:06 -0700 (PDT) X-Received: by 2002:a05:600c:3f06:b0:49c:ee1c:d582 with SMTP id 5b1f17b1804b1-49cee1cd69emr1464025e9.14.1788358926010; Wed, 02 Sep 2026 07:22:06 -0700 (PDT) From: Luigi Leonardi Date: Wed, 02 Sep 2026 16:21:58 +0200 Subject: [PATCH 1/2] igvm: honor byte_offset when writing memory map, MADT and device tree MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260902-fix_offset-v1-1-04b18f7595b2@redhat.com> References: <20260902-fix_offset-v1-0-04b18f7595b2@redhat.com> In-Reply-To: <20260902-fix_offset-v1-0-04b18f7595b2@redhat.com> To: qemu-devel@nongnu.org Cc: Gerd Hoffmann , Stefano Garzarella , Ani Sinha , Luigi Leonardi X-Mailer: b4 0.14.3 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=leonardi@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1788358973402154100 qigvm_directive_memory_map(), qigvm_directive_madt() and qigvm_directive_device_tree() all wrote their data unconditionally at the start of the parameter area's buffer, ignoring param->byte_offset from the IGVM_VHS_PARAMETER header. This is harmless when a directive's offset happens to be 0, but breaks for IGVM files that pack multiple parameters into a single shared parameter area at different offsets: a later directive would overwrite the data written by an earlier one at the start of the buffer, corrupting it. Use param_entry->data + param->byte_offset as the write location and size the bounds checks against the remaining space in the buffer rather than its full size. Signed-off-by: Luigi Leonardi --- backends/igvm.c | 10 ++++++---- target/i386/igvm.c | 4 ++-- 2 files changed, 8 insertions(+), 6 deletions(-) diff --git a/backends/igvm.c b/backends/igvm.c index 7b7bdc72b7..a6e3a58022 100644 --- a/backends/igvm.c +++ b/backends/igvm.c @@ -632,8 +632,10 @@ static int qigvm_directive_memory_map(QIgvm *ctx, cons= t uint8_t *header_data, return -1; } =20 - max_entry_count =3D param_entry->size / sizeof(IGVM_VHS_MEMORY_MAP_ENT= RY); - mm_entry =3D (IGVM_VHS_MEMORY_MAP_ENTRY *)param_entry->data; + max_entry_count =3D (param_entry->size - param->byte_offset) / + sizeof(IGVM_VHS_MEMORY_MAP_ENTRY); + mm_entry =3D (IGVM_VHS_MEMORY_MAP_ENTRY *)(param_entry->data + + param->byte_offset); =20 retval =3D get_mem_map_entry(entry, &cgmm_entry, errp); while (retval =3D=3D 0) { @@ -837,14 +839,14 @@ static int qigvm_directive_device_tree(QIgvm *ctx, co= nst uint8_t *header_data, } =20 fdt_size =3D fdt_totalsize(fdt_packed); - if (fdt_size > param_entry->size) { + if (fdt_size > param_entry->size - param->byte_offset) { error_setg(errp, "IGVM: device tree size exceeds parameter area" " defined in IGVM file"); return -1; } =20 - memcpy(param_entry->data, fdt_packed, fdt_size); + memcpy(param_entry->data + param->byte_offset, fdt_packed, fdt_size); =20 return 0; } diff --git a/target/i386/igvm.c b/target/i386/igvm.c index ad9bf87761..4d9d97385a 100644 --- a/target/i386/igvm.c +++ b/target/i386/igvm.c @@ -199,8 +199,8 @@ int qigvm_directive_madt(QIgvm *ctx, const uint8_t *hea= der_data, Error **errp) =20 GArray *madt =3D acpi_build_madt_standalone(ctx->machine_state); =20 - if (madt->len <=3D param_entry->size) { - memcpy(param_entry->data, madt->data, madt->len); + if (madt->len <=3D param_entry->size - param->byte_offset) { + memcpy(param_entry->data + param->byte_offset, madt->data, madt->l= en); } else { error_setg( errp, --=20 2.55.0 From nobody Sat Sep 26 22:14:21 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1788358959; cv=none; d=zohomail.com; s=zohoarc; b=mrludxxiQUz40JXcJau92UWpClL1fHfO+qyfKR9cnPySKlHBE5o8o4Se4NPmx91O++w7BygSikaf5BfYwlaDc0zxvJhpT30M0kqtfsXEM0fJ2eODCyVVg4+mpch8+3EFGZC7fyLexooKF73Y4qWe8TL1nvrDM/5blycpucNtM0o= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1788358959; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=OP1jnqi4mJJzRIl3OIYQpm6OFSO+ZwM3P7Nwbo9pGFQ=; b=RoqugaZGCzUh4DvzIDCFf3VnqauXhI+yOmgZm9TKo6HO0l1V+Qeub+qZy+kAXcnerLt2Cc8jI0X/eVTq78cAXYGpoqlqnNFxiBdBQ2+gp/4GrV/GTF1xd87S8UcyL/hyUE+bavJ310bPiVlxBPtHB9HQDWUXeToJrRjFSF4XrCo= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1788358959236812.3376568744503; Wed, 2 Sep 2026 07:22:39 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1x1lr0-0002Mn-5x; Wed, 02 Sep 2026 10:22:18 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1x1lqy-0002MO-8u for qemu-devel@nongnu.org; Wed, 02 Sep 2026 10:22:16 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1x1lqw-0007ta-H3 for qemu-devel@nongnu.org; Wed, 02 Sep 2026 10:22:16 -0400 Received: from mail-wm1-f69.google.com (mail-wm1-f69.google.com [209.85.128.69]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-656-W1SaiBy9ODeRQWxGUZL7aw-1; Wed, 02 Sep 2026 10:22:12 -0400 Received: by mail-wm1-f69.google.com with SMTP id 5b1f17b1804b1-493fa6e28a7so10725635e9.1 for ; Wed, 02 Sep 2026 07:22:12 -0700 (PDT) Received: from lleonard-thinkpadx1carbongen13.rmtit.csb ([151.29.41.106]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-49ce4776131sm80871685e9.11.2026.09.02.07.22.06 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 02 Sep 2026 07:22:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1788358933; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=OP1jnqi4mJJzRIl3OIYQpm6OFSO+ZwM3P7Nwbo9pGFQ=; b=TzcKTkUimcR8AvVvQZfBAIHKPzBx+sFasnb/ttdSrmxpCr3Nn2lxRo2qH3VDJsQrbiJKlE W2dyS04aUAJFA/IUKryXYY6ZWAB7HsLPAhUcSIY+1iVPCukR1R2MVMSDtQpOijSG1awxwt B4XadIaEa/ww0X1QQb2Oc66B6P/iL3M= X-MC-Unique: W1SaiBy9ODeRQWxGUZL7aw-1 X-Mimecast-MFC-AGG-ID: W1SaiBy9ODeRQWxGUZL7aw_1788358931 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1788358931; x=1788963731; darn=nongnu.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=OP1jnqi4mJJzRIl3OIYQpm6OFSO+ZwM3P7Nwbo9pGFQ=; b=tf2zkZNybQYsFyffq78RlYUAbwq/znyazJQp+R71JpFtmkzqT3vsYAsTAdnhqXuEDY emq2iKvxrIP8W/f8ZGyDsxvtq9QEX77dyI0JR11l4uD1J8BALiQk7y6lwh2nk1h6+iLq jFjP7kOrq53ytXTyBQO8fiSG3LFqfDU0SjtJray7+oJ5WKJ2uKxTuRVPhggUSVDhGT3q ZCeKZzZGHbHtTYd5T+MVV2AjAdPeIfy42i9aVQdtAHmMiMAN2DgLZbLFl2eYUwU5CLuk nRETYFziSsNfTF61HabNMZRZdlLT1WvI1ug8YEWSwVlZjNDQJZgcer3hk1IS04308z6u RhOA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788358931; x=1788963731; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=OP1jnqi4mJJzRIl3OIYQpm6OFSO+ZwM3P7Nwbo9pGFQ=; b=n914bM90gZXZHGnaqKAf5aOlGVSeRxpXqjeDVU90Vi9mv7VGSen03D9oXewClmafiV NdqPLd/jxZiwAahO6B6/i2mp3z6AavajKWlQcb+qR2cAUmz/02y9rqz8ekUPl+V1wCJF CPaDjbq3NwQ2gZPzWSjja9iDQ+gguXrzsDfxAi1vsZB24x5HNYdXPWgsTT2pwRXOLtA8 OUJNKMttqIirW9DBBqa/NC5inbM4NCpPxRrZNnllpy8Fpu9pk/Kar5D1oVIVhaJ7Tkci HkesEBMXNeGZoL2fTnRkV0jBD4+ELdcv0IQCf88ezXkV7UgwRnJt6bgkxUpk0x/PwjR2 AgcQ== X-Gm-Message-State: AFuF++mO5JaNUJuzIYadjK7DLoD2VP/c0otSqWZmp/WTCoUstU/kCaq+ aXNLMIH1gykyhrbVjOxqO3+jv1JRS63vLra5Te9a7lpl4l4AQrUbD1l57eTx0t2HKsB/ANaUpG4 J9Huxw/TOkubEv5QoqvPC3gf3DU4pOkCpCxTwtPP9mbAvRkwV+mb7PLofJi2ewElRYtw= X-Gm-Gg: AR+sD12hxRLHRQGSiahR7pshoXfEsT1vzUZ3fPA/bq2P8HmWXxz+ehEw+j1hk0kEHC+ 1/sm2jMKiDZ5sFsXbtlO85viYRqfDmUPSst8U97dbm5ydPL6CBo5u9rcNXf8bgY+foh4SdZ7PC/ iN9KC4nnM3eLtWdjw3GxvrZqSt95cSY48gvZuL1AGnNHc8QBnft2L/cUOW1Xik8ZR8Ltga0PckN 8olmSulDR4K2X+0tU0fiXqwr8IN6IzXaDkcERZUZYXtp2FYK5dDIS6RdjzmLM7wx4YTPREmt8nt 2HfJzS3g+QDuWV5GxB90pWR6TxwObDRS7er4+/8Vdu0ereMMTw6kilPXb1zGxFw1SvkRi07cBdZ /SByCnekazrd1xYfd5kjmecaQbXlv4nFu+hhTVu1PeIfUTnI5ADDIuYBRxXDlKNqT49RC X-Received: by 2002:a05:600c:4592:b0:496:c1f3:e8f8 with SMTP id 5b1f17b1804b1-49ce5828104mr81370965e9.7.1788358929798; Wed, 02 Sep 2026 07:22:09 -0700 (PDT) X-Received: by 2002:a05:600c:4592:b0:496:c1f3:e8f8 with SMTP id 5b1f17b1804b1-49ce5828104mr81366565e9.7.1788358927080; Wed, 02 Sep 2026 07:22:07 -0700 (PDT) From: Luigi Leonardi Date: Wed, 02 Sep 2026 16:21:59 +0200 Subject: [PATCH 2/2] igvm: validate byte_offset before using it in parameter directives MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260902-fix_offset-v1-2-04b18f7595b2@redhat.com> References: <20260902-fix_offset-v1-0-04b18f7595b2@redhat.com> In-Reply-To: <20260902-fix_offset-v1-0-04b18f7595b2@redhat.com> To: qemu-devel@nongnu.org Cc: Gerd Hoffmann , Stefano Garzarella , Ani Sinha , Luigi Leonardi X-Mailer: b4 0.14.3 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=leonardi@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1788358961160154100 None of the directive handlers that place data at a byte_offset within a parameter area validated that byte_offset actually falls within the parameter area's size. A malformed IGVM file with byte_offset > size would underflow the "size - byte_offset" computation used to determine remaining space, wrapping to a huge value and defeating the size check, then write out of bounds through param_entry->data + byte_offset. Add qigvm_param_offset_valid() to check byte_offset against the parameter area size, and call it from each handler before doing any arithmetic with byte_offset. When possible, add an explicit check that fixed-size write fits in the remaining space. Signed-off-by: Luigi Leonardi --- backends/igvm.c | 46 ++++++++++++++++++++++++++++++++++++++= ++++ include/system/igvm-internal.h | 4 ++++ target/i386/igvm.c | 4 ++++ 3 files changed, 54 insertions(+) diff --git a/backends/igvm.c b/backends/igvm.c index a6e3a58022..5d2364bf70 100644 --- a/backends/igvm.c +++ b/backends/igvm.c @@ -101,6 +101,22 @@ qigvm_find_param_entry(QIgvm *igvm, uint32_t parameter= _area_index, return NULL; } =20 +/* + * Check that byte_offset falls within the parameter area + */ +bool qigvm_param_offset_valid(const QIgvmParameterData *param_entry, + const IGVM_VHS_PARAMETER *param, + Error **errp) +{ + if (param->byte_offset > param_entry->size) { + error_setg(errp, + "IGVM: byte_offset 0x%x exceeds parameter area size 0x%= x", + param->byte_offset, param_entry->size); + return false; + } + return true; +} + static int qigvm_directive_page_data(QIgvm *ctx, const uint8_t *header_dat= a, Error **errp); static int qigvm_directive_vp_context(QIgvm *ctx, const uint8_t *header_da= ta, @@ -632,6 +648,10 @@ static int qigvm_directive_memory_map(QIgvm *ctx, cons= t uint8_t *header_data, return -1; } =20 + if (!qigvm_param_offset_valid(param_entry, param, errp)) { + return -1; + } + max_entry_count =3D (param_entry->size - param->byte_offset) / sizeof(IGVM_VHS_MEMORY_MAP_ENTRY); mm_entry =3D (IGVM_VHS_MEMORY_MAP_ENTRY *)(param_entry->data + @@ -694,6 +714,17 @@ static int qigvm_directive_vp_count(QIgvm *ctx, const = uint8_t *header_data, return -1; } =20 + if (!qigvm_param_offset_valid(param_entry, param, errp)) { + return -1; + } + + if (sizeof(*vp_count) > param_entry->size - param->byte_offset) { + error_setg(errp, + "IGVM: vp-count parameter exceeds parameter area " + "defined in IGVM file"); + return -1; + } + vp_count =3D (uint32_t *)(param_entry->data + param->byte_offset); *vp_count =3D 0; CPU_FOREACH(cpu) @@ -718,6 +749,17 @@ static int qigvm_directive_environment_info(QIgvm *ctx, return -1; } =20 + if (!qigvm_param_offset_valid(param_entry, param, errp)) { + return -1; + } + + if (sizeof(*environmental_state) > param_entry->size - param->byte_off= set) { + error_setg(errp, + "IGVM: environment-info parameter exceeds parameter are= a " + "defined in IGVM file"); + return -1; + } + environmental_state =3D (IgvmEnvironmentInfo *)(param_entry->data + param->byte_offset); environmental_state->memory_is_shared =3D 1; @@ -825,6 +867,10 @@ static int qigvm_directive_device_tree(QIgvm *ctx, con= st uint8_t *header_data, return -1; } =20 + if (!qigvm_param_offset_valid(param_entry, param, errp)) { + return -1; + } + if (ctx->machine_state->fdt =3D=3D NULL) { error_setg(errp, "IGVM: device tree not available"); return -1; diff --git a/include/system/igvm-internal.h b/include/system/igvm-internal.h index 9e9fa1d9af..7e0d1512ae 100644 --- a/include/system/igvm-internal.h +++ b/include/system/igvm-internal.h @@ -81,4 +81,8 @@ QIgvmParameterData* qigvm_find_param_entry(QIgvm *igvm, uint32_t parameter_area_index, Error **errp); =20 +bool qigvm_param_offset_valid(const QIgvmParameterData *param_entry, + const IGVM_VHS_PARAMETER *param, + Error **errp); + #endif diff --git a/target/i386/igvm.c b/target/i386/igvm.c index 4d9d97385a..e758989d0d 100644 --- a/target/i386/igvm.c +++ b/target/i386/igvm.c @@ -197,6 +197,10 @@ int qigvm_directive_madt(QIgvm *ctx, const uint8_t *he= ader_data, Error **errp) return -1; } =20 + if (!qigvm_param_offset_valid(param_entry, param, errp)) { + return -1; + } + GArray *madt =3D acpi_build_madt_standalone(ctx->machine_state); =20 if (madt->len <=3D param_entry->size - param->byte_offset) { --=20 2.55.0