From nobody Mon Sep 28 02:05:28 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785180084; cv=none; d=zohomail.com; s=zohoarc; b=UNSwkttAQlukCUh/kJ2DZ7xrKAOeQteI9nR1X3Fc2WkL5b7it1Ye84zk0dfM8UhQv7Z3dEbe8/HDNQHev1s2+ru5518VkOFnUGKKYs+2gdFOvE/vwtWSIrsT2b1rLiwOf7ntrZ3sh+XvEZ1Yfh47lmUPdcHly4wOb6ozU/TA6ms= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785180084; h=Content-Type:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=gLoWFknB1MQPf833VKaVMeYT284G3Gy3H1HalWnTKlw=; b=CH1OMho5bHHjiAFZ/guI9A9a55R7pie+vQE2GqzsvB368hFquDjrwGQNV6uTMys2swufGwo9wgEgg41yuMUSiQlMFueSOaQ0ohHXP3egWn3pZR9no6j+holsfqyU9pqHkjFSBayOMbg5lQt1A5ybJmo11Sur5rGqlN3hvYmYWH0= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785180084254491.1229149061463; Mon, 27 Jul 2026 12:21:24 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1woQrg-0008WP-Cm; Mon, 27 Jul 2026 15:19:52 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQrZ-0008Vm-LC for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:19:49 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQrY-0000Ky-1d for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:19:45 -0400 Received: from mail-wr1-f70.google.com (mail-wr1-f70.google.com [209.85.221.70]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-307-FXXw_jzTPWy1aXOHpckbTQ-1; Mon, 27 Jul 2026 15:19:41 -0400 Received: by mail-wr1-f70.google.com with SMTP id ffacd0b85a97d-47f84ac1990so1980069f8f.2 for ; Mon, 27 Jul 2026 12:19:41 -0700 (PDT) Received: from redhat.com (IGLD-80-230-28-14.inter.net.il. [80.230.28.14]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-47f85c6dc25sm50027694f8f.33.2026.07.27.12.19.38 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 12:19:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785179983; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=gLoWFknB1MQPf833VKaVMeYT284G3Gy3H1HalWnTKlw=; b=i+jDlNaIwCmxiFjmdYmaEMNMrZXp+ap6Q3uaqZJjDbZjP31JRedYFUUBY9L+tdiay3s+4N JsRPfYBUrqFz4+kkU+irLYnedDzt/KhSV5Dg6pvdAzKNySKZnYDbOq2HINFxsHDasJk/pd 1vxqSVLYqExsIIIf8rwcwOHGy80XSc8= X-MC-Unique: FXXw_jzTPWy1aXOHpckbTQ-1 X-Mimecast-MFC-AGG-ID: FXXw_jzTPWy1aXOHpckbTQ_1785179981 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1785179980; x=1785784780; darn=nongnu.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=gLoWFknB1MQPf833VKaVMeYT284G3Gy3H1HalWnTKlw=; b=OGLrFUF++/84pDl2G6IFU2+9NiIt8yFP+Rf9E9QR2n8eN1tmn1dthjLF8BFxp2ptWj jzA0c+bS+uuRb6+faY0a4AQPcRMmhFaNxZWFUSQV151Qt8LY4dYrvK0dH4yN/oy/CKRb 20gLoShEmgo/s9FgcvYG+NuOtGYcCizuX18Yslnbxe7Zn/d4lJmAcJS7jBSBEUPjjYn9 wGl/S9mFxXEjPoNe+MVwkILehsJ//sFyLLj93xwhEleD8ZdkwVhLGKg0Bpp5UbaKzYkU EYBdRu45IsvOz2UN77CLaYS7NYjFNfCAPrn12yfiBPV1Ko7FuW5auECuamTmtz7N+Paj /v4A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785179980; x=1785784780; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=gLoWFknB1MQPf833VKaVMeYT284G3Gy3H1HalWnTKlw=; b=gLxa4x6+IOY5rRXVd0uDfMonkU+JxHh0zkzlBLB2y1AOtiJzOPQU1ShDyLNCVxuQEe B2Rb+T25+wyb0Ak83VFMMS2Zw3qEavla2FLpmTfMyoMY2wFHAusxiMNcgHuGFUEs1Y6e IQxrsT0lH5baIUlAuTabHsalA1Bk2uMdkXP5yaxJG5vpeqnm2zMJfBbAtVO3KPtD51TL jRVICKjquezerWfowRZTyAFwFQaba2jrDA0fLr/XZ7eIRwdaM1t0MfxUXlmCTKdC4sWP I3EXro9dKgfYupk3ZdqMmWGEz+fa1GVsrhOYm5f16an0UnQN9ydnb4ynHBzypyJP3IIV c7Dw== X-Gm-Message-State: AOJu0Yyyvy20xutwjX90y77JEwH/Kh/WwCQ6u8fQQLDVrx7ndbA4JzP5 tqQStZUDbgOsIe/Lv/ShSbbMXYp6xzN9QKb5tLoiFr10GNMWRJjG10WkfHr/nMxudJXUcEXIBXy JulYp0Pb30aOqgKPKuyILQjzhOlLGbjsLGE8WQukzmhi2kUVZi6zx+PhlRw8ENX0h5wR5RA1LjM gxS3ZqWWOSMD+Z1fjg0iIKlpsFvKSXSkgl0g== X-Gm-Gg: AR+sD13ho/QCTzK/SLuDUMHyEC+pOy4jgK3E6OuFM3sxY0OGbSGizRAhW2KLlBCaM8B 0w47FNWwtjMbyo6ba/AopMXM33ceXLqAk7WiZKhlsx2BdQpQ7DfIXEGfk2ONCdb+JJaH+1lT+B+ kSP5wadVFTG3X+UjL8ddHtVJ1Q4ScF7e9CJCZu1Nc5uqs4RvGjGoc5xBo2ObcH7i2NDjd5S4fZx YL2mNB+Wwip+SfZDWLAoP+uAJi1bSPSEeK2pD/Yym/kAjxSbGnhKXyT5ze2xLP8DPNLjclwbNBL V/AL5lkVfyg4PEmhxltmUzNMTB48/z++OeskgJn5hbLfjr6MhRXNJQZFic+eyGuNLk/PxJ/kGOi ROn1lYB9ZA5lq7jwBsHKP5w== X-Received: by 2002:a05:6000:230b:b0:475:f0f0:9ec9 with SMTP id ffacd0b85a97d-47f9feb0549mr14024571f8f.52.1785179980495; Mon, 27 Jul 2026 12:19:40 -0700 (PDT) X-Received: by 2002:a05:6000:230b:b0:475:f0f0:9ec9 with SMTP id ffacd0b85a97d-47f9feb0549mr14024542f8f.52.1785179980010; Mon, 27 Jul 2026 12:19:40 -0700 (PDT) Date: Mon, 27 Jul 2026 15:19:38 -0400 From: "Michael S. Tsirkin" To: qemu-devel@nongnu.org Cc: Peter Maydell , Jason Wang , Yuri Benditovich , Paolo Abeni , huntr bubble Subject: [PULL v2 01/30] virtio: use masked features with set_features_ex Message-ID: References: MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: X-Mailer: git-send-email 2.51.2.2891.g4157995a80.dirty X-Mutt-Fcc: =sent Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=mst@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -36 X-Spam_score: -3.7 X-Spam_bar: --- X-Spam_report: (-3.7 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-1.58, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-Zoho-Virus-Status: 1 X-Zoho-AV-Stamp: zmail-av-0.2.10.1.5.2/285.167.77 X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785180085559158500 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" virtio_set_features_nocheck() calls set_features_ex with guest-supplied feature bits, without masking the value with host features (unlike set_features which gets the correct val & host_features). This does not matter if the driver matches spec, but drivers can be malicious or buggy and set bit outside the host mask. Devices don't expect this, so unsupported guest feature bits getting set can break the host. In virtio-net, this can enable RSC without vnet header support and cause out-of-bounds reads from short packets. Pass the masked features to set_features_ex, consistent with set_features. Fixes: CVE-2026-63321 Fixes: 64a6a336f4 ("virtio: add support for negotiating extended features") Cc: Jason Wang Cc: Yuri Benditovich Cc: Paolo Abeni Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3623 Reported-by: huntr bubble Signed-off-by: Michael S. Tsirkin Message-ID: Acked-by: Paolo Abeni --- hw/virtio/virtio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c index f4d86a3655..7c19080db5 100644 --- a/hw/virtio/virtio.c +++ b/hw/virtio/virtio.c @@ -3320,7 +3320,7 @@ static int virtio_set_features_nocheck(VirtIODevice *= vdev, const uint64_t *val) virtio_features_and(tmp, val, vdev->host_features_ex); =20 if (k->set_features_ex) { - k->set_features_ex(vdev, val); + k->set_features_ex(vdev, tmp); } else if (k->set_features) { bad =3D bad || virtio_features_use_ex(tmp); k->set_features(vdev, tmp[0]); --=20 MST From nobody Mon Sep 28 02:05:28 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785180035; cv=none; d=zohomail.com; s=zohoarc; b=KY0515MwpysEzUNBiVvBslHLdGfCUJ3D5vYUiUHT7BSF1QVO17GYOrbzX4ZXws7r1YzS2PpgNp0D39mYD/rzZQidXZfFvpCJkRUkAgIMTliSqKgUHMNW2FInUtBkI1rg+WpSyB8PZNs+6HzfZJpzr3mCcGY4JuC/8RBOuJc+AEw= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785180035; h=Content-Type:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=gn3znuVi/1agHf4H7bEz33XDAIBlLdDR7MKVnZpeaqY=; b=SwOLviQcPTTTrJamxMeYemjf2s+Ooc2D0Nko8lZwSPS62CX9ms0t9B6WVMuVFB1bNuKiReNMcgdp6yZVAcZaEoxIoX/CSrTQBhUmG4m3Hvlq9gzQACYmZAa+X+WAW5qOa4el081PkNL3sJa1VHL/S6hUkP0BzlfPF6cWBPjnp1M= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785180035825233.28757194944535; Mon, 27 Jul 2026 12:20:35 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1woQrk-00006Y-LR; Mon, 27 Jul 2026 15:19:56 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQrf-0008W9-0r for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:19:51 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQrd-0000LG-Bl for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:19:50 -0400 Received: from mail-wr1-f70.google.com (mail-wr1-f70.google.com [209.85.221.70]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-150-uYBMuVAgMCikQUC6_xh3cA-1; Mon, 27 Jul 2026 15:19:44 -0400 Received: by mail-wr1-f70.google.com with SMTP id ffacd0b85a97d-47f6e8b5996so3132680f8f.2 for ; Mon, 27 Jul 2026 12:19:43 -0700 (PDT) Received: from redhat.com (IGLD-80-230-28-14.inter.net.il. [80.230.28.14]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-47f96d4656bsm34527728f8f.21.2026.07.27.12.19.41 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 12:19:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785179987; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=gn3znuVi/1agHf4H7bEz33XDAIBlLdDR7MKVnZpeaqY=; b=EdKutbJo4P7BT2/ECJ2kOwb4wKchITxIwi4XzaapgijAy2WvKT8i7/GAbIDoIU3BvWuAkZ 5Nd8kQHhRWw8fvawM+b9gRGpVnz0P1MVALFwdUFTvnHYDRKMILkv/9e1oV0qh9+YrAJGzq dV6RFJpHnMBepywBoIlzCzbLy9/mhiE= X-MC-Unique: uYBMuVAgMCikQUC6_xh3cA-1 X-Mimecast-MFC-AGG-ID: uYBMuVAgMCikQUC6_xh3cA_1785179983 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1785179983; x=1785784783; darn=nongnu.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=gn3znuVi/1agHf4H7bEz33XDAIBlLdDR7MKVnZpeaqY=; b=Yhos/fbhapPbIKgePgeTZGoG3vALYZiITGJlu0AWoAwhmq9Ia2hWH0wq0mUhtcs7Qf gZ77wj9eAkcOpQN0qjFMHx+EKwAImImscGeOzF1SyZ5zlEDK/Sd96cr0X8kJpkrflsEN wqF2Jbu+YAEkSiRDmJt7joxDMmjDgDKJcrpJ9zWpxYFTotEts09W4viTc0w/L3LvWoJF DDzx8Nqqao9cQHue+ZDSSrU7rRmc8UbkUGzNJTT0CSdqJUCxkBnjG3xiteyeUCyGE8vc FjqE3VfbDYBnyYq+qIB2Ny8KItGuJVM0LDosbv/gslRrV0EdbVuk3fbjmSUGjAFo7SA2 r+5g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785179983; x=1785784783; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=gn3znuVi/1agHf4H7bEz33XDAIBlLdDR7MKVnZpeaqY=; b=P12YngFOE9LP4JSDAQqHOSLJQYlcm96r0N6JTuWclDGp7rXoBxlqos6KaiAauyPJEZ 04gftZjluPFZ8JZ4zdF+ka+naX3eM4LfH/6ZD3JodnrL1uz1YiQlgYrUxjoNZVg3oIrt VvHEv63vHvGYAesaxNBikzKT7PL8dAxQItT738jx1Vo816c6Kd48NCO05455d+VB8sdl ako6HQzXXOaw2sLwT1ozupB0NQlF/hb+AiR+7jpVWrV9KIp4tWasQS0dtMo5VG6QqV0S 4NH1YnMNoH4dbITIt7OPRkKlspYLr43lu8sPkgFKK1zp7Z2rGXGi7iN1h3VqEB2EF9FX 4ZNw== X-Gm-Message-State: AOJu0YxXwB1jZ/mKrwkjWF38FaDukdgAGRaJtrOp+Vk89c7Giq6nzv9f gsFlaxJFbhZGWFTw4Q6y7j1kZLhwH4wZQeff574T6qprJkTMq1bMp0fS2VKP171D3ueNTVTrnt3 XOaZ5u6aKIvWHPbcl55fcdBYXy/6L5JaQMIekCW0L+KOFE1nD5eGJlZO4ZRJ+D/bd5VRGAAYqJB 8E3s+ZL3m/sm90ia7k490FM5kgnTbIzToQ6w== X-Gm-Gg: AR+sD104MsMA4y4L9My+HEpS5mRct3+UihZ0ppId1boWTia8DTXnJmgTrUmiJfS24pX h6j575MzVP1LKV4hLyxy4/8iokcE0lD9brPY8VrmccvynOWrkUlickKBng5UxAE8ln4cEiwY8oF y0BeFSjzeRwivd5qWnXWIkjVGUNwQaDhIxOxuO8QBdY2U6EbydhiSKzs3gpV+vIMmr8tLa5ZiEl 6+Mc9ipoHEJsHzdeXjnY3cnnnme5oDiFbSxvIeOPwMtBQX5SdAqjqc2Dd7TDpF6AF/FMggL+JDN BY1l/abCuzkKB2L6QK3m7WxBjW5dczIqI6RhJWwD+52Yjn725jXgs0Bf+QsbDN1OsjsAtxwgzEp cKvdWCxWsKH4NwnVWoPsPlw== X-Received: by 2002:a05:6000:2311:b0:47f:81c4:36b4 with SMTP id ffacd0b85a97d-47f9fc8871dmr14046156f8f.14.1785179982792; Mon, 27 Jul 2026 12:19:42 -0700 (PDT) X-Received: by 2002:a05:6000:2311:b0:47f:81c4:36b4 with SMTP id ffacd0b85a97d-47f9fc8871dmr14046114f8f.14.1785179982175; Mon, 27 Jul 2026 12:19:42 -0700 (PDT) Date: Mon, 27 Jul 2026 15:19:40 -0400 From: "Michael S. Tsirkin" To: qemu-devel@nongnu.org Cc: Peter Maydell , Jason Wang , Yuri Benditovich , Wei Xu , huntr bubble Subject: [PULL v2 02/30] virtio-net: fix OOB read in RSC receive path Message-ID: <52c7bb369b23dfcafb6e6d90665c777797b55e88.1785179875.git.mst@redhat.com> References: MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: X-Mailer: git-send-email 2.51.2.2891.g4157995a80.dirty X-Mutt-Fcc: =sent Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=mst@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -36 X-Spam_score: -3.7 X-Spam_bar: --- X-Spam_report: (-3.7 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-1.58, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-Zoho-Virus-Status: 1 X-Zoho-AV-Stamp: zmail-av-0.2.10.1.5.2/285.167.77 X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785180037728158500 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The RSC receive path parses incoming frames at guest_hdr_len byte offsets, but the backend buffer contains only host_hdr_len bytes of vnet header. If the lengths differ, RSC would read at the wrong offset and cause an OOB read. This is no longer possible after the previous patch, but the assumption seem fragile. Along the defense in depth lines, let's validate. To ensure we are not breaking any valid setups by mistake, warn and fall back to the normal receive path when host_hdr_len !=3D guest_hdr_len. Fixes: CVE-2026-63321 Fixes: 2974e916df ("virtio-net: support RSC v4/v6 tcp traffic for Windows H= CK") Cc: Jason Wang Cc: Yuri Benditovich Cc: Wei Xu Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3623 Reported-by: huntr bubble Signed-off-by: Michael S. Tsirkin Message-ID: --- hw/net/virtio-net.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c index f0e3beb290..2761644dfd 100644 --- a/hw/net/virtio-net.c +++ b/hw/net/virtio-net.c @@ -2674,6 +2674,13 @@ static ssize_t virtio_net_receive(NetClientState *nc= , const uint8_t *buf, { VirtIONet *n =3D qemu_get_nic_opaque(nc); if ((n->rsc4_enabled || n->rsc6_enabled)) { + /* this never happens with existing backends, but just in case. */ + if (n->host_hdr_len !=3D n->guest_hdr_len) { + warn_report_once("virtio-net: host_hdr_len %zu !=3D guest_hdr_= len %zu, " + "skipping RSC", + n->host_hdr_len, n->guest_hdr_len); + return virtio_net_do_receive(nc, buf, size); + } return virtio_net_rsc_receive(nc, buf, size); } else { return virtio_net_do_receive(nc, buf, size); --=20 MST From nobody Mon Sep 28 02:05:28 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785180162; cv=none; d=zohomail.com; s=zohoarc; b=Wbvayi9HjU2qzJomqmYJFMvsngukO852W3B5dcHdUWYWhBqxW3dvhJyeQ9XscfcHGz6RJRON9esnViwUfN+cI2Kh7eZOyTI39/uZFNMe7nUInROLP5bFpXL89dSoi6sNClRgq32XCO/7fgVWuMO5L5C2tzOfmzy2cFhnjOF5HB0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785180162; h=Content-Type:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=RTWKwepcbjdvvt957sT6DX6W7SqARwm9zXL6of/Nhm0=; b=kSx1hOaXBUCbjBgRrF79jZWtmLLZCcqIKqkOnuDZetzZBSDq6IxJDgPoEzYak+JYGsohNfNg9eIgN1onaTDJr4kBHfZ8gBjntue/Wpw8LPtk7Y4rZF17xLZxIEvpVtodFTq6JXkBqcE7EGQgJucTLhquEhZIhNhcTvElvVscpqI= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785180162857302.43768894990023; Mon, 27 Jul 2026 12:22:42 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1woQrh-0008WT-2S; Mon, 27 Jul 2026 15:19:53 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQrf-0008W8-02 for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:19:51 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQrd-0000LI-Aq for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:19:50 -0400 Received: from mail-wm1-f71.google.com (mail-wm1-f71.google.com [209.85.128.71]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-333-FSvOhKQAP76g0MVkvvrRnw-1; Mon, 27 Jul 2026 15:19:46 -0400 Received: by mail-wm1-f71.google.com with SMTP id 5b1f17b1804b1-495474a5fbcso27835775e9.1 for ; Mon, 27 Jul 2026 12:19:46 -0700 (PDT) Received: from redhat.com (IGLD-80-230-28-14.inter.net.il. [80.230.28.14]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4957e334f63sm205542965e9.1.2026.07.27.12.19.43 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 12:19:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785179987; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=RTWKwepcbjdvvt957sT6DX6W7SqARwm9zXL6of/Nhm0=; b=PjEpoGcsT4ibhfcJWtPc4kUDs05DAuDsZEeTd2Uej2YWxcfl8oc8rX0xU42i7zjJx+bXBg Tdi8VH9O1pZNIKhD6OkOJJEXuoJiGeEXD3R2Nm8psY0Z4Umz5/824nYZElwFYUKitQ22i9 XOhwVjan5mUqn6oRMi/QI2HjqbMffSY= X-MC-Unique: FSvOhKQAP76g0MVkvvrRnw-1 X-Mimecast-MFC-AGG-ID: FSvOhKQAP76g0MVkvvrRnw_1785179985 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1785179985; x=1785784785; darn=nongnu.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=RTWKwepcbjdvvt957sT6DX6W7SqARwm9zXL6of/Nhm0=; b=l0O5wjW9Y1IYUh97oy1K9VWSAfldUAJLwjroCF9BWiiDlcf/RtLxuwdYuxTs1mUFO+ 8++CWw/bDHgNHE+XCM9Zsz6lZahqvSBsAGKdgNqzExHnyyvL13JxZWUEjPDTavc8X056 LOMAQkQ4qFvwC1mZiqCfz1Q6Mx7xsK+c5Ph3XBaY31yJhyVpW59PkCE989mvNt8HBl98 LcBkFyhBx05mYGQb/B727kgWpohdaHG42oGkpzcDXuwyVAw/2rhrwjYJhNJczMMnZPnJ X48i+m39GcG+Hl2zQ+dD9WraNy+t1zIBtfBC5izZkKU99KwUVArLRkBRagXoDRQWxIbp 5odg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785179985; x=1785784785; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=RTWKwepcbjdvvt957sT6DX6W7SqARwm9zXL6of/Nhm0=; b=eExaOy+z0WsLdWYWms8Ntu48WGh050wj/Kjq39vOdnfBYK4HghdesRyur/YrQpPVC0 G2hlV7Lk1ZT0n7ritrjy3Eu2aay+oY4HHRUdGjTGjZvnKzz4KchSFYLKff6v3di5LQMc UVnunmzLThvgaYiZFYP839LAzdq2fLoT/8FhyaA+Uu+kU8fuxckCfHagkwepZTGE2fcC jMF1nLSl1coPoHr64IpGOQGRpcbnEhq8y+RS6nHcjDCnbx0WED5TAWrizqy4bR3t5OZH sYUrWk+/pj+xkaXTDCnI+15G47bHRnLTMFgF+G4Vm2RjiDMks9fMT4NnRxEodNSykwvW 4VxQ== X-Gm-Message-State: AOJu0YzsCYsLN8DHMVXl2P/RHF7Hjkz0+8Lk1G1C8KP+t7gV1DPC5qhA JNp3B3knhdwfP7XW398H9rjtWnfXXR9A+l35Z4JDjjz+2j+3veb1Xt1mKmLKDlMJO8RO/mgkxbO W1l+lR9TgclPOO+YP3mB7ZQg1/zp8GJQBZByFtRbTq+RsP9fnqwDpj1j+ySH5YYO3J/YnuKdeWd TQycd5b3O0rDnuu8JoZSfYArqnbjj2AEqdmQ== X-Gm-Gg: AR+sD13cJ4Aiz6b6UPsQ85pKHriNTai7s7qwyLEcrsmB5IEtDApPK/GtDVl9lV4WEeV HcACHBVuPCs5cZ2f9Ny97EHtUKbJoMF/iR3THqwpiMddJQftG9gS7xYJYzg/UWmzY7CeIKp2PHY ovX1fDAiyIdUOUV7YHIiFrKO9RYV4UZO9o8nmHbmsGdOOC3z5U20IZkNFOLV+1d3o3kyoccN4eb eveiLpkX9+KPWpKPlKBQhPGRo76OXfgGMA59z7L7anoMtrcT7YbZ0zFurmGBkhF743/23WCjJ4j b4YskphVGCDQl7okaHvOFRiVThCOWC3wQsY8sveUyYr9BF/GwWS9+IVfbmhiJ9u0rvtkUQzkJH7 OHYS4FoOYQO/AGHg6FQ1VgQ== X-Received: by 2002:a05:600c:1387:b0:495:5b4a:53b7 with SMTP id 5b1f17b1804b1-496bd695ff4mr79303905e9.19.1785179984933; Mon, 27 Jul 2026 12:19:44 -0700 (PDT) X-Received: by 2002:a05:600c:1387:b0:495:5b4a:53b7 with SMTP id 5b1f17b1804b1-496bd695ff4mr79303645e9.19.1785179984446; Mon, 27 Jul 2026 12:19:44 -0700 (PDT) Date: Mon, 27 Jul 2026 15:19:42 -0400 From: "Michael S. Tsirkin" To: qemu-devel@nongnu.org Cc: Peter Maydell , Jason Wang , Alex Williamson , huntr bubble Subject: [PULL v2 03/30] virtio-net: fix short frame OOB read in receive_filter() Message-ID: <772488562053c1299fc3667a49b3ff1858f83979.1785179875.git.mst@redhat.com> References: MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: X-Mailer: git-send-email 2.51.2.2891.g4157995a80.dirty X-Mutt-Fcc: =sent Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=mst@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -36 X-Spam_score: -3.7 X-Spam_bar: --- X-Spam_report: (-3.7 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-1.58, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-Zoho-Virus-Status: 1 X-Zoho-AV-Stamp: zmail-av-0.2.10.1.5.2/285.167.77 X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785180164002158500 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Within virtio-net, receive_filter() reads Ethernet header fields without any length checks. But virtio-net sets do_not_pad in NetClientState, so backends such as socket forward frames at the size supplied by the peer without padding to the Ethernet minimum. A short frame thus causes an out-of-bounds read. Add size checks in receive_filter() and drop the truncated frames. Fixes: CVE-2026-63320 Fixes: 3831ab2094 ("qemu:virtio-net: Enable filtering based on MAC, promisc= , broadcast and allmulti (Alex Williamson)") Cc: Jason Wang Cc: Alex Williamson Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3626 Reported-by: huntr bubble Signed-off-by: Michael S. Tsirkin Message-ID: --- hw/net/virtio-net.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c index 2761644dfd..7e0c984ec6 100644 --- a/hw/net/virtio-net.c +++ b/hw/net/virtio-net.c @@ -1744,10 +1744,21 @@ static int receive_filter(VirtIONet *n, const uint8= _t *buf, int size) if (n->promisc) return 1; =20 + if (size < n->host_hdr_len + 14) { + /* Truncated ethernet packet */ + return 0; + } + ptr +=3D n->host_hdr_len; =20 if (!memcmp(&ptr[12], vlan, sizeof(vlan))) { - int vid =3D lduw_be_p(ptr + 14) & 0xfff; + int vid; + + /* Truncated vlan packet */ + if (size < n->host_hdr_len + 16) { + return 0; + } + vid =3D lduw_be_p(ptr + 14) & 0xfff; if (!(n->vlans[vid >> 5] & (1U << (vid & 0x1f)))) return 0; } --=20 MST From nobody Mon Sep 28 02:05:28 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785180082; cv=none; d=zohomail.com; s=zohoarc; b=UGB3ypO2msy6kKliCitJXwkS0mn3PMhJILpOenNofjMSoIgpW0yqUC3rOvGF83cODJ6zdXWLFWbn1uQBZLDLNTvtGZrvNzNhQu++T3gU0tmC/lFK9whb4Cdkm1nFTtypycuAkb9lom245eOziGjKE1TJ6yuWX257F0s4mfNkrcc= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785180082; h=Content-Type:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=5xEgcXduIKUS+efKpR6fC7s/haat8kW+FyLhnuY1/MM=; b=Jk9VE5TxfJ9dZcuTO5brHNGMWhD/SNe5IFysuehpbL9ihHbFa1W4LaJivtfoiSGsQ7gWnOPVrp5FpMlM9LQpWFIHK8DS0g0Bl+5omoXKSnLoQS+HDa1BRkK3bHROzTMMch6+h0M5Cww3zGnjwrjpSjy83Ws2lL+O2JsuN0OV7X0= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785180082703451.3016217450038; Mon, 27 Jul 2026 12:21:22 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1woQri-00005a-J5; Mon, 27 Jul 2026 15:19:54 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQrg-0008WR-Gp for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:19:53 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQre-0000LY-MT for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:19:52 -0400 Received: from mail-wm1-f72.google.com (mail-wm1-f72.google.com [209.85.128.72]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-527-zb2lgnO_PACqcGKH2tVlbA-1; Mon, 27 Jul 2026 15:19:48 -0400 Received: by mail-wm1-f72.google.com with SMTP id 5b1f17b1804b1-493bfc3b84aso17325845e9.0 for ; Mon, 27 Jul 2026 12:19:48 -0700 (PDT) Received: from redhat.com (IGLD-80-230-28-14.inter.net.il. [80.230.28.14]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496b388d5b4sm178961985e9.3.2026.07.27.12.19.45 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 12:19:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785179990; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=5xEgcXduIKUS+efKpR6fC7s/haat8kW+FyLhnuY1/MM=; b=AzYI2kv4XwmqttRp2hZ1WU/3zBj4Afd3v70vDaglFKNXQpQP+17yD6W+LFfIvmUoUIvnx8 Gzje4xMsEBCJR1e1+l7Gtsk2lBd/gp9ZbU2Rpw0RW8kHeC2nqvlVBphHdutD8af5QCWmi1 LxPrjQT8aSaH/kbKmOwBKLY1BJC3XbU= X-MC-Unique: zb2lgnO_PACqcGKH2tVlbA-1 X-Mimecast-MFC-AGG-ID: zb2lgnO_PACqcGKH2tVlbA_1785179987 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1785179987; x=1785784787; darn=nongnu.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=5xEgcXduIKUS+efKpR6fC7s/haat8kW+FyLhnuY1/MM=; b=m/Iv13VPjDXTLs5sYE5PGtPIujZM4twMoNPYswpYK3DdNSHbb4hBjIY7RorfRJo4Vk 7YYTuiiK35sK+WKINxwQ8uNoGgAWBMEd1ozb4Lq7nYO6CekStgCZKygC9notqcPYy4Eb LiZx1Jp9deLC7yRsXHkprLGOw75lurgOB4HtmKRHy3GaTnOIdipSMNJp8Tke0+/Ypt6E idmTFaT5cNPJTVP7cVghtRq1fUy6bSh4X+99MebDBFz1X4c3d0oMkE3hjfWPv3kI9RTd j/cMxuuvf4jBIPsW149ywupRLxFHjLZGRzYGLIDGbZyfwbtqOVp7npzDJCnVDvVCHjlr ndxA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785179987; x=1785784787; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=5xEgcXduIKUS+efKpR6fC7s/haat8kW+FyLhnuY1/MM=; b=YCsaF2urI1bnTxDoMJzz3bMDHneFQOLQbQX+xubh/zKRwWA9OFVoz0t4NTJA9im5U/ 7XLOjk4eeXKwSw2jlwkDHbdsKoi+5GheYAPoIAVirPdb5aayGWcg1vdGFeewO6dv/+sO DomOESW1sKkNRQy+wRohqaSzaeml8JVRQ3CvvHT+ES4xAEkheKczG4Wqdc4D2fp5PZ2/ czZKDdOwSebUEOXbziawvePCfc/LdRHPmPEkh/2si2eyrvriAxg3nHhxtJ/YEzeLP8LX WjKbxzb/HhW4M+FezqOicdh78kSBER4h+GM/x11I+9Tcs61uGbatAyBs0fMtFn3J388+ IFsw== X-Gm-Message-State: AOJu0YxV1EEuNOCMNoiSu+Q6rYzam93tkp4KKyX2QHsdKcZZTFNP9Ssd Lacms2wM2qPK+HgQt4RZ9b4gnGUwiBkAgBe95FJWz2h6klO1XsYzy57yr7Sdjxo2j36n4cvbhR/ fgSQAYz7RjroXqPJA09Lw4VBm+9tCNlA/2fApP5v4CCK83fvGyjVn2YfVctxuT9xZmrEKQdSc3r /CfzSlaQKkhqCJq1QzELBQkyeVF8uWFuGFTA== X-Gm-Gg: AR+sD12VZn6kTm3cSFWnpfjncH0n8RH6OKufyWy1mWLjeHCzXBuk5i1SSb9avAyRRNO pbW5fQ1mIHcIUR2X0jnVWAcdEEHTGCNv+Z7lZo0JOyUYJKGOHViL93Uy6s7PvorhqB0A+4CPFkY x9c1ccKViASX+CNhnXyVmh44Z4Q1nEIEebZUMl4IWcj933pgQ1ElEKp+tvgshYpOQivJp13wvjQ MJt+VUebjfqvUUNW+rb3FOsO74BopNm1TW+TU2xQHjhrBRWfFvDO4iXNM36BJMYVxipB4dfJM/u 2deyo4vrbsYwaQ8upyLh6JNU7xf/4RNqEZrT6TD/JH+++HR6GizF8Jo/30tI9jvynhdZlsIYJIi x7bLfgs+PkGRAQc4F4ODHLg== X-Received: by 2002:a05:600c:5253:b0:495:4732:1eb9 with SMTP id 5b1f17b1804b1-496c4fce74dmr4251295e9.21.1785179987343; Mon, 27 Jul 2026 12:19:47 -0700 (PDT) X-Received: by 2002:a05:600c:5253:b0:495:4732:1eb9 with SMTP id 5b1f17b1804b1-496c4fce74dmr4250865e9.21.1785179986671; Mon, 27 Jul 2026 12:19:46 -0700 (PDT) Date: Mon, 27 Jul 2026 15:19:44 -0400 From: "Michael S. Tsirkin" To: qemu-devel@nongnu.org Cc: Peter Maydell , Stefano Garzarella , xlabai Subject: [PULL v2 04/30] libvhost-user: protect against OOB writes in vu_set_inflight_fd Message-ID: References: MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: X-Mailer: git-send-email 2.51.2.2891.g4157995a80.dirty X-Mutt-Fcc: =sent Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=mst@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -36 X-Spam_score: -3.7 X-Spam_bar: --- X-Spam_report: (-3.7 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-1.58, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-Zoho-Virus-Status: 1 X-Zoho-AV-Stamp: zmail-av-0.2.10.1.5.2/285.167.77 X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785180083596158500 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" vu_set_inflight_fd() trusts the num_queues value from the VHOST_USER_SET_INFLIGHT_FD message without checking it against dev->max_queues, so an oversized value causes out-of-bounds writes to dev->vq. Front end is generally trusted so not a security problem, but OOB isn't a nice way to handle frontend bugs. Let's harden this a bit: check num_queues and panic if it's invalid. Fixes: 5f9ff1eff3 ("libvhost-user: Support tracking inflight I/O in shared = memory") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3740 Cc: Stefano Garzarella Reported-by: xlabai Signed-off-by: Michael S. Tsirkin Message-ID: <23b3f12388c1035f208550df9de9944c22d8d534.1784899127.git.mst@re= dhat.com> --- subprojects/libvhost-user/libvhost-user.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/subprojects/libvhost-user/libvhost-user.c b/subprojects/libvho= st-user/libvhost-user.c index 2c35bddd6f..8208265588 100644 --- a/subprojects/libvhost-user/libvhost-user.c +++ b/subprojects/libvhost-user/libvhost-user.c @@ -1998,6 +1998,8 @@ vu_get_inflight_fd(VuDev *dev, VhostUserMsg *vmsg) =20 if (vmsg->size !=3D sizeof(vmsg->payload.inflight)) { vu_panic(dev, "Invalid get_inflight_fd message:%d", vmsg->size); + vmsg_close_fds(vmsg); + vmsg->fd_num =3D 0; vmsg->payload.inflight.mmap_size =3D 0; return true; } @@ -2005,6 +2007,15 @@ vu_get_inflight_fd(VuDev *dev, VhostUserMsg *vmsg) num_queues =3D vmsg->payload.inflight.num_queues; queue_size =3D vmsg->payload.inflight.queue_size; =20 + if (num_queues > dev->max_queues) { + vu_panic(dev, "Invalid get_inflight_fd num_queues: %"PRId16, + num_queues); + vmsg_close_fds(vmsg); + vmsg->fd_num =3D 0; + vmsg->payload.inflight.mmap_size =3D 0; + return true; + } + DPRINT("set_inflight_fd num_queues: %"PRId16"\n", num_queues); DPRINT("set_inflight_fd queue_size: %"PRId16"\n", queue_size); =20 @@ -2052,6 +2063,7 @@ vu_set_inflight_fd(VuDev *dev, VhostUserMsg *vmsg) vmsg->size !=3D sizeof(vmsg->payload.inflight)) { vu_panic(dev, "Invalid set_inflight_fd message size:%d fds:%d", vmsg->size, vmsg->fd_num); + vmsg_close_fds(vmsg); return false; } =20 @@ -2061,6 +2073,13 @@ vu_set_inflight_fd(VuDev *dev, VhostUserMsg *vmsg) num_queues =3D vmsg->payload.inflight.num_queues; queue_size =3D vmsg->payload.inflight.queue_size; =20 + if (num_queues > dev->max_queues) { + vu_panic(dev, "Invalid set_inflight_fd num_queues: %"PRId16, + num_queues); + close(fd); + return false; + } + DPRINT("set_inflight_fd mmap_size: %"PRId64"\n", mmap_size); DPRINT("set_inflight_fd mmap_offset: %"PRId64"\n", mmap_offset); DPRINT("set_inflight_fd num_queues: %"PRId16"\n", num_queues); @@ -2071,6 +2090,7 @@ vu_set_inflight_fd(VuDev *dev, VhostUserMsg *vmsg) =20 if (rc =3D=3D MAP_FAILED) { vu_panic(dev, "set_inflight_fd mmap error: %s", strerror(errno)); + close(fd); return false; } =20 --=20 MST From nobody Mon Sep 28 02:05:28 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785180042; cv=none; d=zohomail.com; s=zohoarc; b=SZVpUoPDrEKRj+V9152qCAxNFmxruYwlg8eUV6u7oXsTHpMknTwEes0QVdw8IKqKlNSVL958/79Nqgx5AI2IhsR9Xw7OR5j0dIXyKFMb0ecnZgE7C3LDihd8bLIMxkxM28msk6XHMtJrVRanqsikdl86sOnubE7NS91EpKGNfQU= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785180042; h=Content-Type:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=y1895M+UpGSv0E/zHw1pl3GXC82tC3h2kRRWVl1rs6Y=; b=NzQojIi2v73bvfNMkMqY/CWZp9X7tAaJIqi1qP4/8qNQKnlyO0DjMDuV/awvMCtiyaK58LV/iweucX7OPGAyWAXFYpJxNk2aqB5xJPyMedLU72e4VZx20uve+7r/svsndKdLp8TncrsHUqGh+RIl7t67CiZ9fHf0fyYydIMYpd0= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 178518004200583.9562591294283; Mon, 27 Jul 2026 12:20:42 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1woQrk-00006W-Fi; Mon, 27 Jul 2026 15:19:56 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQri-00005T-Ba for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:19:54 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQrg-0000Lr-Op for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:19:54 -0400 Received: from mail-wr1-f72.google.com (mail-wr1-f72.google.com [209.85.221.72]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-573--70U5AniNjm_OXEtngPlwg-1; Mon, 27 Jul 2026 15:19:50 -0400 Received: by mail-wr1-f72.google.com with SMTP id ffacd0b85a97d-472c330e555so1795193f8f.1 for ; Mon, 27 Jul 2026 12:19:50 -0700 (PDT) Received: from redhat.com (IGLD-80-230-28-14.inter.net.il. [80.230.28.14]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496c45e0424sm14762205e9.13.2026.07.27.12.19.47 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 12:19:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785179992; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=y1895M+UpGSv0E/zHw1pl3GXC82tC3h2kRRWVl1rs6Y=; b=hSR+iYgyyUbCb4mXtmq3cM3azKlEb/fdXmeWjZxtN9pFet1KAJum1e3csZj62lq9JmuALu 05cVB3P5UCYtcUIp+Z2qrvey+zsplHiBlL7x7qH7+yBIe6bjBOHewkxGecogX1J85gWRQj 0zN7TP1uojp2xT6KIJ+qI6Z0ufdbFnU= X-MC-Unique: -70U5AniNjm_OXEtngPlwg-1 X-Mimecast-MFC-AGG-ID: -70U5AniNjm_OXEtngPlwg_1785179989 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1785179989; x=1785784789; darn=nongnu.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=y1895M+UpGSv0E/zHw1pl3GXC82tC3h2kRRWVl1rs6Y=; b=mU823NB3eLHO+P+c3DqEnGRE7ooVlofg6/av7jjqjm+qA31itNVt0HTwrIs3qmfMpE DCLBfP6P8XVvB6Yc737JmTqxGDUzn5kubn3lhCvhqVJOPuwQWKZbwbUSbEdFxYI5Kv6l AWNdfnTkwosXq1uHCht1RTPAXSto+DEL2HjhLCRl5aZ/kVpRw+yzymZnzwcvRyAnez/y +b0O3YIrJGuQWqKNc5K39jRvLJeZSzh0hcOvadPSjetOTYfGFXkTspmXmfLd35C5yXax 42pl2oBFuVh0FJrkeQjXCUCcAl/n/4KGlisxXcKp51gdDqzp1VRL8vrGfKRIWHS+7OXk 7nNQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785179989; x=1785784789; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=y1895M+UpGSv0E/zHw1pl3GXC82tC3h2kRRWVl1rs6Y=; b=ccoTc13eSA2jE/VYJ9glmnvOVTzzTPry0vPdfVCVgwKFWBDSWnJ522Dm70ATtUxyp+ 2qDOcyA9y+1ms/Vs3lbMyzE3D3S4Nn0KDBGNjy0UeqiBVYjmxsJ13uHUHSAyeqKj7IaM fZEmM1MPA5ojkbfgUxHCO5VyWGMdlubfTacvNcwzHeIPPZeTPF1H5MUYDf2dHeo4xbxq +SfWIK6A0ppI+9wMaAOugpTaNSMfp5/l+hZ4EJJ1QmGBB5++Qxku8JjCs01SflYF83TQ Cm819PuEiOxNIkpwpEuuSekmauaNMdPbbISCKal54rUYNDT4X93PqKXI2fd98KKgY6P4 p1CQ== X-Gm-Message-State: AOJu0YxLAjZ8rdvL421CSpsBVVxIQ987bbIUkjz3VNAxfgRhtaIeINQ8 5xnHXzyPSLFDzae5n8iKsyU+pmKgqBFqFwHuSmDl+Ma/MXQ4SRydNjWxfQJ+BZk/2vpLpVx6+Ki AnDTChWsN1FxDUfCi72/jyxL5bs7jWzXg/REsqL2Zartsg1rOTEU6e7ufKomjjpEzRfQaR7RAn8 SaAnRBmHPHk/xK4bOqsqy+ugE5UKUOBEm0Ag== X-Gm-Gg: AR+sD10lXS+vTXRXmttHi/zSBScQZYX8zVTtfb/TIh7fNqOhEfUzMTM4HiiYAV9+oGu KrWAsHcEhulKWhtU1XFgkKE5JzuddWkD/Gh6Zo3Cr1H+FTUB380VU0LQG6GD21LL5L2xRPxFPMD qwRJ83+kt0yJtXl1lz6qKsyu/D2+gl0n3zumNJ03ODIkUSAwzsc3NAB8k9wyHR5EvZR/qgR8HWs onFSG82PsT+hdJRBArQ1zurpLYTr9PqSjfKPu2fPMow/KduyDpVtRlSzIo8YeHEH47Gtl2HDbOs qeV3QWyl0EwIxzvtH8nHOB3ImpwajwJukUI5U1UK8R9nYx2F+btIVZUuEXDy1XZVhwv3VfXkgEU jm0yzR5lh0YzW6QfhNaSS1g== X-Received: by 2002:a05:600c:5487:b0:495:503f:cf9a with SMTP id 5b1f17b1804b1-496b57170aamr112086845e9.9.1785179989350; Mon, 27 Jul 2026 12:19:49 -0700 (PDT) X-Received: by 2002:a05:600c:5487:b0:495:503f:cf9a with SMTP id 5b1f17b1804b1-496b57170aamr112086475e9.9.1785179988780; Mon, 27 Jul 2026 12:19:48 -0700 (PDT) Date: Mon, 27 Jul 2026 15:19:46 -0400 From: "Michael S. Tsirkin" To: qemu-devel@nongnu.org Cc: Peter Maydell , Stefano Garzarella , xlabai Subject: [PULL v2 05/30] libvhost-user: protect against OOB vring queue access Message-ID: <758ef96a2dba157e930af7709f327435a153f7a3.1785179875.git.mst@redhat.com> References: MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: X-Mailer: git-send-email 2.51.2.2891.g4157995a80.dirty X-Mutt-Fcc: =sent Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=mst@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -36 X-Spam_score: -3.7 X-Spam_bar: --- X-Spam_report: (-3.7 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-1.58, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-Zoho-Virus-Status: 1 X-Zoho-AV-Stamp: zmail-av-0.2.10.1.5.2/285.167.77 X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785180043442158500 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" SET_VRING_NUM, SET_VRING_ADDR, SET_VRING_BASE, and GET_VRING_BASE handlers all use the queue index from the message to access dev->vq[] without checking that it is below dev->max_queues, so a malformed message causes an out-of-bounds heap access. Frontend is trusted so not a security problem, but an OOB access is not a nice way to handle errors. Check, and panic. Fixes: 7b2e5c65f4 ("contrib: add libvhost-user") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3741 Cc: Stefano Garzarella Reported-by: xlabai Signed-off-by: Michael S. Tsirkin Message-ID: --- subprojects/libvhost-user/libvhost-user.c | 28 ++++++++++++++++++++++- 1 file changed, 27 insertions(+), 1 deletion(-) diff --git a/subprojects/libvhost-user/libvhost-user.c b/subprojects/libvho= st-user/libvhost-user.c index 8208265588..42a5e2f1f5 100644 --- a/subprojects/libvhost-user/libvhost-user.c +++ b/subprojects/libvhost-user/libvhost-user.c @@ -1200,6 +1200,12 @@ vu_set_vring_num_exec(VuDev *dev, VhostUserMsg *vmsg) =20 DPRINT("State.index: %u\n", index); DPRINT("State.num: %u\n", num); + + if (index >=3D dev->max_queues) { + vu_panic(dev, "Invalid vring_num index: %u", index); + return false; + } + dev->vq[index].vring.num =3D num; =20 return false; @@ -1210,7 +1216,7 @@ vu_set_vring_addr_exec(VuDev *dev, VhostUserMsg *vmsg) { struct vhost_vring_addr addr =3D vmsg->payload.addr, *vra =3D &addr; unsigned int index =3D vra->index; - VuVirtq *vq =3D &dev->vq[index]; + VuVirtq *vq; =20 DPRINT("vhost_vring_addr:\n"); DPRINT(" index: %d\n", vra->index); @@ -1220,6 +1226,12 @@ vu_set_vring_addr_exec(VuDev *dev, VhostUserMsg *vms= g) DPRINT(" avail_user_addr: 0x%016" PRIx64 "\n", (uint64_t)vra->avai= l_user_addr); DPRINT(" log_guest_addr: 0x%016" PRIx64 "\n", (uint64_t)vra->log_= guest_addr); =20 + if (index >=3D dev->max_queues) { + vu_panic(dev, "Invalid vring_addr index: %u", index); + return false; + } + + vq =3D &dev->vq[index]; vq->vra =3D *vra; vq->vring.flags =3D vra->flags; vq->vring.log_guest_addr =3D vra->log_guest_addr; @@ -1256,6 +1268,12 @@ vu_set_vring_base_exec(VuDev *dev, VhostUserMsg *vms= g) =20 DPRINT("State.index: %u\n", index); DPRINT("State.num: %u\n", num); + + if (index >=3D dev->max_queues) { + vu_panic(dev, "Invalid vring_base index: %u", index); + return false; + } + dev->vq[index].shadow_avail_idx =3D dev->vq[index].last_avail_idx =3D = num; =20 return false; @@ -1267,6 +1285,14 @@ vu_get_vring_base_exec(VuDev *dev, VhostUserMsg *vms= g) unsigned int index =3D vmsg->payload.state.index; =20 DPRINT("State.index: %u\n", index); + + if (index >=3D dev->max_queues) { + vu_panic(dev, "Invalid vring_base index: %u", index); + vmsg->payload.state.num =3D 0; + vmsg->size =3D sizeof(vmsg->payload.state); + return true; + } + vmsg->payload.state.num =3D dev->vq[index].last_avail_idx; vmsg->size =3D sizeof(vmsg->payload.state); =20 --=20 MST From nobody Mon Sep 28 02:05:28 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785180052; cv=none; d=zohomail.com; s=zohoarc; b=R7B/LU57GAqaOud+vk4cg7Se9271h+qcihcurdArCPvyavcvdnci2KHjIMwGykw3TELuqHA/XLfRtENLu6bFJtToR3xZU+jTwOn9zsCnUDR41ReNw9Dhr+180BSY6E6TUDQZEuNdbac5JeRBP/4XjitftRkfJINVSIZMtksjEm8= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785180052; h=Content-Type:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=/txAZo0uKIIHRAZMetvN+bShmrwHuXg9vNoDM1Sc3Ec=; b=bRw3Yn4bOI1aC+a+U8M4hNdqsTUtTXsZjwarfLhJQc31RPmAy4LWn56NMVA6mAAhYxB6CRZSc4YQCeGiLFyXBKuyrde2pd7TMksmcD8Z1POSrgWe3xxmlMAhJiPq/PQRL2qdEhH8l+5C7AwyDiSlTV37BHyLpjsr7An+lwsXe5Q= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785180052423786.8479961425697; Mon, 27 Jul 2026 12:20:52 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1woQro-00007s-0E; Mon, 27 Jul 2026 15:20:00 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQrl-00006u-0n for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:19:57 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQrj-0000MF-HZ for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:19:56 -0400 Received: from mail-wr1-f70.google.com (mail-wr1-f70.google.com [209.85.221.70]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-688-cOel_knzNfOad8K__TW7zg-1; Mon, 27 Jul 2026 15:19:53 -0400 Received: by mail-wr1-f70.google.com with SMTP id ffacd0b85a97d-47f6e8b5996so3132769f8f.2 for ; Mon, 27 Jul 2026 12:19:53 -0700 (PDT) Received: from redhat.com (IGLD-80-230-28-14.inter.net.il. [80.230.28.14]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-47f85bdac28sm50182920f8f.16.2026.07.27.12.19.49 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 12:19:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785179994; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=/txAZo0uKIIHRAZMetvN+bShmrwHuXg9vNoDM1Sc3Ec=; b=JNNY2dAsrkm1e232B22i3YIcW1p9BQRY4JDW57mS6E57cz66ekat0blvRZ64pfzg6/t6Nx 5mEVt4/hmAQZTmRckj9KgCavCGcomfBY0z0QF+9aD1XI4wxzImogymgC0PSziY9PhAKG9N q3NruywEArMfLM35i0u2jFLug3/U6x4= X-MC-Unique: cOel_knzNfOad8K__TW7zg-1 X-Mimecast-MFC-AGG-ID: cOel_knzNfOad8K__TW7zg_1785179992 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1785179992; x=1785784792; darn=nongnu.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=/txAZo0uKIIHRAZMetvN+bShmrwHuXg9vNoDM1Sc3Ec=; b=dkdqKXUKY8gWanSxPzbvKFpauAWXMA5V2yr96n71clvodsQcgrSzHXx1DxuEbWDGlI VDL7++UGwYl2TaizaMO3DeLorFo5VTSGUG/FDa2JxpQsFDbEERhJ4qkOJPphjKnWgb5W Ksn23x3eMDXaspq6+L0k1Kq5hVOuTfCWI1ei4g5trMj8wdO9uWJhztAYOc+Jp/N/0e4e 9tyjPBZ4Kl4T0kG3R7axlXUxVuR9rKf7Uxke3Q30INWCioar7+pLiGB3C2fvxWib1imG YMfSVbUWHchnzDykSKVOrlEXGgMc+tDV5jr7wjkGRYFFBb5COa71+zoqH/JpcxEmmed0 Uv4A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785179992; x=1785784792; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=/txAZo0uKIIHRAZMetvN+bShmrwHuXg9vNoDM1Sc3Ec=; b=FG1LCaaE23E4+FfrdmNHynzrMbh2PP0xrJV9vkA0+TH2+iNBZR5gf3wcV3aO0ma89n ct6y9kq/RuOmDKUMQ2Hs+Oi6PlT5yXgyCWV/VKn73hTsWgbr0qh8vG8Flfxlf7GS+DuA BUwLlnuxYAGPRmuAy8+o5LNh3MEgjGfS10+v5hYrOVp5o6Tzrttvdb1fMKFsvB18wf9Q bXYqfgBdEQJ5BSeonJEPedIPyPNi0mcmjQ35SoYJF9Ygo0h6M+M3rRVcjqNq/kKdXM7I Zhro5G1mO4u/MLqPkryk8H06srecHHf9MCeMRYqR/vxc157uIGstpUqCZkWtNiFHAsp0 twKA== X-Gm-Message-State: AOJu0Yy7qZOq74NzDdjy9cVlBSwltLBAcwesOvnvwmdMy3mXH1WZ6Ats ZtrRRShC9S4qChsbTHQlOo9teWHpwEJF4kudoo6MhmtKfBeNunMTwBvl05mhbhy/ezyGmENi/nE 80UTK6Cq28VJBYQqW6yeAQUj2sYYdlr76pKwcorBXJRM2EZ6etinlCPYlydnFfPZAxCo6K98Nwy 1VEQuM07TLCtVbMrRsZM1/5pYCjabIytXrxg== X-Gm-Gg: AR+sD13if+4OMCBNBEJhFip+RfusTq1V/b8AsApcM0+LryZCZWwsBS+I//5+jk2h2Dy 1CmhWOoyh/GMfpdyLbaFChs9gIvKYzATxuUSldRwLM38QWwDRyy0O2S/GCwAdk0CfRCIhnc7sG6 x/qaVJy4Zoclg6m0PK2QUfU88nkptVbVZpMF61ri4H4akyQ1WairNflXa3F2jiHwi8mi9AikofD x02atKcDbwpoWRKN81BKC6838uNucMxcpy460laEBYdbyuOb0eUxf366bTrdbhtDLdA+EkTukO5 J8ZWdsrLrSzfEBePrzNO7EtAapMj6IITDZyR/q8d7DD2lTU44hgnErLVbEsQ8mlQ4raX8Jk9ldK kzJaNCquLTO0RpKxLqVpopQ== X-Received: by 2002:a05:6000:2311:b0:47f:81c4:36b4 with SMTP id ffacd0b85a97d-47f9fc8871dmr14046694f8f.14.1785179992007; Mon, 27 Jul 2026 12:19:52 -0700 (PDT) X-Received: by 2002:a05:6000:2311:b0:47f:81c4:36b4 with SMTP id ffacd0b85a97d-47f9fc8871dmr14046659f8f.14.1785179991446; Mon, 27 Jul 2026 12:19:51 -0700 (PDT) Date: Mon, 27 Jul 2026 15:19:49 -0400 From: "Michael S. Tsirkin" To: qemu-devel@nongnu.org Cc: Peter Maydell , Laurent Vivier , jasowangio@gmail.com, qemu-stable@nongnu.org, dong ling Subject: [PULL v2 06/30] hw/virtio: reject zero-length packed indirect descriptor table Message-ID: <6dbdc271f56b42e921a662b65a862f503eb4448e.1785179875.git.mst@redhat.com> References: MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: X-Mailer: git-send-email 2.51.2.2891.g4157995a80.dirty X-Mutt-Fcc: =sent Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=mst@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -36 X-Spam_score: -3.7 X-Spam_bar: --- X-Spam_report: (-3.7 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-1.58, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-Zoho-Virus-Status: 1 X-Zoho-AV-Stamp: zmail-av-0.2.10.1.5.2/285.167.77 X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785180053388158500 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Laurent Vivier The split-ring path already rejects a zero-length indirect descriptor table since commit 7423192912af ("virtio: add checks for the size of the indirect table"). The packed-ring path is missing the same check, allowing a guest to trigger an assertion in address_space_cache_init() with a packed indirect descriptor that has len=3D0. Add the same !desc.len check to the packed-ring indirect validation in both virtqueue_packed_get_avail_bytes() and virtqueue_packed_pop(). Fixes: 86044b24e865 ("virtio: basic packed virtqueue support") Cc: jasowangio@gmail.com Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3984 Reported-by: dong ling Signed-off-by: Laurent Vivier Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin Message-ID: <20260715115040.2186274-1-lvivier@redhat.com> --- hw/virtio/virtio.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c index 7c19080db5..2d33622daf 100644 --- a/hw/virtio/virtio.c +++ b/hw/virtio/virtio.c @@ -1475,7 +1475,7 @@ static void virtqueue_packed_get_avail_bytes(VirtQueu= e *vq, } =20 if (desc.flags & VRING_DESC_F_INDIRECT) { - if (desc.len % sizeof(VRingPackedDesc)) { + if (!desc.len || (desc.len % sizeof(VRingPackedDesc))) { virtio_error(vdev, "Invalid size for indirect buffer table= "); goto err; } @@ -1927,7 +1927,7 @@ static void *virtqueue_packed_pop(VirtQueue *vq, size= _t sz) vring_packed_desc_read(vdev, &desc, desc_cache, i, true); id =3D desc.id; if (desc.flags & VRING_DESC_F_INDIRECT) { - if (desc.len % sizeof(VRingPackedDesc)) { + if (!desc.len || (desc.len % sizeof(VRingPackedDesc))) { virtio_error(vdev, "Invalid size for indirect buffer table"); goto done; } --=20 MST From nobody Mon Sep 28 02:05:28 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785180217; cv=none; d=zohomail.com; s=zohoarc; b=fDYNci71tE2ec/Kg87AnJuV34VFfFH+fgLd9bBFgKhxaDl75xVoKYDPg0bFIjgHw5h4wyWD1WSZrEguYZaaUbf7ISllAbTHkoTcsMyXaXtCG+hma0dPdXwfpZI3ZKIPneIeTnbq5h3/EA1f85o67mpvtjgZ5cg1MVwkcj7jAgbU= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785180217; h=Content-Type:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=0KkUZwiZCp3omFxnV90IJXEAM6ZshsqXJQAFCai5nyM=; b=NN11fnZ26U9mAMgjo9UudYEw9LNJO8ZHiF9+geJrU/DBvCFBDrC6o0EtLddRqjMCWlIWOEm0jtaN0eUPROJ0q03ucmEHNlP9ht/dM3Ag6c5fbOzkqDKoLVyZfbYpz6/PV7tW5yYlE1h7lIUhL1UnK92TbHgt6k1tE4EKy6Xcyuc= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785180217295126.94668129701836; Mon, 27 Jul 2026 12:23:37 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1woQrp-00008F-KX; Mon, 27 Jul 2026 15:20:01 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQrn-00007V-8c for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:19:59 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQrl-0000Ma-OE for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:19:59 -0400 Received: from mail-wm1-f72.google.com (mail-wm1-f72.google.com [209.85.128.72]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-628-PDFd6UPZM4iU1Ath3CIC5A-1; Mon, 27 Jul 2026 15:19:55 -0400 Received: by mail-wm1-f72.google.com with SMTP id 5b1f17b1804b1-492488f8583so28268545e9.2 for ; Mon, 27 Jul 2026 12:19:55 -0700 (PDT) Received: from redhat.com (IGLD-80-230-28-14.inter.net.il. [80.230.28.14]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-47f85c66cebsm52624772f8f.30.2026.07.27.12.19.52 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 12:19:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785179997; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=0KkUZwiZCp3omFxnV90IJXEAM6ZshsqXJQAFCai5nyM=; b=dlA+3YZPB4EU9TU8wjCNUA0dhBkz6csrUo3HkACuMO9vusZTFAfaAV05WarIhV7eks4CVI BnCzzBSBTyoJL/PPDEkzS9aFpISk6uiB92s602FmQdbvBWewb5mJbbXTTWfFMaeEXXSaSj q3RHIIwH905/sEXrw3vJ5NlecOPi1ao= X-MC-Unique: PDFd6UPZM4iU1Ath3CIC5A-1 X-Mimecast-MFC-AGG-ID: PDFd6UPZM4iU1Ath3CIC5A_1785179994 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1785179994; x=1785784794; darn=nongnu.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=0KkUZwiZCp3omFxnV90IJXEAM6ZshsqXJQAFCai5nyM=; b=QRDSybOF5sIfzbfFlxg3oaxex2iYnRZCcFX6+6UqQAs73nDYS/Yl+QUDgAjJ/hN7AU 5u3vSzZ1WX5UzvNVXXDeDeQqBonp+ccB4uDWjS1/8iyrB8tPkhHP1kKn43EpCqi7zIm8 NcjHl9zkM6nRO3aREtuAz1h2laD7KYr2n8unkNjdKHxhdHbhN/QVGGifD8vbSohF2jqX xcZbQ2gw+4kgel0p+syfzEPeGr0PoWq29BTibE9fi3XdakLOv6PUKxoBgd0Uws8g/w0O IEhgHDofy9TLBsHR0Hf8RObzXRigdx7wdLveLynrii/2GWUdF0/18R4bnRLjCg8x4Ioa EeMQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785179994; x=1785784794; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=0KkUZwiZCp3omFxnV90IJXEAM6ZshsqXJQAFCai5nyM=; b=TqwQ03ygx2N4CVIBNYJF/sc3hVg5iPITW9Yh1i+S1nwWU6cbhxDN7D+W6EI1zLIsJz hvn+w81M6OPr+URXQoDHuy7rwmV/sKhbw+z+UInvwLvznzXmsd2F9UfqC+Z6adCTnh8J 5neAv+ZSTRIfoBu+P7GILt+zKDd303gqM9paHADj7xV4j7Mz/5mn818fjsaZGRBR1why +cP8fTMMopHLUMIVOuDmybtXSL18fHNs8i0QhONos6tixZWKPHLxTC3DlXwCr+oJTb4y Wb//kQgOsfX7aKzTU+lEk53JypGPbg76DhRfRMcFTnEwW3ybMfWHVqX0F33zGQeLp9VU RH2A== X-Gm-Message-State: AOJu0Yyp5RySVvkOV4BpElS6rwPJjRAdLWaCh5Bh9TzJCGA5aUD9n3vN 1RlUUPnuND3MkxiTJgzhqa2UZOSm4BtNxkn8RnJj9ZxCk5IgveU/2YJVw6auSXNnZViv2WGZUJM ocyuAYrUDT7yHXo42ceWabxkcwJbnO/5LUlj01+uPr3Pli7PXd6l3bkMNNHPjY9G1HAcc+d6HqF Xpn/2FFKKdLz5x6gLVwMGtXu6a/3WwGKwDcQ== X-Gm-Gg: AR+sD129zuLXHXGAIyeFKqiyMqYPHmStOvQoStGA44SU77EngAM4y3B/tVCVuQts+zS IMbydu74o7/j0TvY3DVUa5gH7BbIMVXM4Rq+RN6MYOXU+A4UzNPiCYxOzcF4nmlkN9D6plKs03n d/oXtYNfZe7alAbfeiz4TzDRZvnnZR8bppjYpENbpLEz8AhWsnEcLDypPGkecwkrFUbIgeaGury 1SaXY+MsRhVUbXwnerhJiDjnL3Kio7AjyVJ1tr9ttpTYziecnSizXkNqxMN0IHldZFZC9hH3Hh2 b8A7saDHIDeIcfQHQiQkd/tfzsJzXf2AMNf5g0t4FgixvCWpZEHYOtkJIXuRUY7lB1x5PYv+nNj B9M2sRYpH34jgwbIef7G5kw== X-Received: by 2002:a05:600c:1990:b0:495:67b8:d97e with SMTP id 5b1f17b1804b1-496c4fcdd98mr3922325e9.30.1785179994209; Mon, 27 Jul 2026 12:19:54 -0700 (PDT) X-Received: by 2002:a05:600c:1990:b0:495:67b8:d97e with SMTP id 5b1f17b1804b1-496c4fcdd98mr3922015e9.30.1785179993656; Mon, 27 Jul 2026 12:19:53 -0700 (PDT) Date: Mon, 27 Jul 2026 15:19:51 -0400 From: "Michael S. Tsirkin" To: qemu-devel@nongnu.org Cc: Peter Maydell , Stefano Garzarella , "Dr. David Alan Gilbert" , Feifan Qian Subject: [PULL v2 07/30] vhost: do not crash on ring map failure Message-ID: <27806d2ddba2da97fb4137cba7d4172356c42914.1785179875.git.mst@redhat.com> References: MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: X-Mailer: git-send-email 2.51.2.2891.g4157995a80.dirty X-Mutt-Fcc: =sent Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=mst@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -36 X-Spam_score: -3.7 X-Spam_bar: --- X-Spam_report: (-3.7 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-1.58, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-Zoho-Virus-Status: 1 X-Zoho-AV-Stamp: zmail-av-0.2.10.1.5.2/285.167.77 X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785180218176158500 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When vhost_commit() rebuilds the memory region table after a flatview change, it revalidates cached host virtual addresses for active vring parts. If a mapping is stale, QEMU abort(). This is not a security problem - only the priviledged guest can control make it invalid - but not nice e.g. for driver debugging. Let's call virtio_error() instead, marking the device as broken. Fixes: 0ca1fd2d68 ("vhost: Simplify ring verification checks") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3783 Cc: Stefano Garzarella Cc: Dr. David Alan Gilbert Reported-by: Feifan Qian Signed-off-by: Michael S. Tsirkin Message-ID: <71961a7dc157f552303aeea8c99a75c5e1ce904e.1784898432.git.mst@re= dhat.com> Reviewed-by: Dr. David Alan Gilbert --- hw/virtio/vhost.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c index af41841b52..371dca17dd 100644 --- a/hw/virtio/vhost.c +++ b/hw/virtio/vhost.c @@ -755,8 +755,9 @@ static void vhost_commit(MemoryListener *listener) (void *)(uintptr_t)dev->mem->regions[i].userspace_a= ddr, dev->mem->regions[i].guest_phys_addr, dev->mem->regions[i].memory_size)) { - error_report("Verify ring failure on region %d", i); - abort(); + virtio_error(dev->vdev, + "Verify ring failure on region %d", i); + goto out; } } =20 --=20 MST From nobody Mon Sep 28 02:05:28 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785180209; cv=none; d=zohomail.com; s=zohoarc; b=lstEkvjVTchAdjeDiVL5X3Y4tnY2dP9c8FuWf7WZM5teadBpB3FhlsC32V6mc4PRaa4Kn4i26GqY9TUb1H/PibBBmyOw9f8HJkJrk2NOjADxvvzuB+Slj149vqhG1Lpt1RpLDm74VdaJbnKtQcTHS24NrgfMGvex0nYMvnfsQzE= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785180209; h=Content-Type:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=IVtM1kLlRrBmYYke395btEBse7H966kQnPC7NNaA2Xs=; b=GXpSdWtnv1Qz3bNnhX73dd7bMhrEG7Bz3rcrjZoz+zaaVLrgl2925x8FqeiTI4MmK2vPrrWufAxCWvRH+ePr+HvousbfiydOc1YRlGRkF4abIgI05PTgTIx2qhfprb8XXcXbl5yEerkRmjaLHh02fyjvzTTzyfR/O7YYi+zdRT8= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785180209835299.984904781341; Mon, 27 Jul 2026 12:23:29 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1woQrr-00009d-Is; Mon, 27 Jul 2026 15:20:03 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQrp-00008j-Px for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:20:01 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQro-0000Mt-7Y for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:20:01 -0400 Received: from mail-wm1-f71.google.com (mail-wm1-f71.google.com [209.85.128.71]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-650-HcnD9D_OP1WO-Cljo-rtcA-1; Mon, 27 Jul 2026 15:19:57 -0400 Received: by mail-wm1-f71.google.com with SMTP id 5b1f17b1804b1-49564d4b849so13457825e9.3 for ; Mon, 27 Jul 2026 12:19:57 -0700 (PDT) Received: from redhat.com (IGLD-80-230-28-14.inter.net.il. [80.230.28.14]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496c4625161sm14010865e9.14.2026.07.27.12.19.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 12:19:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785179999; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=IVtM1kLlRrBmYYke395btEBse7H966kQnPC7NNaA2Xs=; b=LpKffoFbWawA+gM8h+mD2XN8/auRLmw+hzivjPIirblIc6VSz3i8gLB6lqAOYi4RoBgc3l wu1ZxUoavpEF2xHH0zuVmePg4U/TuA5RMdsEf0jyyQrN/s+zdCvtVTJndX0cOro3Gr5hA6 kakkJDGgngGbN3yrQii7SW4RQrw7fBU= X-MC-Unique: HcnD9D_OP1WO-Cljo-rtcA-1 X-Mimecast-MFC-AGG-ID: HcnD9D_OP1WO-Cljo-rtcA_1785179996 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1785179996; x=1785784796; darn=nongnu.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=IVtM1kLlRrBmYYke395btEBse7H966kQnPC7NNaA2Xs=; b=gvI/Zuq+rlunYBd1glxuBCjjF6VUbTqYtvmIOVawc3CiF+oC55CMf0JCDJMqn34kub cVQSgeFde/rc7tfM/Fo/g/+xxU2ToFDXafEmFfc36ZL8UXMfGO/iRTLyp3TPNMsRpBbK Fh5/+WEjEYI4w7T1Mjq0V1pNFpvJeBLi/+Y36gvVLyDzgU5OjdAB2UFcc+dSWev/hcAW bMHzNaRJhSVtvWP8/xFygJ9c/r8ZpxfDXxJzRcArUx97qkNX1kc0bh1544SYim5Dwa/m gHyBZuCmLKzGtmimQ2ITH8KTXu3NHtz5NxnLewP4WHU9dI1vSHlr8rnOUNMfBe7KmC4D MJvg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785179996; x=1785784796; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=IVtM1kLlRrBmYYke395btEBse7H966kQnPC7NNaA2Xs=; b=sn/4kcA+VGm4YXqD6+4U4bgAl4CmGa6Rya7Hr3aGlRvYvenYKZ6R//NxLQsykh1wKG DXgQ80R+ENPMUamHlBYR55I6v8qkDHMPLBeN2F6D+EgfkLSPfnnz3c3RQ7Ww/i7C9uXb nBSuHtCfB/e7oGRk6Jzn4sFu2q5F8YMEzByeURwn6wKNy9+yiWgQ7eIwPUbEwAN4g9Pe dHau3AJezCwoi+XITtAgf5iyNMSrTkAWzmUf/wzyt3NqZbxaq6imJtQWsS+NWbrhMWuW CbnO6u9vFin6Eo1bK5vuRlBOGZ0E+5Im1omMKUcW5sASSSWKxUITdvxu+rg6o3oTzW22 n/eA== X-Gm-Message-State: AOJu0YzMzj83+ZVlOaOMr2Q2xwGbeH3MlTRwb0QJHMIlGewiLdZfOq7y EcWOsIvP7M1ZdQgNfUqh1M1W7DSca4sID5yA7QmAKXU8KDwO9i49kfIaTnu44vObaSGh4a84GOd u+tcfG158nkpGSseWihY5BJdLK+7a1Ebjv2QrOUjMd/jLT/IKh/YsNCfFuihWgYrtkocVMYqQVk F2D0Q9r2r/9pBerW/PSefdkV2XyWvrooNfBA== X-Gm-Gg: AR+sD10kjn0+8zV7gj5dNzfwkfdCLtqRZ0c0KX+7ORegG+gKBZUC4kE1tZTrLw5CMNi hISl1H8p7sfA+w8uYLc/GxL5ocGH9lx7EjE47N1HXT9WGpnFcJ4dcI+nUqUjBUsacIp820kJNDg 3YJkOdxAxH/+Ecli0zxyDHP3lsqXBAeDVzkpUkbS2vHTmDfIvHsJChXqCIu/s2FkkpSpP+f74lB DkBwK3Sos/rTRM2WGxKWSDgClPoYQMLpjcAXyYZrusXsiUYK+QWNNjP4js4XIIAhTEz4uHnCLgV wYtKmlZP2+Uu3VqippUEZ+7OMj6PouffSQjcvVcvTeDIIp9E7PRFOnNyInQt64Qcei1HuFYLEDo Je99Q7IvvRL8kgVDTCI2mGA== X-Received: by 2002:a05:600c:3b86:b0:495:665d:75df with SMTP id 5b1f17b1804b1-496b5719f90mr132870685e9.23.1785179996445; Mon, 27 Jul 2026 12:19:56 -0700 (PDT) X-Received: by 2002:a05:600c:3b86:b0:495:665d:75df with SMTP id 5b1f17b1804b1-496b5719f90mr132870355e9.23.1785179995924; Mon, 27 Jul 2026 12:19:55 -0700 (PDT) Date: Mon, 27 Jul 2026 15:19:53 -0400 From: "Michael S. Tsirkin" To: qemu-devel@nongnu.org Cc: Peter Maydell , Paolo Bonzini , Fam Zheng , Greg Kurz , Feifan Qian Subject: [PULL v2 08/30] virtio-scsi: fix SCSIRequest leak on a bad request Message-ID: References: MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: X-Mailer: git-send-email 2.51.2.2891.g4157995a80.dirty X-Mutt-Fcc: =sent Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=mst@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -36 X-Spam_score: -3.7 X-Spam_bar: --- X-Spam_report: (-3.7 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-1.58, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-Zoho-Virus-Status: 1 X-Zoho-AV-Stamp: zmail-av-0.2.10.1.5.2/285.167.77 X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785180210277158500 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When virtio_scsi_handle_cmd_vq() cleans up prepared requests after a malformed element in the same batch, it drops only one reference even though virtio_scsi_handle_cmd_req_prepare() leaves each unsubmitted SCSIRequest with two references. This leaks the request and allows repeated bad batches to cause unbounded host memory growth. Add a second scsi_req_unref() and clear hba_private first. Fixes: CVE-2026-61476 Fixes: 661e32fb3c ("virtio-scsi: convert virtio_scsi_bad_req() to use virti= o_error()") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3875 Cc: Paolo Bonzini Cc: Fam Zheng Cc: Greg Kurz Reported-by: Feifan Qian Signed-off-by: Michael S. Tsirkin Message-ID: <5092cd4716e08d29731bfe85eea82a732b837ff4.1784895264.git.mst@re= dhat.com> --- include/hw/scsi/scsi.h | 1 + hw/scsi/scsi-bus.c | 7 +++++++ hw/scsi/virtio-scsi.c | 2 ++ 3 files changed, 10 insertions(+) diff --git a/include/hw/scsi/scsi.h b/include/hw/scsi/scsi.h index 5f83e58d1d..c60c6e8810 100644 --- a/include/hw/scsi/scsi.h +++ b/include/hw/scsi/scsi.h @@ -221,6 +221,7 @@ SCSIRequest *scsi_req_new(SCSIDevice *d, uint32_t tag, = uint32_t lun, int32_t scsi_req_enqueue(SCSIRequest *req); SCSIRequest *scsi_req_ref(SCSIRequest *req); void scsi_req_unref(SCSIRequest *req); +void scsi_req_unref_detach_hba(SCSIRequest *req); =20 int scsi_bus_parse_cdb(SCSIDevice *dev, SCSICommand *cmd, uint8_t *buf, size_t buf_len, void *hba_private); diff --git a/hw/scsi/scsi-bus.c b/hw/scsi/scsi-bus.c index dccb2f25b2..deb43d5560 100644 --- a/hw/scsi/scsi-bus.c +++ b/hw/scsi/scsi-bus.c @@ -1513,6 +1513,13 @@ void scsi_req_unref(SCSIRequest *req) } } =20 +void scsi_req_unref_detach_hba(SCSIRequest *req) +{ + /* Unref when the HBA frees hba_private separately (e.g. virtio_scsi_f= ree_req) */ + req->hba_private =3D NULL; + scsi_req_unref(req); +} + /* Tell the device that we finished processing this chunk of I/O. It will start the next chunk or complete the command. */ void scsi_req_continue(SCSIRequest *req) diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c index 6c73768011..bf64d1231a 100644 --- a/hw/scsi/virtio-scsi.c +++ b/hw/scsi/virtio-scsi.c @@ -931,7 +931,9 @@ static void virtio_scsi_handle_cmd_vq(VirtIOSCSI *s, Vi= rtQueue *vq) req =3D QTAILQ_FIRST(&reqs); QTAILQ_REMOVE(&reqs, req, next); defer_call_end(); + /* Drop both the ref from _prepare and the initial ref= */ scsi_req_unref(req->sreq); + scsi_req_unref_detach_hba(req->sreq); virtqueue_detach_element(req->vq, &req->elem, 0); virtio_scsi_free_req(req); } --=20 MST From nobody Mon Sep 28 02:05:28 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785180244; cv=none; d=zohomail.com; s=zohoarc; b=mBDGj2QK8FCtXwjoUGdvNDpSl9z9q+yAmenG7QUpH7hmBp4Kdxc80QatUOjsw2ricg+6J7GQWMJKTtlceul/wJED33W1qMdbxptceZioTh/XHlXugmgPIlL9MZQFpiHHyzT+fBTIWtamWx5KfD0Tq1O1OUv/VBE3XrYZ7QPpR/U= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785180244; h=Content-Type:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=ztveMvOf8dhfMuHF5jnMCpMJC+TJBMbMVVTXwok/3LQ=; b=fOyRCn3XWvtIdcGrbKLtqHFoo/dMEJaE6qhLbZ+ijNjvTN2W5FvU5paEwdy2tQzM0kRM/oATo0PaX9/GbS/whSKNGAGp/p9xyeYNXh3czq4v2MLSfn1mAp54zY4SiWxt++vZxjFppswhy1VM/NTlrBjGzr+LPk/XXH/fV1nw4cY= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785180244345590.8424307537421; Mon, 27 Jul 2026 12:24:04 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1woQrt-00009t-BF; Mon, 27 Jul 2026 15:20:05 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQrs-00009f-61 for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:20:04 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQrq-0000N6-DV for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:20:03 -0400 Received: from mail-wr1-f71.google.com (mail-wr1-f71.google.com [209.85.221.71]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-563-PErsgzd4MDGw7jDveE4F9w-1; Mon, 27 Jul 2026 15:20:00 -0400 Received: by mail-wr1-f71.google.com with SMTP id ffacd0b85a97d-47f7700ffdeso1224830f8f.2 for ; Mon, 27 Jul 2026 12:19:59 -0700 (PDT) Received: from redhat.com (IGLD-80-230-28-14.inter.net.il. [80.230.28.14]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-47f96b9abc0sm30687523f8f.32.2026.07.27.12.19.56 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 12:19:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785180001; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=ztveMvOf8dhfMuHF5jnMCpMJC+TJBMbMVVTXwok/3LQ=; b=Sl/0h0AO2J2So7YZ7GGZlv2mi8pO1kNkmx28r7jakHuFs3duA0ejArYip2qUFRs2bT1qYh IEDja5oVSqmxSxvo5IRUS6Z0EDsjb0BYEXummJvDtvbAQwGW6RitKv8gP33qDHOquD7I5M kfXsnZrKN6CQR8DGccpVUD/c4m5Sv9g= X-MC-Unique: PErsgzd4MDGw7jDveE4F9w-1 X-Mimecast-MFC-AGG-ID: PErsgzd4MDGw7jDveE4F9w_1785179999 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1785179999; x=1785784799; darn=nongnu.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=ztveMvOf8dhfMuHF5jnMCpMJC+TJBMbMVVTXwok/3LQ=; b=RTi0AJSSXqwsBHbbLYszVkqZxwQT+h95qWVJ+zCCZag+7TBkzpv9WX79F6vj6ZTTqB xZJmFzvQaS7SGjHBWoQ/pcEkOPykH0/TQeMSn5gkrg5wCpi0AOkOMBsu/pbopEXSykoI uWZ56e7/cnYTVJR5RZRywZLumIPZK9vBBC8EG6jkna+hYYbspzb35bheMxF7GYCtBoGT UaGmVl3e0JxKwUWybDjF0p2pk+SwQvtFJGWN05E8TBPJy7urIWlucey5x/9qbfFDk4d8 pHNsYpRTlCgrU6dNbR2SwWliLhWf9DIRsfZ4NY9qgg/PFXD9EFc+Zq4i97ZVVx8OiZZo quhA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785179999; x=1785784799; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=ztveMvOf8dhfMuHF5jnMCpMJC+TJBMbMVVTXwok/3LQ=; b=cKDrmkf54F45ixfTEay34GvgHT3aJQkugrABsRPh23MCN3SKWzYvGtB7Z2K7rPAih0 GO2T1HNF/zwwfNuSyDI7Wc3gH8Y3rg49tUCEYV8CrZt6g3cpg4+KYGxPEehWvhxUMqP7 XGDz8Z8eyAo/IlBvTvQNsc6vcSh3umKxuosp615kfomOQWcrcsVGJxsNgI3Y3yUYsYv9 WcfuSMSaByz6PW+HnEL71m9IN56G8u9J5Iz5ExIEkSAe5C4v2ZMX7FFT0oxjq4vsOiXX I8QgfNybL2FpkWBghMpDPZZ5QAcvtZ5e9JatT/wCDmVor+HQZWIt4XBIn4xuXcU4+gJI dE9Q== X-Gm-Message-State: AOJu0Yy+Eg+kpYBiUv0fiI7NJB6ptJwvpqgBr/W11PxUzP0lCXCfMSqH LeHPtM5lHQuQXCR+FnSUoSCALuuxiak8pVPj6YfIGMzgZmmfDYHqRudAYVyaTmbG7TWWc0/3yCy XVzSgWQkYvavcfAuV+8VzYdWmXfAhi9thjBLT33gmhZzSwICAJT3nWbThbIJ+6zJOJHnL5Gj2OJ zyeM57H0R4S4Mb5ILuUtNEKjNqfss8oceLHQ== X-Gm-Gg: AR+sD12d7NgN4HxRUuJRp/Mkfd9vsGlyfwKKH9RBXE3gm6YF3+WiAwe6fC2emuR2P2d Pf7IqL33xS1XKDOiCoCe3B7OQcHAkyobYp0QF3FQjrbdnsGrCZHX/09DZjgwBjWtMk4dm05RNoH q3ReAFX6F4MXuG77bf63bL7wVMgAspuVM+KZNTAJS+zX7ohrj4HqIXEYei5Pep2S5Hk28USUgZ1 oeIGvsOZ4ls0vQjqeYtv1GDy0Ti3X19mjnooOEIZtmmpedG/17V55+9G9syEyjM58A9QMaSaioL DAr6ZLfexnkBo7N++VSZO/QUaBrRJlpuC3/bM3JbzdLQY3YGZ6TLJj8tEEu4gm2qa2RxprSUkOo L9+HV7FHP+f8jYBCZ4MYIQg== X-Received: by 2002:a5d:584c:0:b0:47f:8866:bd6a with SMTP id ffacd0b85a97d-47f9fc9255bmr12593714f8f.19.1785179998720; Mon, 27 Jul 2026 12:19:58 -0700 (PDT) X-Received: by 2002:a5d:584c:0:b0:47f:8866:bd6a with SMTP id ffacd0b85a97d-47f9fc9255bmr12593682f8f.19.1785179998106; Mon, 27 Jul 2026 12:19:58 -0700 (PDT) Date: Mon, 27 Jul 2026 15:19:56 -0400 From: "Michael S. Tsirkin" To: qemu-devel@nongnu.org Cc: Peter Maydell , Yonggang Luo , Miku Hatsune , Philippe =?utf-8?Q?Mathieu-Daud=C3=A9?= , Zhao Liu Subject: [PULL v2 09/30] virtio-mmio: fix QUEUE_NUM_MAX Message-ID: References: MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: X-Mailer: git-send-email 2.51.2.2891.g4157995a80.dirty X-Mutt-Fcc: =sent Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=mst@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -36 X-Spam_score: -3.7 X-Spam_bar: --- X-Spam_report: (-3.7 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-1.58, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-Zoho-Virus-Status: 1 X-Zoho-AV-Stamp: zmail-av-0.2.10.1.5.2/285.167.77 X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785180246506158500 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" virtio-mmio reports VIRTQUEUE_MAX_SIZE (1024) as QUEUE_NUM_MAX for every queue, regardless of the size the device passes to virtio_add_queue(). This works by accident because QEMU mostly does not care about the ring size - the guest is the one allocating memory here. But this changes with in-order vqs where qemu is the one allocating resources. Now, specifying a larger vq than allocated causes an OOB memory access. To fix: - for new machine types, report the actual max queue size to guest - for old machine types, use a compat property to allocate 1k sized queues Fixes: 525d82e323 ("virtio: fix queue size validation against allocated max= imum") Fixes: CVE-2026-50626 Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3882 Cc: Peter Maydell Message-ID: <8715acbb9516e67e2a776cda6f9edf105343f788.1784930765.git.mst@re= dhat.com> Acked-by: Yonggang Luo Reported-by: Miku Hatsune Signed-off-by: Michael S. Tsirkin --- include/hw/virtio/virtio-bus.h | 1 + include/hw/virtio/virtio-mmio.h | 1 + hw/core/machine.c | 1 + hw/virtio/virtio-mmio.c | 7 +++---- hw/virtio/virtio.c | 11 +++++++++++ 5 files changed, 17 insertions(+), 4 deletions(-) diff --git a/include/hw/virtio/virtio-bus.h b/include/hw/virtio/virtio-bus.h index 1a2d396156..f80fd71424 100644 --- a/include/hw/virtio/virtio-bus.h +++ b/include/hw/virtio/virtio-bus.h @@ -30,6 +30,7 @@ #include "qom/object.h" =20 #define TYPE_VIRTIO_BUS "virtio-bus" +#define VIRTIO_QUEUE_SIZE_OVERRIDE "x-override-queue-size" typedef struct VirtioBusClass VirtioBusClass; typedef struct VirtioBusState VirtioBusState; DECLARE_OBJ_CHECKERS(VirtioBusState, VirtioBusClass, diff --git a/include/hw/virtio/virtio-mmio.h b/include/hw/virtio/virtio-mmi= o.h index 1644d09810..0a9069868c 100644 --- a/include/hw/virtio/virtio-mmio.h +++ b/include/hw/virtio/virtio-mmio.h @@ -69,6 +69,7 @@ struct VirtIOMMIOProxy { /* Fields only used for non-legacy (v2) devices */ uint32_t guest_features[2]; VirtIOMMIOQueue vqs[VIRTIO_QUEUE_MAX]; + uint16_t override_queue_size; }; =20 #endif diff --git a/hw/core/machine.c b/hw/core/machine.c index 805148678d..73b4d82b4a 100644 --- a/hw/core/machine.c +++ b/hw/core/machine.c @@ -41,6 +41,7 @@ #include "hw/arm/smmuv3.h" =20 GlobalProperty hw_compat_11_0[] =3D { + { "virtio-mmio", VIRTIO_QUEUE_SIZE_OVERRIDE, "1024" }, { "chardev-vc", "encoding", "cp437" }, { "tpm-crb", "cap-chunk", "off" }, { "tpm-crb", "x-allow-chunk-migration", "off" }, diff --git a/hw/virtio/virtio-mmio.c b/hw/virtio/virtio-mmio.c index 58c6d46aab..55ceaeef5f 100644 --- a/hw/virtio/virtio-mmio.c +++ b/hw/virtio/virtio-mmio.c @@ -172,10 +172,7 @@ static uint64_t virtio_mmio_read(void *opaque, hwaddr = offset, unsigned size) >> (32 * proxy->host_features_sel); } case VIRTIO_MMIO_QUEUE_NUM_MAX: - if (!virtio_queue_get_num(vdev, vdev->queue_sel)) { - return 0; - } - return VIRTQUEUE_MAX_SIZE; + return virtio_queue_get_max_num(vdev, vdev->queue_sel); case VIRTIO_MMIO_QUEUE_PFN: if (!proxy->legacy) { qemu_log_mask(LOG_GUEST_ERROR, @@ -738,6 +735,8 @@ static const Property virtio_mmio_properties[] =3D { DEFINE_PROP_BOOL("force-legacy", VirtIOMMIOProxy, legacy, true), DEFINE_PROP_BIT("ioeventfd", VirtIOMMIOProxy, flags, VIRTIO_IOMMIO_FLAG_USE_IOEVENTFD_BIT, true), + DEFINE_PROP_UINT16(VIRTIO_QUEUE_SIZE_OVERRIDE, VirtIOMMIOProxy, + override_queue_size, 0), }; =20 static void virtio_mmio_realizefn(DeviceState *d, Error **errp) diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c index 2d33622daf..cdc8ba76f1 100644 --- a/hw/virtio/virtio.c +++ b/hw/virtio/virtio.c @@ -2568,6 +2568,17 @@ VirtQueue *virtio_add_queue(VirtIODevice *vdev, int = queue_size, if (i =3D=3D VIRTIO_QUEUE_MAX || queue_size > VIRTQUEUE_MAX_SIZE) abort(); =20 + BusState *qbus =3D qdev_get_parent_bus(DEVICE(vdev)); + if (qbus && qbus->parent && + object_property_find(OBJECT(qbus->parent), VIRTIO_QUEUE_SIZE_OVERR= IDE)) { + int override =3D object_property_get_int(OBJECT(qbus->parent), + VIRTIO_QUEUE_SIZE_OVERRIDE, + &error_abort); + if (override) { + queue_size =3D override; + } + } + vdev->vq[i].vring.num =3D queue_size; vdev->vq[i].vring.num_default =3D queue_size; vdev->vq[i].vring.align =3D VIRTIO_PCI_VRING_ALIGN; --=20 MST From nobody Mon Sep 28 02:05:28 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785180091; cv=none; d=zohomail.com; s=zohoarc; b=e7+phdEQB3+X0vCwTSmP3cFfSPtvx2X0SzFDbbkGhRrnqvTRlgrftGgSCiVrVPpc+znMAy+nQZBcGkUxDkXA1RfHF3K3jFm5GfS9+AM4wI1CRetBgUjMFgF4Dv5Ng2IkHb9i1fqLZA7Q1WM2FF2MHSD1DzXKqAnsTJOfgf3kdQQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785180091; h=Content-Type:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=aQNDpvgz0cKq2YM7qNFjDFk+WeGlgzmqudnvc9cyDME=; b=fg0r3lGoJEhRMoyr/HLJGTKhInORrJrx80m71UZjzJbqvH/+GcNvQvk6TSlF1JiGiKLkcGJnDG1RcubwKKoEntHx438EuxYFSJTBRgPInuTB+Ur/zF18MZPRuHSao1gFgCrxInwuWmPYMsu4u11DtFDTqLvihP5a6wxgGDPeBao= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785180091163499.6070716827438; Mon, 27 Jul 2026 12:21:31 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1woQry-0000AR-Um; Mon, 27 Jul 2026 15:20:10 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQru-0000AF-9W for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:20:06 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQrs-0000OQ-Hn for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:20:06 -0400 Received: from mail-wm1-f72.google.com (mail-wm1-f72.google.com [209.85.128.72]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-651-ySRMCvDKP-afaofyvw8kfQ-1; Mon, 27 Jul 2026 15:20:02 -0400 Received: by mail-wm1-f72.google.com with SMTP id 5b1f17b1804b1-4955ce558d8so28960805e9.3 for ; Mon, 27 Jul 2026 12:20:02 -0700 (PDT) Received: from redhat.com (IGLD-80-230-28-14.inter.net.il. [80.230.28.14]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496c45e0424sm14774085e9.13.2026.07.27.12.19.59 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 12:19:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785180003; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=aQNDpvgz0cKq2YM7qNFjDFk+WeGlgzmqudnvc9cyDME=; b=CehgnfGT5YnwOqkd7P3sVRdO5uRakF1cLTRVxGIcR7xBWXPNhxs3IK/Z5vaLoIdMVpbmW5 qwNWn+abPYiJ7TOm+Dh1f0Xtqxq01US6H0+ECWrj+J6fEwPD3MGG/3OS1QjYlsNd7mWFPB b61MTvx8Yu85kqxSOYi9HY96AZcczP8= X-MC-Unique: ySRMCvDKP-afaofyvw8kfQ-1 X-Mimecast-MFC-AGG-ID: ySRMCvDKP-afaofyvw8kfQ_1785180001 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1785180001; x=1785784801; darn=nongnu.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=aQNDpvgz0cKq2YM7qNFjDFk+WeGlgzmqudnvc9cyDME=; b=gmqxoxOiCWz19lcufIVVUVVXHT+NEXsuIn/2+MyqpLqtubFkZfwG8bGYX0YJYvlrpZ RnH+v+qncejE2Iww/hlHKRBD4B7UQtDq8dQJ3/t/oMsL2VCzgbo2ugATsuEkvsL1q97s 3VzOPg6CgcAHBg8PZt3iH5tRFK+C5o7bYaghZlq8lOmcsfycvx8btENQHeihdfnkW8S3 VLZ8KjwwZBfItBwVbKwNxvgft+R9BVIT87dPYOgEQJYCHkSOme6k4iftDuTSdy5GfWup qLUd7vxJ4ia79Hdpd5Jkf7ONYZW9MUTuzSYnc5flczokrY+y8Y1ojHKptp/n9ZxAGRFh WVHA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785180001; x=1785784801; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=aQNDpvgz0cKq2YM7qNFjDFk+WeGlgzmqudnvc9cyDME=; b=FdGsK4NS6dLgzISCAixQO2n7hCq7lcAThCXZzYGiWInwpRlqawOv/Dw4w6wwMcKO6y 85dnxzlFeNKy7dCmF7R0NWQSauWAGL3g7r0ZNj2mNbHbPmqD9CQ13eIM/CRObGFLCHxZ PYGUJDzw55sdEntHYSIWg8TgBBwO7YLIjwJCwk4luuq4bXHPHnHyNqx2RYN4XGFJhpcH XEwaOCFN+Lk+24yAGUq/Xpp68WDT8Add6LaRWBXqAvoFxR+pj80iGTAK7BUWlnXORCeg De5UTKdZGoKPlZaUBQZlH3vqNx9aTXOwxAg9AHKac3XvAQzoE4RsBev7ju5Sx1jbzGS6 PVEw== X-Gm-Message-State: AOJu0YzerTzEcsR2OxNqnERMJdIH2fRO99ySQLwujRwlQLQpy6gh0UPS OnqhaQGfCM6xlMpksBg0MyqjSIHZdfw87MuLhQUqifnUqcdGs6dfXM7b6JU+RRRc9yb1woy5aZA eLtq9DuLYw8cmYGDdHEsVKdW3n56nW0KOjZC35uFIJNu1n5MpLItsnDpvH9U98vFEwGXs+RqWXa d9yT34XLjEFihpsZjQVtjhwbF6VOtpQumHZg== X-Gm-Gg: AR+sD12VTQBTmXLcCaIvwzJFmB8rymzpcHU0t/ljLQHgygxN0l8+Ze0wKVB0Svc5MfQ nlUduqfrSP7S7dPSY2sV3MmEiNb7I9+VgWtayl4WlPHHt2iSc3Jruda6CFlKW3s8qUAIBbej6pg /c8do25UKK17mb8WqVXoB29s6OJkSiXmJg26UEuw+MjEhyl+M8k+5b++vJCCWAblPSjJ8RwB/fg up33AEamfMxzcp90TJPsi5/cKzHTVxDVNt5NVD7r79Y3y59bnRCf08R+p9LzBrcx/iNwxWZNTAh QZ3Ys8unS14sY8W50pjWKk6BscinCPnBiFBecACW3Qstoi9MJm32CWaIpHiskmzcvNVBqIaJVnw Gr+X1WX9nxlqumQ1OdWRalw== X-Received: by 2002:a05:600c:1549:b0:495:4749:16a7 with SMTP id 5b1f17b1804b1-496b6a31b65mr123243475e9.14.1785180000878; Mon, 27 Jul 2026 12:20:00 -0700 (PDT) X-Received: by 2002:a05:600c:1549:b0:495:4749:16a7 with SMTP id 5b1f17b1804b1-496b6a31b65mr123243085e9.14.1785180000302; Mon, 27 Jul 2026 12:20:00 -0700 (PDT) Date: Mon, 27 Jul 2026 15:19:58 -0400 From: "Michael S. Tsirkin" To: qemu-devel@nongnu.org Cc: Peter Maydell , huntr bubble , Jia Jia , Miku Hatsune Subject: [PULL v2 10/30] virtio: fix queue size validation against allocated maximum Message-ID: References: MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: X-Mailer: git-send-email 2.51.2.2891.g4157995a80.dirty X-Mutt-Fcc: =sent Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=mst@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -36 X-Spam_score: -3.7 X-Spam_bar: --- X-Spam_report: (-3.7 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-1.58, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-Zoho-Virus-Status: 1 X-Zoho-AV-Stamp: zmail-av-0.2.10.1.5.2/285.167.77 X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785180091565158500 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" virtio_add_queue() allocates used_elems for num_default entries, but virtio_queue_set_num() accepts larger guest-supplied queue sizes up to VIRTQUEUE_MAX_SIZE. With VIRTIO_F_IN_ORDER, this lets the guest drive used_elems accesses past the allocation and cause out-of-bounds reads and writes. Reject queue sizes larger than num_default in virtio_queue_set_num() and mark the device broken. Fixes: e63c0ba1bc ("virtio: Add support for guest setting of queue size") Fixes: CVE-2026-50626 Cc: Peter Maydell Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3882 Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3921 Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3923 Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3613 Reported-by: huntr bubble Reported-by: Jia Jia Reported-by: Miku Hatsune Signed-off-by: Michael S. Tsirkin Message-ID: --- hw/virtio/virtio.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c index cdc8ba76f1..4a6430c31c 100644 --- a/hw/virtio/virtio.c +++ b/hw/virtio/virtio.c @@ -2418,6 +2418,11 @@ void virtio_queue_set_num(VirtIODevice *vdev, int n,= int num) num < 0) { return; } + if (num > vdev->vq[n].vring.num_default) { + virtio_error(vdev, "virtio: queue %d size %d exceeds max size %u", + n, num, vdev->vq[n].vring.num_default); + return; + } vdev->vq[n].vring.num =3D num; } =20 --=20 MST From nobody Mon Sep 28 02:05:28 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785180163; cv=none; d=zohomail.com; s=zohoarc; b=MiucSUaRJ/uNUxmoak3VSnLpHeX6fjlIzvjSN/kgHKXbAAVvBId3mAn9aZPDltAOySSBmIZdal5U0VFEaIVbnhq8X3hqJ1Q6ISQ0TalwWYAS3ERBTLGn5fjRIC+KT5zADPqztUR58nDvk3PvDLrEauF9ecZWmg5yoSA7BXoxfSw= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785180163; h=Content-Type:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=mkXR+qyvrRlYakP6hofO/xvu4cSKGYwGmHafizZSjXg=; b=DCFkrAjqhkesUomoHy/RdoqG9oo3DYibHF+ovozhNfN2RmJs8osdp1j5pzRgD21WIH8sY+aHAN5d9tlzsDw+CpUjajETV8ySzLUo+XU7qw/xh5G3rM2GwoqvFuqbbdck34vGBKoAFcfJ8NwXzDBgCi4tdD1uLBJbOVkzcDtX13E= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785180163258529.2524017237312; Mon, 27 Jul 2026 12:22:43 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1woQs0-0000BX-SK; Mon, 27 Jul 2026 15:20:12 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQrw-0000AS-3c for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:20:10 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQru-0000Oo-Hl for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:20:07 -0400 Received: from mail-wr1-f71.google.com (mail-wr1-f71.google.com [209.85.221.71]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-222-v2anLifKNqKaE-_oxGzEHg-1; Mon, 27 Jul 2026 15:20:04 -0400 Received: by mail-wr1-f71.google.com with SMTP id ffacd0b85a97d-47f6db77430so2110896f8f.0 for ; Mon, 27 Jul 2026 12:20:04 -0700 (PDT) Received: from redhat.com (IGLD-80-230-28-14.inter.net.il. [80.230.28.14]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-47f85b9a6d7sm50768176f8f.2.2026.07.27.12.20.01 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 12:20:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785180005; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=mkXR+qyvrRlYakP6hofO/xvu4cSKGYwGmHafizZSjXg=; b=ThDhtQTlxphtwcxBpDdNEVkyHgZoMuNHLP5AjLAuD+rSoRU3D1/8EN3JJAVMqdAAKcoEgH EHePLn6Y6p0s64JNl3nIKS1d/m+mTrVHJpI9AmpDNfvEL3ecRBQdmuwhuVJBJZAXCcaZki yRLJIDxJNtnWif2JH4z5or3sW9odC8c= X-MC-Unique: v2anLifKNqKaE-_oxGzEHg-1 X-Mimecast-MFC-AGG-ID: v2anLifKNqKaE-_oxGzEHg_1785180003 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1785180003; x=1785784803; darn=nongnu.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=mkXR+qyvrRlYakP6hofO/xvu4cSKGYwGmHafizZSjXg=; b=Nb2fizN+K5HiYjXEiy/vu/paOukp+mBIwmDmA+qtWA1ph1nQGgmPOJkYc+HDwlrrLT e/fwXRcvEBsJbQVNmRgHk17f1mxQI6hmw/eNqk14vBNaSdZVLxOv5k95DYhP4XlaWFBp 6Uv1gGhL7w0mJft1cXZB/EN9ItYhS9ir9u49Lyw3ohBDTlTXmjogUzdDC2WSxFqfRqAe MRFPd6ZiH6Ww53/cuc0WAGdevJER1xGw9jSLawO8afviZ65/2fXciZ1gg/Zl7gLhUWmM xoTbKr0Dfdyd9+hTQC1B5XYasYsC8IR2GbJ3QnDB+hC7JYHASaAp5Kr7Mbp1CZ+FJ+it O55g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785180003; x=1785784803; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=mkXR+qyvrRlYakP6hofO/xvu4cSKGYwGmHafizZSjXg=; b=fzJh3Dv03TvvZL7ulJ1tOo9mt4BphYCl4ENQqL0ykQOjrNGViLLWziVRBDmykSL6sG JySO8v6Fq9ua2Azyjty1skBfI153cr+9g3HqJcN1KUIJPIHAm/mKoAH9Ps2NTQJBn5jA jPAEzt40kZnvlhj98IoqNsmp4QLg2t35JRJ2lrBB1L20JVZj/PUh2k/CaqZLmQ9DM7V6 cPBY3FRCDaFFeTZ9biidpr6rtNyGWG7ZvtYZsrdCbhx5n4ipoGLZcR7KeJ1kNqXI+4SY fW6C4aAxrx/3IO3IJ4oHL2oHA+DhiRuLwQgIpNiCZlKSfAN6u/jBJzeExcnNYYGkgPWc ZRxA== X-Gm-Message-State: AOJu0YxCoD7uGXTmh9Kz6Bn8QTxnet8NOtOTmeqIG2R3bD9UjFDWORS1 8CUDJNAYyuaT3p+NCQbhbiGbCNDDc9hUbmtAIVKKqtgryS4EzuDR1O/llkfeDVV6g00CsW0MGiy 7eZs+JfWkKhrGGl193CTjJE2ck1xj+c0uhcIkmYZKLkz8xs/Sufk1RatHiCFl6Y/8+cIa6hrpNt zYOSQa+ROLRd9W70lH/5VtBXKAQzvP9Fi36A== X-Gm-Gg: AR+sD12lD1EmtwXBHFI/0MerXvQ3cAt5O2ztq7PTfywlJcVBuDUCnR7xYPJHiLdjr51 MkO7m18TGOprSGCOiXgZBulQa8Guxenk76Yw/FdMWZuU5rd2wCZ0697a7uEWnDSbHsREcyeW2mc LU8fzhx6lyOQjjeOuCwJs+fHYcGw1M66sg3PIbGn09lGxImi0GvFwGNhzx4173DKIh1upBi9rBl EiGFByeNpi7H4J2hPjAihWHIeSZsfyYtw2YUyWoet0X3GpqTyO+I7xXFY4zBLMou987A++UVOG9 HZ1CpUnsj7OP49/TOK9sNdh34g4TbeS/51TZnm3XF96EnvhrnQe1Ak3SNXJAiigUVIyaHqf4fye /R4NXxTRwjxOsA0gXhcb0QA== X-Received: by 2002:a05:6000:26d3:b0:47f:920b:7fad with SMTP id ffacd0b85a97d-47fafa9ead1mr459578f8f.51.1785180002918; Mon, 27 Jul 2026 12:20:02 -0700 (PDT) X-Received: by 2002:a05:6000:26d3:b0:47f:920b:7fad with SMTP id ffacd0b85a97d-47fafa9ead1mr459543f8f.51.1785180002351; Mon, 27 Jul 2026 12:20:02 -0700 (PDT) Date: Mon, 27 Jul 2026 15:20:00 -0400 From: "Michael S. Tsirkin" To: qemu-devel@nongnu.org Cc: Peter Maydell , Cornelia Huck Subject: [PULL v2 11/30] virtio: stop migrating num_default, validate vring.num on load Message-ID: References: MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: X-Mailer: git-send-email 2.51.2.2891.g4157995a80.dirty X-Mutt-Fcc: =sent Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=mst@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -36 X-Spam_score: -3.7 X-Spam_bar: --- X-Spam_report: (-3.7 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-1.58, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-Zoho-Virus-Status: 1 X-Zoho-AV-Stamp: zmail-av-0.2.10.1.5.2/285.167.77 X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785180163965158500 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" num_default tracks the allocation size of used_elems, set by virtio_add_queue(). Migrating it via the ringsize subsection is wrong: a migration stream (malicious or simply from a different configuration) can inflate num_default so that virtio_queue_set_num() accepts oversized values, leading to OOB access on the used_elems array. It is not even migrated consistently: a configuration with a smaller num_default could thinkably migrate and work but in the common case of num =3D=3D num_default the value is not actually sent. Stop migrating num_default: make virtio_ringsize_needed() return false so the subsection is never sent, and use VMSTATE_UNUSED to consume the field from old streams without applying it. The destination keeps its local num_default from virtio_add_queue(), which matches the actual allocation. Also validate vring.num against num_default when loading the core virtio state, rejecting streams that supply a queue size larger than the locally allocated maximum. Fixes: 46c5d0823d ("virtio: ring sizes vs. reset") Fixes: 50e5ae4dc3 ("migration/virtio: Remove simple .get/.put use") Cc: Cornelia Huck Cc: Peter Maydell Signed-off-by: Michael S. Tsirkin Message-ID: <3e6a7c403f93acc37af6a6332fdc65049ae218fb.1784894327.git.mst@re= dhat.com> --- hw/virtio/virtio.c | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c index 4a6430c31c..2766217ddd 100644 --- a/hw/virtio/virtio.c +++ b/hw/virtio/virtio.c @@ -2805,14 +2805,6 @@ static bool virtio_packed_virtqueue_needed(void *opa= que) =20 static bool virtio_ringsize_needed(void *opaque) { - VirtIODevice *vdev =3D opaque; - int i; - - for (i =3D 0; i < VIRTIO_QUEUE_MAX; i++) { - if (vdev->vq[i].vring.num !=3D vdev->vq[i].vring.num_default) { - return true; - } - } return false; } =20 @@ -2901,7 +2893,7 @@ static const VMStateDescription vmstate_ringsize =3D { .version_id =3D 1, .minimum_version_id =3D 1, .fields =3D (const VMStateField[]) { - VMSTATE_UINT32(vring.num_default, struct VirtQueue), + VMSTATE_UNUSED(sizeof(uint32_t)), VMSTATE_END_OF_LIST() } }; @@ -3581,6 +3573,12 @@ virtio_load(VirtIODevice *vdev, QEMUFile *f, int ver= sion_id) =20 for (i =3D 0; i < num; i++) { vdev->vq[i].vring.num =3D qemu_get_be32(f); + if (vdev->vq[i].vring.num > vdev->vq[i].vring.num_default) { + error_report("VQ %d vring.num %u exceeds allocated max %u", + i, vdev->vq[i].vring.num, + vdev->vq[i].vring.num_default); + return -1; + } if (k->has_variable_vring_alignment) { vdev->vq[i].vring.align =3D qemu_get_be32(f); } --=20 MST From nobody Mon Sep 28 02:05:28 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785180098; cv=none; d=zohomail.com; s=zohoarc; b=Lr9HnNkNPL/VXK3iU4+GXvMzSi6VIThpC+zZmtUAojdaFg+UlEc6P4MeQoQdsSQndFXq11zaDVdQuUaxVEUzzKuCj1pRj0tJV5vStNm2S0G7g6UhPe4lfU3w5pms29LU/j87lUiPHaKl3+4IEaFN/a0VAagYE5ZoXzmlZlutiAA= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785180098; h=Content-Type:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=2640OUuG2O/plt3Fy2X0eZtR4sI9P21G6Nt5bpP3cNo=; b=PcGrTOOcL+auHTaS1D3FlLAL1Unvvidl2/u3Xylq4Km6ND5qChY1GxzCyE5SWSA461RW4adqwZalVL6uM4gnmx8HaK95qTXNFvqJxzPANE+W4J6UigqFoJ0UBSmgrylZf2S5EicmxLftk+9eXkcYnZB1Ws+KbTaQzhOOyUfc+f8= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785180098930225.3727242233689; Mon, 27 Jul 2026 12:21:38 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1woQs0-0000BU-FP; Mon, 27 Jul 2026 15:20:12 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQry-0000Ad-Hu for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:20:10 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQrw-0000PS-KW for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:20:10 -0400 Received: from mail-wm1-f69.google.com (mail-wm1-f69.google.com [209.85.128.69]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-283-Q3ys8yobO6e4WiUg-g9OTg-1; Mon, 27 Jul 2026 15:20:06 -0400 Received: by mail-wm1-f69.google.com with SMTP id 5b1f17b1804b1-4955843c6cdso34159605e9.1 for ; Mon, 27 Jul 2026 12:20:06 -0700 (PDT) Received: from redhat.com (IGLD-80-230-28-14.inter.net.il. [80.230.28.14]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496c44af19bsm15066965e9.3.2026.07.27.12.20.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 12:20:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785180008; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=2640OUuG2O/plt3Fy2X0eZtR4sI9P21G6Nt5bpP3cNo=; b=LkILwRjIliqJ6ldphcd4JlmZjYOi/ljnTtjaDt8mgY7Ql8boUGhv3UPJOnBkQBjtbetz2S Xf0JZiNOYQcr1EE183/IU7M9E/QfmOYRIJxICuSvOvvkDCAR2KWFB7KhRNH8P88rpubqUM u89LPnHaSDSBkkJSBrXQMsXtgtOfq6A= X-MC-Unique: Q3ys8yobO6e4WiUg-g9OTg-1 X-Mimecast-MFC-AGG-ID: Q3ys8yobO6e4WiUg-g9OTg_1785180005 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1785180005; x=1785784805; darn=nongnu.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=2640OUuG2O/plt3Fy2X0eZtR4sI9P21G6Nt5bpP3cNo=; b=E5SsLQdY27U4R6KD6T1c0tAym4v+dHRD4Lns+hcVWNK3nAgndNJMKZMttQvJ8d1Ysp B/OwZ/I5Z4tbKqerLCMpcGWtVUIGsbb0ZCu6wJJAt8CqOW89sGTRxnlDXmcD6tvRemQU M433PBFLDqLdut780+eZOJEEiKeCtYUbSXlWJHTKz22pTIcQGmn2IOQ4BqnO+AEwehjc qCzO5uFTZ9GT7S3OxZDOVhRNKOLF3gPfDWqCvD1r37f57kIs+iXjnsImyYvxyaPfBqE/ y7rvMVAVD5Ka38onjcqSU2/RT9woonN3wHpqaJYURG7avXKVCr+9wFvUm/ziNETy0nbH m/pw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785180005; x=1785784805; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=2640OUuG2O/plt3Fy2X0eZtR4sI9P21G6Nt5bpP3cNo=; b=CE6qHwj+KrHhTV5EJiLPcLps0bGsZO3MDk5ND9ASy2CVnyByZ7KH09yhRyfb5u0i6t X3UHTQaT1Nmujha0qQjI5VLttX9ZpJITgvmVdNuknmseyaq9kcOwn3uD3/s8QbDywVAF fZMv0ChpCTaIshBofSkPjVYvu1mQ7rYf1evzXfjtf3iCMxUfswP/FOWEHkvbxiUvazAG Pa4k3uTyZGtwQRqCYpwXQ0kPNcxAgB5CkQ9KxWq0tf7JwJKfgEgqlDI9G4qTBlBvtk5V AS1lNDJM/cm8EtyxB3qfmZBOSMOwhP7J0CsrGWeGjm/UGpuaryl1BWuuPLDTS3BHwu0T /hJA== X-Gm-Message-State: AOJu0YwpFg/hT5iqqydwNsx6gmL7UDeKNcUdKIycJgp2nBq25EqRSpTz UDJHtvVy+JgJ6KwniI2qUaDz/S4AVwkNygX1+4fbwYS5bbqDuVsw05isB0DasKFbtfnq2PFZSLm gi9xVUDWDm3IYhcy5onbDx4mtBiC1L2MzawAOMOjCVhV1DGPb55jUAjNQ9DXTTpK4MJTIdRCpIE 8XGtn+MTsoIVRxZg+EWZ9EBba3nsq+iYuQEQ== X-Gm-Gg: AR+sD10B+RXLkrUY5QWACH7GQh6FYdiHPBE1/RhFYqKoOkTXk+yfTX4PE9y8O4eUXpX w+nqVW7jU1UXoUs84kVy4FpYxfCNZV92NNcHGGv6DYMttMuEFB15+WopX+Wfsj9oCmQ2XWStYHe 1K9jRRPrh6xr/fQju39nJRI0VtIT84Gl7fjuy0XSfkvkCeHRHcVnUuexzQeVgU2/DZ70okd47m9 E+l/9kB0GbHsU6hx2yQ3ULwTuhJ6v4RMcqE7MNP26ecGKouRc9LSYKXSKdTnEvUptwAUVV0cxo6 WM0/goFgczFpEHIBnhkUsn+0futfhf4Nc1PfEqJDEyVVPK7nVtl3xrijccsU3cY5xPKiJRnYnsz XsnDY/53+ecsoHaOenKvofA== X-Received: by 2002:a05:600c:8b47:b0:493:f176:dc69 with SMTP id 5b1f17b1804b1-496b572e886mr136574295e9.37.1785180005029; Mon, 27 Jul 2026 12:20:05 -0700 (PDT) X-Received: by 2002:a05:600c:8b47:b0:493:f176:dc69 with SMTP id 5b1f17b1804b1-496b572e886mr136573935e9.37.1785180004354; Mon, 27 Jul 2026 12:20:04 -0700 (PDT) Date: Mon, 27 Jul 2026 15:20:02 -0400 From: "Michael S. Tsirkin" To: qemu-devel@nongnu.org Cc: Peter Maydell , "Dr. David Alan Gilbert" , Feifan Qian Subject: [PULL v2 12/30] virtio: fail early on bad config_len in migration Message-ID: <665c854390e0db15ed55b985ca850c36b28b0e57.1785179875.git.mst@redhat.com> References: MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: X-Mailer: git-send-email 2.51.2.2891.g4157995a80.dirty X-Mutt-Fcc: =sent Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=mst@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -36 X-Spam_score: -3.7 X-Spam_bar: --- X-Spam_report: (-3.7 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-1.58, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-Zoho-Virus-Status: 1 X-Zoho-AV-Stamp: zmail-av-0.2.10.1.5.2/285.167.77 X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785180099717158500 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" virtio_load() attempts to load config_len bytes from the migration stream. If that's huge (e.g. 4g) this will uselessly spin beyond the end of the stream for seconds. Not nice. Check qemu_file_get_error() and bail out early, instead. Also note that config_len is int32_t but is coerced to unsigned when used. Switch it to uint32_t to make this clearer. Fixes: 2f5732e964 ("Allow mismatched virtio config-len") Cc: Dr. David Alan Gilbert Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3891 Reported-by: Feifan Qian Signed-off-by: Michael S. Tsirkin Message-ID: Reviewed-by: Dr. David Alan Gilbert --- hw/virtio/virtio.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c index 2766217ddd..979c4065b7 100644 --- a/hw/virtio/virtio.c +++ b/hw/virtio/virtio.c @@ -3505,7 +3505,7 @@ int coroutine_mixed_fn virtio_load(VirtIODevice *vdev, QEMUFile *f, int version_id) { int i, ret; - int32_t config_len; + uint32_t config_len; uint32_t num; uint32_t features; BusState *qbus =3D qdev_get_parent_bus(DEVICE(vdev)); @@ -3553,6 +3553,9 @@ virtio_load(VirtIODevice *vdev, QEMUFile *f, int vers= ion_id) qemu_get_buffer(f, vdev->config, MIN(config_len, vdev->config_len)); =20 while (config_len > vdev->config_len) { + if (qemu_file_get_error(f)) { + return -1; + } qemu_get_byte(f); config_len--; } --=20 MST From nobody Mon Sep 28 02:05:28 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785180199; cv=none; d=zohomail.com; s=zohoarc; b=MlwTMDWb7n5I33PWuakVzEkt0On1lqep1GtwAssNsWz4jcByAAFA2Jw8n60kocP+UElC8NwvuDY7sBCrwL9+DfJYKok25MaMOcY3oVwC7E88U9M+zeWq3ZWLEHKUW+M1CmlZ/r/frARugYyTWnTkkk/QWfRH12p0CLLCsZxU45g= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785180199; h=Content-Type:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=XtAeMdvTIJtWG8IGUOglMiMwR5LzmhVQBRNo6kKVl5s=; b=e7ZopzexH8hdjcUWoukBtbR+zBiBfCkevHcGcRCMhnl9R1xEjUVPMaxNaKJz2HOsPA62JYPqXoTQNDwalw73i1d9ni3cYhl774Leo7L8xamwFMWMlfAUv9OdPe+yIUpzf32inf37HWXvWFcLVbpMrtnVdgZsPhvj+8+skLxWgAk= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785180199345717.4982638282488; Mon, 27 Jul 2026 12:23:19 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1woQs1-0000BZ-3u; Mon, 27 Jul 2026 15:20:13 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQs0-0000BC-5t for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:20:12 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQry-0000Pi-KE for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:20:11 -0400 Received: from mail-wm1-f70.google.com (mail-wm1-f70.google.com [209.85.128.70]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-35-JoE9lUaBMpq9DO8hnYsgcA-1; Mon, 27 Jul 2026 15:20:08 -0400 Received: by mail-wm1-f70.google.com with SMTP id 5b1f17b1804b1-493fa6e28a7so37481405e9.1 for ; Mon, 27 Jul 2026 12:20:08 -0700 (PDT) Received: from redhat.com (IGLD-80-230-28-14.inter.net.il. [80.230.28.14]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496c44afaecsm17031125e9.2.2026.07.27.12.20.05 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 12:20:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785180009; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=XtAeMdvTIJtWG8IGUOglMiMwR5LzmhVQBRNo6kKVl5s=; b=Tajm+Ut3UBQKrgapZaIfH2k7hbvC089lXb6/mKcx1BolIY0qzGdO/H4vLP0Kh4CXPFG9+I LHDB/x7mz1bi4XnEqm+4puQutc4bVooJlG+GlwFvE95Vq6Oa/I/HCtlNeVfqPowANgSxmR s2x2Z4HxMN+mRXp6ahJpBp5JDCWRyQc= X-MC-Unique: JoE9lUaBMpq9DO8hnYsgcA-1 X-Mimecast-MFC-AGG-ID: JoE9lUaBMpq9DO8hnYsgcA_1785180007 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1785180007; x=1785784807; darn=nongnu.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=XtAeMdvTIJtWG8IGUOglMiMwR5LzmhVQBRNo6kKVl5s=; b=BTCYmSnd6F+IknvS3VE0epuNpNJJbw7L3zMpbNdyCTD69TcD9mjd+r3DDrwdfgsY9w kpeYk5ZcOG22bB+3IynWY9VBgsql7JwTo1M4gMdgEfmXcFSvDjaD/VM+w47y4BfI+daA B5V3P9mCwMmuCuv7S+tNON5U/omF8CQdKrpXS24w0PkkB/SNi2fUJo8k363SQ3jD+Hsa Of+CQrkNO16msEOaY6A8fAEXW2INFXp6fh7k1GBgzT6q66fDDQWDZweHmequRzdBVoYC vxq4EQASBWHBFz/COi/9UmsEzX46qcUpqtAvZiY8/6yuvEvGoVICowo9B/CSPR9Zbxg5 IbMw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785180007; x=1785784807; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=XtAeMdvTIJtWG8IGUOglMiMwR5LzmhVQBRNo6kKVl5s=; b=A1L1p95gzAiGmEVjgpUw/RUWJHvLMO+PQcBhiy33hLiNMY6sni8/UIrmi9ITkjzjGo QzDG5GaoiYyG0SZI/JQZ1HzswSJ2Aj5fyKr9TYk0AaddiEjoajbx5gIE27y1kpPGvYx5 smw4pov0BK0AJcPiFbGj41RYMdualj5yb/sItCxS5AY3MNX41FyvSp3e3zJU4fRPSv7g GHI4wbH3/RyEOrmeZ9sGxVm9pnlEKIbqZtXBAVmOY3Wot35XV5LMtChhuX/gveQd8/kJ WKcGiHYyYdnnDe46KUY2w0AyYF6yG59tjU/OzPMBizB0qhUD7kE/Bw3tzXd1UuQ1/EFZ I17g== X-Gm-Message-State: AOJu0YzVU/3tQHWnJpkbBH1QdxpnkTVaHvTxiE8ALaIJ8QAEeolfBjn4 AsuHd5nJVk+j4ioutORYQ8Ehl8Z6/o8NlEIIpJGaWWE4JeWWu2L7jiLxVcn7Jbbu5Q+DUhm7jhm f6jhLwZanw+GIhx+xzDRxTtsrsOgBlyBuv2dIecPzqAY88unYyB4lSLZFhJ7jNWOTF516TPVkWL s5aJanZyhO0QYs6lzfBCTLUI+AhssZtfQeJA== X-Gm-Gg: AR+sD13nlE0ZkvpBg1MP2wQngr5ur52x2PjKbwoU8ydamhB0hH3uI3ZjJG6A7wHXn2K uEFkg1tyzZN8D7oPkTnJO1acHzq7DZpxCc2BmoC70w1nOZmOwiVKSGoukpgFz42/1CDo4NCBXAh Ig92M0p31aoXhOg/T5pZS3ADvtRejkmyk2bvnmqJV480IHwCmQqBSZkT2Jk0JuO49fUtJ7ka80E gTZluep5opJmz84k1VrGRIyHE10vsYIPH0FO1v2aJxYvMdErVcQ8g++FcoIV+atcaQS8JvJM6dk MJw5KQlSNnGzULOIVo7uDaPR0nVEVfLbMLQqw1GQzmQ4H45iO4A2hnrveJnjIxEMQDXHMOWtgUm BB11FxMnL7QBeUpIlnmKXOg== X-Received: by 2002:a05:600c:210c:b0:495:4a27:483f with SMTP id 5b1f17b1804b1-496b5700419mr80573275e9.29.1785180006997; Mon, 27 Jul 2026 12:20:06 -0700 (PDT) X-Received: by 2002:a05:600c:210c:b0:495:4a27:483f with SMTP id 5b1f17b1804b1-496b5700419mr80572935e9.29.1785180006458; Mon, 27 Jul 2026 12:20:06 -0700 (PDT) Date: Mon, 27 Jul 2026 15:20:04 -0400 From: "Michael S. Tsirkin" To: qemu-devel@nongnu.org Cc: Peter Maydell , Stefano Garzarella , Raphael Norwitz , Feifan Qian Subject: [PULL v2 13/30] vhost-user: assert nregions within limit Message-ID: References: MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: X-Mailer: git-send-email 2.51.2.2891.g4157995a80.dirty X-Mutt-Fcc: =sent Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=mst@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -36 X-Spam_score: -3.7 X-Spam_bar: --- X-Spam_report: (-3.7 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-1.58, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-Zoho-Virus-Status: 1 X-Zoho-AV-Stamp: zmail-av-0.2.10.1.5.2/285.167.77 X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785180200114158500 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" scrub_shadow_regions() and vhost_user_add_remove_regions() use fixed-size stack arrays sized to VHOST_USER_MAX_RAM_SLOTS and index them with dev->mem->nregions. nregions is calculated to never overrun these, but let's add an assert to make sure we don't get a stack overflow if there's a bug. Fixes: f1aeb14b08 ("Transmit vhost-user memory regions individually") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3910 Cc: Stefano Garzarella Cc: Raphael Norwitz Reported-by: Feifan Qian Signed-off-by: Michael S. Tsirkin Message-ID: <48fb8411f67e525872fb19618a886e52b670ab7f.1784896199.git.mst@re= dhat.com> --- hw/virtio/vhost-user.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/hw/virtio/vhost-user.c b/hw/virtio/vhost-user.c index 517cc4ca71..2881cec72d 100644 --- a/hw/virtio/vhost-user.c +++ b/hw/virtio/vhost-user.c @@ -946,6 +946,9 @@ static int vhost_user_add_remove_regions(struct vhost_d= ev *dev, =20 msg->hdr.size =3D sizeof(msg->payload.mem_reg); =20 + /* Ensure nregions fits the fixed-size arrays used below. */ + assert(dev->mem->nregions <=3D VHOST_USER_MAX_RAM_SLOTS); + /* Find the regions which need to be removed or added. */ scrub_shadow_regions(dev, add_reg, &nr_add_reg, rem_reg, &nr_rem_reg, shadow_pcb, track_ramblocks); --=20 MST From nobody Mon Sep 28 02:05:28 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785180167; cv=none; d=zohomail.com; s=zohoarc; b=XwTxAUSlOCq1XCeUWxtDPSlSbSZKIqYG/T/E8BUP/O9AXDZfuoEEueOxSmFcd95ZSrBM2mgS7LvPHA5PAT7fMIzKSBpb9XK+s5D0BawDV+6mBU8Hudb81woOi/K/EHeddctkZ343S0bnxmqznT1nrDRlwj30dgotUgYPrjVE4wg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785180167; h=Content-Type:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=84hPA+8jDla3npE9ffBr07SeKPeglYRBtqwzRIySi1s=; b=cbMG7IOJkglURPuw2dMiW2jJs+MS1d23QHMKpgaBsH5s+OGr9S1BUCEQl2CqkGoV8nRbipyTC4htrJrbsft91nJwnNMZKcgBMv0L+yn7cmcXjENgZ2j/9KXmLJg7ElEo5MP1UJlAUFmIU0D+MlgZa+RtrsSksFHm1vO9WiINeE0= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785180167057760.5369114093043; Mon, 27 Jul 2026 12:22:47 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1woQs3-0000CH-06; Mon, 27 Jul 2026 15:20:15 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQs2-0000C3-7s for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:20:14 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQs0-0000Q6-FI for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:20:13 -0400 Received: from mail-wm1-f71.google.com (mail-wm1-f71.google.com [209.85.128.71]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-76-ywTFiE05ORuJz3laEVu_Cg-1; Mon, 27 Jul 2026 15:20:10 -0400 Received: by mail-wm1-f71.google.com with SMTP id 5b1f17b1804b1-4954c2d4081so22454335e9.2 for ; Mon, 27 Jul 2026 12:20:10 -0700 (PDT) Received: from redhat.com (IGLD-80-230-28-14.inter.net.il. [80.230.28.14]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496c45e0424sm14783805e9.13.2026.07.27.12.20.07 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 12:20:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785180011; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=84hPA+8jDla3npE9ffBr07SeKPeglYRBtqwzRIySi1s=; b=c2I6uF69zOcYrjtDJJjyJjrbESYiFeJwj/Vs+QZeW6xOoA470xfGRuTzGLFmwBRujsapmN 5SlOIZWBWJbkERgFmxWUo3A+ipLM0co+pUHDY9B0VWZNm/FaNTXwCZ3xxtUYGfnJYMUMvB IqIwK8K9HuxcAz7qR/wUv4oh/j8Z/48= X-MC-Unique: ywTFiE05ORuJz3laEVu_Cg-1 X-Mimecast-MFC-AGG-ID: ywTFiE05ORuJz3laEVu_Cg_1785180010 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1785180009; x=1785784809; darn=nongnu.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=84hPA+8jDla3npE9ffBr07SeKPeglYRBtqwzRIySi1s=; b=XdjjNx4KEcqFw9w6WoaSHztCkx4y9xPRBHpdCrLbzGmwFxTT8gCprBihDSQ3Fnc8dJ qvRd8tA1Vk3mCzSDJ9PNZ08cDYvLHHZT2kgDWbjsR/ge1LCZJBPhxXTqydseZCiEKlHU ac6Q+ipPM0hGlRYG3j7pizcik08OJ3rOmRFSUzecVOucZE7O7DccJfC8HppOtQQGeFdN EMEm9fE568a60boNC8VI7L8sUuEXi2GHQAK5WoEf7Rwv5MpwW8ycFqN5HV1adtIEdHgf dTpB1tSAW4TBPc0fAc+ILPxOUVHOie2I+RiG5rVnOrFWo+YrcDF4C4+kHXGuBoVLn9vq vaww== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785180009; x=1785784809; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=84hPA+8jDla3npE9ffBr07SeKPeglYRBtqwzRIySi1s=; b=pOl27PUHMW+4jMadLxx6ylQMbP2/BgV7MrbmCVPj3K9wB6RsPsBYGpMHCdUpzrbWJj +V324K4sdfMwaoFUbTP847Jxi1/vLzmFUzWPlKh4CrKUQnslh2jkkrFbCp5oGp+rmIl5 J2iy8eZHaz4UlMkW40YTNREZ5z0ufM7KxHbXqD/rfEK9sFG32CXQV5Wl3qjYK/DoJ9IQ atDVr8/M+JTQvAR/0L1aUT1HqGvI8Lx+eZgQkO4bJoqQfCIKuql+C0w53eW3qbYZMzBl 2SBaIxRgiMTqQ/aMMGxzmTdNOcfchsdqrbyHqgdIZTCdcTBPxWUziLmkxBhmkoexuvGe F2gw== X-Gm-Message-State: AOJu0YyIuBTqyuGykSZRGm9Cqfeb7o1/N7KFYDnepQ6ojfR3YwYd8KPA 8IYMQ4E4wgv9W2TXhw6v13IA5X7xq+rC+fJ6wyjMwkZwldAiAncMvvX72OGBa+lo5+fIdMJyBf2 8tN8oZr8aJGzjWdFqmAyiFlY2Nlm3tK2S0N+0PhwooUvHQhhLtVUrMiYODLeXIAtglash0RqoLH xbKCYKEmObMT8jLiO9jnZrQ6/eWFPPEI7sYQ== X-Gm-Gg: AR+sD10Y6K4hLosY8NVkjNQzy/AQLuShtTYDzQYJaq2TZh3wplfJ0zlJ/gPUuPidGas cp69u9mOYMyVH2J0KgXgtubrJ3K8ER6+dGeXgYEWP0FdgeKxjzPwuXGHj0zfmYpdWzi63sqwHfr VlJfuEH3dK223NckFxnAEmlN/faRFmt2FB2Kiv0GUMG1d2IOxSZRkovyTkB//Ekvco6/lqgfpMh pAXkVDf05MSE3D6QsDX6EY+xXCBVO68KMyuZ7W0bDiOIWP/Vf+YdbfsFzatmdHBIgnYCqalAiiV NzPvbUX0DLsfEWpOMwuN0orhnjFzfGOkrMkpu+GM8TCCD8IfwJYHclE41/t8shd25O6JFeV/Jq1 /H3JE5rwWKNNtBgizy252AA== X-Received: by 2002:a05:600c:c87:b0:495:69eb:27fe with SMTP id 5b1f17b1804b1-496b56c58bfmr113116715e9.11.1785180009223; Mon, 27 Jul 2026 12:20:09 -0700 (PDT) X-Received: by 2002:a05:600c:c87:b0:495:69eb:27fe with SMTP id 5b1f17b1804b1-496b56c58bfmr113116245e9.11.1785180008644; Mon, 27 Jul 2026 12:20:08 -0700 (PDT) Date: Mon, 27 Jul 2026 15:20:06 -0400 From: "Michael S. Tsirkin" To: qemu-devel@nongnu.org Cc: Peter Maydell , David Hildenbrand , Pankaj Gupta , Jia Jia Subject: [PULL v2 14/30] virtio-pmem: wait for flush requests on unrealize Message-ID: <5cc182ba39a3ca8ec9ba0576de9696be76dc087d.1785179875.git.mst@redhat.com> References: MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: X-Mailer: git-send-email 2.51.2.2891.g4157995a80.dirty X-Mutt-Fcc: =sent Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=mst@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -36 X-Spam_score: -3.7 X-Spam_bar: --- X-Spam_report: (-3.7 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-1.58, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-Zoho-Virus-Status: 1 X-Zoho-AV-Stamp: zmail-av-0.2.10.1.5.2/285.167.77 X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785180167993158500 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" virtio_pmem_flush submits fsync requests to the thread pool and stores a VirtIOPMEM pointer in each request. If device is deleted e.g. by hot-unplug, once these complete, done_cb can run after virtio_pmem_unrealize frees the device, causing a use-after-free. Track in-flight requests and wait in virtio_pmem_unrealize until their completions finish before tearing the device down. Fixes: CVE-2026-63323 Fixes: 5f503cd9f3 ("virtio-pmem: add virtio device") Cc: David Hildenbrand Cc: Pankaj Gupta Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3938 Reported-by: Jia Jia Signed-off-by: Michael S. Tsirkin Message-ID: <417b6685f37ce818c660ca3c84945992f5c30dcf.1784894206.git.mst@re= dhat.com> --- include/hw/virtio/virtio-pmem.h | 1 + hw/virtio/virtio-pmem.c | 17 +++++++++++++++-- 2 files changed, 16 insertions(+), 2 deletions(-) diff --git a/include/hw/virtio/virtio-pmem.h b/include/hw/virtio/virtio-pme= m.h index 9cce600d0b..bb959d10cf 100644 --- a/include/hw/virtio/virtio-pmem.h +++ b/include/hw/virtio/virtio-pmem.h @@ -32,6 +32,7 @@ struct VirtIOPMEM { VirtQueue *rq_vq; uint64_t start; HostMemoryBackend *memdev; + unsigned int inflight; }; =20 struct VirtIOPMEMClass { diff --git a/hw/virtio/virtio-pmem.c b/hw/virtio/virtio-pmem.c index c3b3299c9c..6f7271c140 100644 --- a/hw/virtio/virtio-pmem.c +++ b/hw/virtio/virtio-pmem.c @@ -23,6 +23,7 @@ #include "standard-headers/linux/virtio_pmem.h" #include "system/hostmem.h" #include "block/thread-pool.h" +#include "qemu/aio-wait.h" #include "trace.h" =20 typedef struct VirtIODeviceRequest { @@ -54,14 +55,20 @@ static int worker_cb(void *opaque) static void done_cb(void *opaque, int ret) { VirtIODeviceRequest *req_data =3D opaque; + VirtIOPMEM *pmem =3D req_data->pmem; int len =3D iov_from_buf(req_data->elem.in_sg, req_data->elem.in_num, = 0, &req_data->resp, sizeof(struct virtio_pmem_r= esp)); =20 /* Callbacks are serialized, so no need to use atomic ops. */ - virtqueue_push(req_data->pmem->rq_vq, &req_data->elem, len); - virtio_notify((VirtIODevice *)req_data->pmem, req_data->pmem->rq_vq); + virtqueue_push(pmem->rq_vq, &req_data->elem, len); + virtio_notify((VirtIODevice *)pmem, pmem->rq_vq); trace_virtio_pmem_response(); g_free(req_data); + + pmem->inflight--; + if (!pmem->inflight) { + aio_wait_kick(); + } } =20 static void virtio_pmem_flush(VirtIODevice *vdev, VirtQueue *vq) @@ -85,6 +92,7 @@ static void virtio_pmem_flush(VirtIODevice *vdev, VirtQue= ue *vq) req_data->fd =3D memory_region_get_fd(&backend->mr); req_data->pmem =3D pmem; req_data->vdev =3D vdev; + pmem->inflight++; thread_pool_submit_aio(worker_cb, req_data, done_cb, req_data); } =20 @@ -122,6 +130,7 @@ static void virtio_pmem_realize(DeviceState *dev, Error= **errp) host_memory_backend_set_mapped(pmem->memdev, true); virtio_init(vdev, VIRTIO_ID_PMEM, sizeof(struct virtio_pmem_config)); pmem->rq_vq =3D virtio_add_queue(vdev, 128, virtio_pmem_flush); + pmem->inflight =3D 1; } =20 static void virtio_pmem_unrealize(DeviceState *dev) @@ -129,6 +138,10 @@ static void virtio_pmem_unrealize(DeviceState *dev) VirtIODevice *vdev =3D VIRTIO_DEVICE(dev); VirtIOPMEM *pmem =3D VIRTIO_PMEM(dev); =20 + /* Release the device's own reference and wait for in-flight flushes */ + pmem->inflight--; + AIO_WAIT_WHILE(NULL, pmem->inflight > 0); + host_memory_backend_set_mapped(pmem->memdev, false); virtio_delete_queue(pmem->rq_vq); virtio_cleanup(vdev); --=20 MST From nobody Mon Sep 28 02:05:28 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785180245; cv=none; d=zohomail.com; s=zohoarc; b=cFsPZF/wPqyIpDr9/YsMCLOqaDj3ctcvMPliM1rMPGVDNKq3cueOJTOkwA1bZ43yGFg2AG0r1CC+zq17Zbwpt96U824Hbdj4Ha0G5+AnQv9/T6jOebH79LXlZcv3ATyBdmebfdzsUmiPsEheonAFOSxMmBQmGSzkqRy1D/u7elY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785180245; h=Content-Type:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=DrMWxqQkZCCLjgvL4EhAZA9LLZrvR9Qu3eOej5gCQYQ=; b=f6tRQyxHUyYfV21jxBmsmwom9hvkPCnp4GEQSirx55ohyrOGfFVar5j1HX3IEHVgY4Yt9ytzM0SqOt7Vuum3OpQ3Q8CNJ9PxHrpcZmNVo4wXfY189u//mhihRPM7iE6fC+Lmwim853WOVkwD60Znv09Fvmx7f2ldWBGDXwfuxGw= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785180245094847.2528279431915; Mon, 27 Jul 2026 12:24:05 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1woQsI-0000Kp-35; Mon, 27 Jul 2026 15:20:30 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQsF-0000Gx-OX for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:20:27 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQsE-0000ca-2B for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:20:27 -0400 Received: from mail-wm1-f69.google.com (mail-wm1-f69.google.com [209.85.128.69]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-568--hXP05yxMheJA0REtkljiQ-1; Mon, 27 Jul 2026 15:20:17 -0400 Received: by mail-wm1-f69.google.com with SMTP id 5b1f17b1804b1-4956c1655c3so14807285e9.0 for ; Mon, 27 Jul 2026 12:20:13 -0700 (PDT) Received: from redhat.com (IGLD-80-230-28-14.inter.net.il. [80.230.28.14]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496c45bb2e7sm14770675e9.7.2026.07.27.12.20.09 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 12:20:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785180025; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=DrMWxqQkZCCLjgvL4EhAZA9LLZrvR9Qu3eOej5gCQYQ=; b=dzfpFdmO3icl6SrASGUipYY18rEyWugoa37xsYCfRbDsiJhJ3Ss8D7TFo4/dlBeWBNi/3e BZJ50lGqVbJ/Kq8DD8x518B8Ekfch5n2dIAT2nA271QVCxL0i86BrdVCs4TM6XncOWq97f mi1XNqEDHY72mtmOSTvK+81RuVNBwqg= X-MC-Unique: -hXP05yxMheJA0REtkljiQ-1 X-Mimecast-MFC-AGG-ID: -hXP05yxMheJA0REtkljiQ_1785180012 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1785180011; x=1785784811; darn=nongnu.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=DrMWxqQkZCCLjgvL4EhAZA9LLZrvR9Qu3eOej5gCQYQ=; b=RI7ZU+B9r8o3s2mmisKjgsI3gAMn2Fs7GOL00Qz9zJyaAd6ruP7I+zBfst8olYdQ9P Fj98ZPpQqSTXXU9DExn9aiDcjzaXd20yK+ps7R7h1JaGPKC4OOs56nhGOFsGhSliomzt KTEHhmdpIhq4Qpbep9TZ6Y+45POe4uRYNJ5T30XB9Az6nUMqfb8G/yQZB3VGFMvuJvs2 G0NboTsb6+RA1/X6D/K19qLXXt9Fb9ATcacZQ8XZ2wXqv01rwlKr2SKFpcrU5Wv3cLfN gmXoJMeX4zrVU/XUcD90HQe5wC93WR8IYMvHVRsILTU5c5mA38NxJ8Hm7zEAloLa4+JO gljg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785180011; x=1785784811; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=DrMWxqQkZCCLjgvL4EhAZA9LLZrvR9Qu3eOej5gCQYQ=; b=h1530Xwrs65TJe0RK5uVdTTugwpOnxqW+tsFQje0c7eADaHq4haX3E0TLbkoN+Xmwy XXq8MCmO1jJUbQWeU8Pxu5m1eKMqK+PLzYCBmfjc/CqvTKrS3mDEUtaqoGb/QFs/WBs+ cVem15JgBqNBjbZWvXK0ImetM5a/ZM8uyBDgx6gqfR3yBAVkPBhBYf7/uUjf9Ov/BK3Y MG0NpSy97pJh1fg+/N+MsevH5h/V5tDHVoC8WDbOGLHlnAI0VGLlKx/kE6QI1A1xtb0s 7GcsyXuUyoZAiRCks59C+J2tFgoTkDaAyUk8b2PRtCZ4JP/a7S2BCoC7dxDLyecRgYp4 ieRA== X-Gm-Message-State: AOJu0Yw6b6Em22H4vIMY6RiuS/XJF+d+YXOMPVJCWkIXSDHYgxiy0ssv 8TpSRzqxnn9P0TRo7u7HbnN3yhd12pFGP31bBF+DnWtrFiq9Jo0KrNsLbX0F5OUDoD6D+VSkDh1 UcT12jhgej5azfd1+DXYAODhL2d7NcMNJ/u9ztULEk22bKmqszpNHNTkhWxMeCtZ8TKL2Xh+TYV z2c3JGmkHkNuKsYZYK+ShUJG2HrPcbcQI7EA== X-Gm-Gg: AR+sD12kzduw825bUgCn4u7mgahQM/i94Z8DSfsOuzvTYNRUX8WGJ3WAdueX8j4TUWc OCPLxEWeVkWylrQwGK4kePX9WH8s62ilqIC8hsYAyo1EEI1hpjo7pD18Z9yMB0NFYxQy1d37y07 FspM55HxHODD+ZNk49Gv0fGJozBkiXY6gXJi79/oVH75fl5pgaWEdCv1E5W768FFp1IPvxFQEaK wT+4HlqLQc+HbOgSJvCGkbhDfwbdI9tZwGlYuuOU2GIbsNb761I+g1qpDqd2VGKY0uLafCOgKuF pSeYzC/5sqo51Lt2s9CnLmq8lGppiLjduquM30Sk3qDDnaRDxisVwh3+jsSKbp1RGyrGQ3Mb/t8 BxFc2vXQmbDofY0B8Hsp/pw== X-Received: by 2002:a05:600c:1987:b0:495:4a34:16e1 with SMTP id 5b1f17b1804b1-496c4fc231amr4102075e9.23.1785180011367; Mon, 27 Jul 2026 12:20:11 -0700 (PDT) X-Received: by 2002:a05:600c:1987:b0:495:4a34:16e1 with SMTP id 5b1f17b1804b1-496c4fc231amr4101765e9.23.1785180010837; Mon, 27 Jul 2026 12:20:10 -0700 (PDT) Date: Mon, 27 Jul 2026 15:20:08 -0400 From: "Michael S. Tsirkin" To: qemu-devel@nongnu.org Cc: Peter Maydell , Xie Yongji , Stefano Garzarella , BB CC Subject: [PULL v2 15/30] libvhost-user: validate last_batch_head in vu_check_queue_inflights Message-ID: References: MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: X-Mailer: git-send-email 2.51.2.2891.g4157995a80.dirty X-Mutt-Fcc: =sent Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=mst@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -36 X-Spam_score: -3.7 X-Spam_bar: --- X-Spam_report: (-3.7 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-1.58, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-Zoho-Virus-Status: 1 X-Zoho-AV-Stamp: zmail-av-0.2.10.1.5.2/285.167.77 X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785180246384158500 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" vu_check_queue_inflights uses last_batch_head from the frontend-controlled inflight shared memory as an index into desc[] without bounds checking. A malicious or buggy frontend can set last_batch_head >=3D desc_num, causing an out-of-bounds write. Validate last_batch_head before using it. Note: the value is not guest-accessible so not a security vulnerability. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3974 Fixes: 5f9ff1eff3 ("libvhost-user: Support tracking inflight I/O in shared = memory") Cc: Xie Yongji Cc: Stefano Garzarella Reported-by: BB CC Signed-off-by: Michael S. Tsirkin Message-Id: <8133770c75c9907578dd551f4d468140a0a75cd2.1784892981.git.mst@re= dhat.com> --- subprojects/libvhost-user/libvhost-user.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/subprojects/libvhost-user/libvhost-user.c b/subprojects/libvho= st-user/libvhost-user.c index 42a5e2f1f5..c1c13dbc90 100644 --- a/subprojects/libvhost-user/libvhost-user.c +++ b/subprojects/libvhost-user/libvhost-user.c @@ -1379,6 +1379,12 @@ vu_check_queue_inflights(VuDev *dev, VuVirtq *vq) vq->counter =3D 0; =20 if (unlikely(vq->inflight->used_idx !=3D vq->used_idx)) { + if (vq->inflight->last_batch_head >=3D vq->inflight->desc_num) { + vu_panic(dev, "vu_check_queue_inflights: last_batch_head %u " + "out of range (desc_num %u)", + vq->inflight->last_batch_head, vq->inflight->desc_num= ); + return -1; + } vq->inflight->desc[vq->inflight->last_batch_head].inflight =3D 0; =20 barrier(); --=20 MST From nobody Mon Sep 28 02:05:28 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785180222; cv=none; d=zohomail.com; s=zohoarc; b=TBtWoH0ZDMcSYrSLpKQMXDFcALnsfoSTDdTdQ6jOBCrxjXwv6QKU46qUmX6krhg40WfhDc3NWhXogAMrXEGX5yWno6JsNkhH+Thep64FeddNmtz81Ji/Jtljq77ZHgN42S+FwVcAEQvF3YiatZlXU+VTJMJw/kH8zoIeRke56jQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785180222; h=Content-Type:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=KzIhIizbscnBAXah3/DIwmRrBhiJpf/g3B5e2RRu1OM=; b=feeDZZUjQQdCdgozSYuhWZ8wkRj4vUOXiZ+pg3rnxrET/MSsFifT6nz3HtG7aNFFgI7Mw4h91UDmBAKfMzwv0VWym1T9oDFaovqh7jebuoJyEx2fMFimLF2se+O8wbJGodzeAeremg0EPiWYCiqqmw8aVj5yqCwKnEvn52y5UQU= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785180222659604.7033582033122; Mon, 27 Jul 2026 12:23:42 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1woQs8-0000D1-KQ; Mon, 27 Jul 2026 15:20:20 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQs6-0000Cc-UU for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:20:19 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQs5-0000bL-9k for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:20:18 -0400 Received: from mail-wr1-f70.google.com (mail-wr1-f70.google.com [209.85.221.70]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-515-4A9rwxc9OJSQlpV8GVoMIw-1; Mon, 27 Jul 2026 15:20:15 -0400 Received: by mail-wr1-f70.google.com with SMTP id ffacd0b85a97d-47f835ac1aeso2197412f8f.3 for ; Mon, 27 Jul 2026 12:20:14 -0700 (PDT) Received: from redhat.com (IGLD-80-230-28-14.inter.net.il. [80.230.28.14]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-47f85c532d4sm50258932f8f.22.2026.07.27.12.20.11 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 12:20:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785180016; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=KzIhIizbscnBAXah3/DIwmRrBhiJpf/g3B5e2RRu1OM=; b=WmiYFQlZOBCiqsr7yyOBT+uxFlh51vKTh+vRsMfXuTWX8rsjcesXB4JIzEQFlHyWZEGuKs wR3ynkjeFpMx+18P1pZ1XtKCQ1zdRrmenm4XG+W1GhBkyFRTXst5XbcTJC/b4XFMiqXRVl XOOH1dKl1YFqEuAUQiyX0+Ox4fdUu7E= X-MC-Unique: 4A9rwxc9OJSQlpV8GVoMIw-1 X-Mimecast-MFC-AGG-ID: 4A9rwxc9OJSQlpV8GVoMIw_1785180014 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1785180014; x=1785784814; darn=nongnu.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=KzIhIizbscnBAXah3/DIwmRrBhiJpf/g3B5e2RRu1OM=; b=MG347BwLc3QFkiCAiVCSaoSLuKDBPzOM5B8Fe7cXjNOMl3jc6PvbgR3VBW1ulbv6yn 1t2Igo7OmKDdOGC5k0LhgepXkv7Tz8pYSSyfVUnCXPY+WKJfMNU3d+hp7oFPsTSYDaLV PfDb3Nt5Tu+4vlcALuxmt6K7dBtdn15p4U2CTPEaHPLoPU9nFAO1Swm2ql+t/5QtGu6w jp9KfA2HOUckGds+kkHUrY56iLaNhn50YjlhM+vJRMbhsmOwwrXULqfpNF1BD/eVeL65 mf25ZgxBiHf81ZZ8EDfS8eTPgLtiIRsu3GrqbfufsuTAK3kRpI6Bru4SmehhqCznitQk lVqg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785180014; x=1785784814; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=KzIhIizbscnBAXah3/DIwmRrBhiJpf/g3B5e2RRu1OM=; b=Ruvh5+C4F4Kkdkrq9qrcHJY/8xHbMaRULzVUZ/Pu5DeJHvQwjnchbHWCRdzAmWj4es uuRnXGGdDAdBPX7lOjYZ+keSoZIQWcZjKfbyWcDoQwY1l6naSP4SN1MOX6Fm5sP+PnhZ CgGax1dWSPWg/MfS8fzPCyZbBwJCvGbE8BrvyLH3KT8dkT/GokL6wAWrvKyP2I/5Idpy D8wDQWU+hE3WvR3t5bx5bhGp72ls4i5yGf/2asZIMMiL9itltEictKUzgo5Luy+l4sxv J+MgdUTHv0RchQqCnhjo0Pmc/BxAQkQfRzQDneK5K3sys77CMO8u5Ac2mS1XhCqHua6M lG9g== X-Gm-Message-State: AOJu0YxEWqYHXEpddZClAXQhTEZSrouCaPA+R6MPfqaZsrwnkZUBIeci xSN2b8pPJyXY259vyvoUjQFJogPETO7bnPTgt2jazNr8s4+UZmlg+fCYoWeOCtFE+u47Oj2flr8 FVzmTilNpHUnXZKzBh5ufbmifY6gfFFXwFXL24FrxJhllWzddd3m5foaz+2LNdXAnNj/tBZIN/u 3jMAjH6SX/KBu7js4JxCfmAWgaJiB/X+ViKw== X-Gm-Gg: AR+sD10cO0jRCTPo7uaIa1wRBfcvJUJRveYb2Yg4onqtfxwhEVPcKPugF6SYfltNcOY cB+1V3rRlID/6wGeuHHwGKFXW1W7ksnyKbVLJCpFST3682/xvbWqHp0/TSf5FSnxZoCd68yqul3 FRaDYFsGWI554Cm6SLR/i2JNPm6Z+72N9qvAwoMib6gJ2eBmMiUFzOfMHo1MIFM+PmRzBoaWhmD glH45xzk82KHzRzMxAeMIzs96Iyqp2cJDPhcYHd+nE6sXmtdtdrxo/sr13YpLcpLZcmicSo4GgE qAxiLxWf/3huuKAO48i45uH+x4/rt3xyeMaPnn+vnsoQQKWwdmfTkmjhIfIbuTHtTNCBPGKpTkc JagwMEqg6lNnNpiBqx6Qm8A== X-Received: by 2002:a05:6000:2503:b0:47f:8abb:7476 with SMTP id ffacd0b85a97d-47f9fc9006dmr13219152f8f.19.1785180013526; Mon, 27 Jul 2026 12:20:13 -0700 (PDT) X-Received: by 2002:a05:6000:2503:b0:47f:8abb:7476 with SMTP id ffacd0b85a97d-47f9fc9006dmr13219106f8f.19.1785180012866; Mon, 27 Jul 2026 12:20:12 -0700 (PDT) Date: Mon, 27 Jul 2026 15:20:11 -0400 From: "Michael S. Tsirkin" To: qemu-devel@nongnu.org Cc: Peter Maydell , Xie Yongji , Stefano Garzarella , BB CC Subject: [PULL v2 16/30] libvhost-user: fix heap overflow in vu_check_queue_inflights Message-ID: References: MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: X-Mailer: git-send-email 2.51.2.2891.g4157995a80.dirty X-Mutt-Fcc: =sent Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=mst@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -36 X-Spam_score: -3.7 X-Spam_bar: --- X-Spam_report: (-3.7 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-1.58, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-Zoho-Virus-Status: 1 X-Zoho-AV-Stamp: zmail-av-0.2.10.1.5.2/285.167.77 X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785180224266158500 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" vu_check_queue_inflights counts inflight descriptors using inflight =3D=3D 1 but copies entries using inflight !=3D 0. If the inflight field contains an unexpected non-0/1 value, the function copies more entries than it allocates and overflows the heap buffer. Stop the copy pass once resubmit_num reaches the counted inuse value. Note: the value is not guest-accessible so not a security vulnerability. Fixes: CVE-2026-63110 Fixes: 5f9ff1eff3 ("libvhost-user: Support tracking inflight I/O in shared = memory") Cc: Xie Yongji Cc: Stefano Garzarella Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3974 Reported-by: BB CC Signed-off-by: Michael S. Tsirkin Message-Id: --- subprojects/libvhost-user/libvhost-user.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/subprojects/libvhost-user/libvhost-user.c b/subprojects/libvho= st-user/libvhost-user.c index c1c13dbc90..a74d814bb4 100644 --- a/subprojects/libvhost-user/libvhost-user.c +++ b/subprojects/libvhost-user/libvhost-user.c @@ -1408,6 +1408,13 @@ vu_check_queue_inflights(VuDev *dev, VuVirtq *vq) =20 for (i =3D 0; i < vq->inflight->desc_num; i++) { if (vq->inflight->desc[i].inflight) { + /* + * We earlier counted exactly vq->inuse in flight - + * what is going on? + */ + if (vq->resubmit_num >=3D vq->inuse) { + return -1; + } vq->resubmit_list[vq->resubmit_num].index =3D i; vq->resubmit_list[vq->resubmit_num].counter =3D vq->inflight->desc[i].counter; --=20 MST From nobody Mon Sep 28 02:05:28 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785180078; cv=none; d=zohomail.com; s=zohoarc; b=a1yeDj66fdBfQw1XeXJyY/cPizPfi15EautDrMBgoqGwUNw80PrmG9GeWqtCJFI/ElryjMTDWqZreQGiv7WCjdiZM9+9/9rWM4C0yc4OwcsV57MYWV22VWGnOrFDcaNSCF8wVFvMZKzb9qW8b80O+LWolOX1JNF/rcz2iIZc0wc= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785180078; h=Content-Type:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=KIzOAIfM1reEGtLuVwKSJi5MtWyPECzNtg489klcaAk=; b=NOqIS2IRXPHIz4UuIvZIQVm02qQVSgaa2lFej3GuJ7YLEQhKDsPMvyW2sSD0Z6yKfcKVKm4uNnMlZGnlSt0D0U7klq9Q+3eWec/Nf7jMz9kFZtResmF/8g22ptL7SE7lNb2mK8+LBb6qRdtcNdSrcUuzhhwYULxEu2pq1cCD5ck= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785180078467933.8065776488588; Mon, 27 Jul 2026 12:21:18 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1woQsC-0000Et-IC; Mon, 27 Jul 2026 15:20:24 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQsA-0000E6-Hw for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:20:22 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQs8-0000bh-U7 for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:20:22 -0400 Received: from mail-wr1-f70.google.com (mail-wr1-f70.google.com [209.85.221.70]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-616-ByBTP5jnOHqcW_uO1JPJCw-1; Mon, 27 Jul 2026 15:20:16 -0400 Received: by mail-wr1-f70.google.com with SMTP id ffacd0b85a97d-47407691804so2231215f8f.1 for ; Mon, 27 Jul 2026 12:20:16 -0700 (PDT) Received: from redhat.com (IGLD-80-230-28-14.inter.net.il. [80.230.28.14]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-47f864305f5sm50322446f8f.17.2026.07.27.12.20.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 12:20:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785180020; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=KIzOAIfM1reEGtLuVwKSJi5MtWyPECzNtg489klcaAk=; b=YmU59zWgqS8VrLZEgHvG4qp6tbsIQ+Ieh2zCKMcs5mmB/LDa89hBbMNTuWAsDYpuSYVkwA JUVRxrfCE1WPex70dowlmgpF6l7jGNF1mUN22CREFAyn6IIVbgBR4mMdF587J5OTNXSvZn /K4HCQ0nZTQbUF/tONfuDzpgCbKqEA0= X-MC-Unique: ByBTP5jnOHqcW_uO1JPJCw-1 X-Mimecast-MFC-AGG-ID: ByBTP5jnOHqcW_uO1JPJCw_1785180016 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1785180016; x=1785784816; darn=nongnu.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=KIzOAIfM1reEGtLuVwKSJi5MtWyPECzNtg489klcaAk=; b=GeWCE+03ESFMJmjYBU0V9jtz4xViYmqwe5WQA6B/COtEihdh8WD3admAxQbCLTnTGl aRFs3gL/GvfthtC3Yo6avw5MeTePgObSsilovzLL4Dk27BDTndLxDtRuJa8C+W08ZXrj bclRaGdb0yBHevLytUTYHjih7C3aXtI0nwh/qRuMYk0RifWsmbzSuA+pQNA9F1uwA1Hx yBIlemD4IljwObVbilRwVN3VdOxYm8MfKDMP12cIzhqWjTobQuc+iNZ105wG7Ab0wKqO drRF6PKhEyVaMXoziPk3FMCZcwt0FCVCqk8VWN/Tyxnbm9KWzKwRMPfDPLcuxkSBxLHk R8cA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785180016; x=1785784816; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=KIzOAIfM1reEGtLuVwKSJi5MtWyPECzNtg489klcaAk=; b=ZYq3xmWtCqpWN3/fYkaO6lYnXNtiPEKqOp90uy073lJgrTXp8+vfWWpSmQX5opeuw1 5uN0ggWLQ+9hY4yeJ9uravIE0NkO6EZtFZSFC6kq8sqbUKwdeohcVOwFSUqohGV5jg5T xBdRv6jGnzkfyZ40UBlIO5N40GPeN9Dl97sw4jzgnwz+jW8bctXiYywnDYnx6iPOVurk fIGOlKokVKBvGgoEr7uW09FAIjvi7TSfYvoyyA2VNAROymxsdLwJMi3/BwChAVKcFoLl a5nK4GQbTZGmeE0MnhxOcHtpGhbXgGQcgx3N63wOWd9eSZ6/gPNHEZUIQO0+LhdNVWU9 zXbQ== X-Gm-Message-State: AOJu0YwLS1jM0FYyFSn9FqTVz2Pvps7hMRSYhB2MBN+NeuX0IX0exZds OdLeewlqRZqYOJyREakmdQD/gOshz0G802RNuoqVMWrrmFyR5BNEbJCV5wO7yIdWwUEb8plTH+J TfzX8On8jbcDfNlKLzIexKJ9FItNYbcrFv2s+O19nVypS2qAXy5ifYaoOwSszf7+0Zmd2tAZpD5 nc+dSmjsivlGb2e4LHxpKjekCAF0BXeu4aUA== X-Gm-Gg: AR+sD13tCny7KhmCfM/iqouvWAMCuw78BpzaIUw7cAf95djEBtPz4/Tv+pIKEnd/UH9 smnAfKDFfFr/1fYcr6ceEjtfDJAlZkOUtoMkWQRvU/2AepqwTps39oQSbvDg62Lm9loRm71uac6 +doIu3h/rYXMdksjf6jIfT4J23CPmS2y0PVv2dzXkGR8iWzNhlu5iTAPZ5PgEw9hMrI2eusPYTT d++Wk/Gj3NR4eS2YHiJJ/XJp3+8rWZK/b4mxn8GUtbo4rrjrWypELIB0lwqqRTTvq1/L0GJlILX mQuryDhRjabtvhFr6H7LAL7RiEKC5P9QoqtX3Qk22VlQ5HXQ/IXyZspfnTu3cI7KlLY0HPqv1uD wlPNKoq8HlszXvi9B+l9Liw== X-Received: by 2002:a05:6000:220e:b0:47a:e342:373e with SMTP id ffacd0b85a97d-47fafa8d34fmr441021f8f.58.1785180015479; Mon, 27 Jul 2026 12:20:15 -0700 (PDT) X-Received: by 2002:a05:6000:220e:b0:47a:e342:373e with SMTP id ffacd0b85a97d-47fafa8d34fmr440972f8f.58.1785180014837; Mon, 27 Jul 2026 12:20:14 -0700 (PDT) Date: Mon, 27 Jul 2026 15:20:13 -0400 From: "Michael S. Tsirkin" To: qemu-devel@nongnu.org Cc: Peter Maydell , Jia Jia , Xie Yongji Subject: [PULL v2 17/30] libvduse: validate vq size Message-ID: <733a98a552e4bd68932de1f58bd6ea39b57b261c.1785179875.git.mst@redhat.com> References: MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: X-Mailer: git-send-email 2.51.2.2891.g4157995a80.dirty X-Mutt-Fcc: =sent Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=mst@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -36 X-Spam_score: -3.7 X-Spam_bar: --- X-Spam_report: (-3.7 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-1.58, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-Zoho-Virus-Status: 1 X-Zoho-AV-Stamp: zmail-av-0.2.10.1.5.2/285.167.77 X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785180079614158500 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" libvduse assumes that vq size (aka vq num) is below VIRTQUEUE_MAX_SIZE and maps logs large enough based on this assumption. However, vduse_queue_enable() accepts the vq size returned through VDUSE_VQ_GET_INFO without validation, so a value above VIRTQUEUE_MAX_SIZE (1024) overruns the inflight log and causes out-of-bounds writes in vduse_queue_inflight_get(). According to the virtio spec, vq size can only be reduced, not increased, so vq size must not exceed the previously configured max_size, but the kernel vduse module does not validate this for us, and we should not trust another process to follow the spec. Validate and reject vq size values above VIRTQUEUE_MAX_SIZE. Fixes: CVE-2026-61402 Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3652 Reported-by: Jia Jia Message-ID: Signed-off-by: Michael S. Tsirkin --- subprojects/libvduse/libvduse.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/subprojects/libvduse/libvduse.c b/subprojects/libvduse/libvdus= e.c index df9ca5e56f..712b97b4c3 100644 --- a/subprojects/libvduse/libvduse.c +++ b/subprojects/libvduse/libvduse.c @@ -902,6 +902,11 @@ static void vduse_queue_enable(VduseVirtq *vq) return; } =20 + if (vq_info.num > VIRTQUEUE_MAX_SIZE) { + fprintf(stderr, "vq[%d] vring num %u exceeds max %u\n", + vq->index, vq_info.num, VIRTQUEUE_MAX_SIZE); + return; + } vq->vring.num =3D vq_info.num; vq->vring.desc_addr =3D vq_info.desc_addr; vq->vring.avail_addr =3D vq_info.driver_addr; --=20 MST From nobody Mon Sep 28 02:05:28 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785180035; cv=none; d=zohomail.com; s=zohoarc; b=kpb6PRneGilAyCoWLPvVURDNBU7KYGI+ajUmGZwT6z7n/SmMqf6AKE7ttBMrW1o4lvUQK1HU1aSVpt1aMUQymopVDA3WI/yU47dKwYfjiC3IdyHvru+MGBHLNrkbbhP6hc+sbbPEvqDdiH0Ja5rQzRva7beUYFTLDAZuw9iMuvg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785180035; h=Content-Type:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=jZerDmu29tPHOdoZ7YzIqHXQfCFfVjQRukUAdYkaI9w=; b=YLAqM2iixqnyShHZvG6m/hFqyDzf3ZO3P0zSngFrFj3pB3oTP/triHGKbwgZeI5NYTBHqAeiREpNHu/x7zxFxccizfi9xn5h88J2Z6g68clrUTg5Le9LfEPZukS4QBZMGgUog1ZSK+hbpHh1ZgXTg3ICQiFUZEBwS4cZglUYbJY= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785180035824699.5595383645243; Mon, 27 Jul 2026 12:20:35 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1woQsC-0000Eu-JM; Mon, 27 Jul 2026 15:20:24 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQsB-0000EI-7e for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:20:23 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQs9-0000br-Bc for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:20:22 -0400 Received: from mail-wr1-f71.google.com (mail-wr1-f71.google.com [209.85.221.71]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-641-aFbPSBe4MTGJq4xGNf-BJQ-1; Mon, 27 Jul 2026 15:20:19 -0400 Received: by mail-wr1-f71.google.com with SMTP id ffacd0b85a97d-473ac08a6a4so2351873f8f.0 for ; Mon, 27 Jul 2026 12:20:19 -0700 (PDT) Received: from redhat.com (IGLD-80-230-28-14.inter.net.il. [80.230.28.14]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496c462512dsm12660045e9.13.2026.07.27.12.20.15 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 12:20:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785180020; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=jZerDmu29tPHOdoZ7YzIqHXQfCFfVjQRukUAdYkaI9w=; b=KnRuWjUumCPait73cNL2F3OK9+Em+SCW1f0TpkU06+zcV765vCn71P5wYpjiNyXYt27luV KK4FtnPpnkP57oIDXtMYiJLiMBoQ2KwIotvqI5sT/smfNnLVGKNLs0F+EMVK9yfnBSpCo6 C+xJPz94AbmJrf5f5YWs5Z1KNuaBWwQ= X-MC-Unique: aFbPSBe4MTGJq4xGNf-BJQ-1 X-Mimecast-MFC-AGG-ID: aFbPSBe4MTGJq4xGNf-BJQ_1785180018 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1785180018; x=1785784818; darn=nongnu.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=jZerDmu29tPHOdoZ7YzIqHXQfCFfVjQRukUAdYkaI9w=; b=KsgmAel20l56AKLFA08A4RgUonLNSGJMUL2tospwA6AKeNIDSiipT1a7ogk2qdZPfG 49yTRGmPkF/bKsuowy0KAUEHLVMQ8HkjvUTNlg81EszJcovUcf+U7w2XnzEOxObTq+zG RUTHHhW2M58tdCeXT/JAC+g+FKvMbVzveEXje3j4pRSoC44uzaLQsgF3ciKgm5Gb0woE 6yF7pTDGvGMVfU0ngEidKMO20bupSzj/vmPTu3ofEA3kh8j/GyvNFLOEzInNiaAkvcW8 K5qutwegXdc1SDKZM35BxHNKqpYqd7nmYLogJexx58v1f+nkG6KJm0wZpA0TSO3/vgB7 b69w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785180018; x=1785784818; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=jZerDmu29tPHOdoZ7YzIqHXQfCFfVjQRukUAdYkaI9w=; b=D1h2LnFIryXJx5N0X2+OmmQQpr5SIVyzn8j+aD+7q2249+2KD8SPTPr0WRqStPDmeN 3srCYYgJtytcNvzUi8518c4awM+EbuHz14e6fj+wgnOgVSQfWCD/HGyRYRvMBKhwfx11 FCO4ZLkz1vra7lFSnqoxYWwcJwHVDz6ZqK+ePKHzghzTQDujQNPbhMotjFRp4UJLq3pu JCiXbZsADaBd73HpgeclA9nGO8fEKHuBEczM96mMMxRisDMCKbciMf/fVzeKRo8A81Vl rSw7xO/Emdwv5LFV8UEHGVAfEC3ZBM2F3ZGNnSJyAHefnElM18af4zY0J63LFe7WG6u+ Hm/Q== X-Gm-Message-State: AOJu0YyQmwxx3jDYIXJrgWES7UqLsj0422mPLFOyz3vRY8far+b5jlZa 5WYAsFayI/q1z2baE24mPy5WlOmN5YHT9JkOr21ecsXwbpXBYYtIYmw+tkWDkJk7ePbIP+XDq1L 2PRnqWBX+hCqcrt007/nsDdMGLNxaxGL7TaNHIsRenDhj7aefQQLhSKyaCEFPe0stUo+CaI5q6t 2BW/l2Hz/Vr5e6OOdrtpa/Ec31T95SjBa/HQ== X-Gm-Gg: AR+sD12VbFQtlw5KJEhgZ5hmgRy0vAdY+XZud4t06XihLYSqHXZqzqyQWwWTRN9+I5c dYwDbVHYV1M2kDQXEzr2xR0KzOXYuEigiGdJjDpV6MENgQDuSgm1yLwnbgl6LXq9DChY3cMhdyP /DflTwIRotz7Wb335rY5lQ7GMjEafctuRJSNg3IWD0FGRO8v974ILIoeChCxIb9CcRA8xo+7CPY UFOkSuYdF0qmC0T9lU20nexhwAO6e4IBNQCpBJ4xZ2UvMDfadzw+d1cXEwANBwjao6KdBigktKV qqVaCJSiadPHKrR5bEBoJx9ysVB+oUuMclrvtwomvhMOvTe7Sjsvw0jTmGwdDNKlYzI32tfezhN WvBaJCsLtIkm8m+J1thmJSw== X-Received: by 2002:a05:600c:5492:b0:493:a966:d5b5 with SMTP id 5b1f17b1804b1-496b5b5d9f1mr138316255e9.2.1785180017880; Mon, 27 Jul 2026 12:20:17 -0700 (PDT) X-Received: by 2002:a05:600c:5492:b0:493:a966:d5b5 with SMTP id 5b1f17b1804b1-496b5b5d9f1mr138315695e9.2.1785180017202; Mon, 27 Jul 2026 12:20:17 -0700 (PDT) Date: Mon, 27 Jul 2026 15:20:15 -0400 From: "Michael S. Tsirkin" To: qemu-devel@nongnu.org Cc: Peter Maydell , Eric Auger , Jean-Philippe Brucker , Jia Jia Subject: [PULL v2 18/30] virtio-iommu: fix OOM due to unbounded call_rcu Message-ID: <67550d65b4bfdbcbfee2dae7ae1ebbbccd01dfe5.1785179875.git.mst@redhat.com> References: MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: X-Mailer: git-send-email 2.51.2.2891.g4157995a80.dirty X-Mutt-Fcc: =sent Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=mst@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -36 X-Spam_score: -3.7 X-Spam_bar: --- X-Spam_report: (-3.7 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-1.58, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-Zoho-Virus-Status: 1 X-Zoho-AV-Stamp: zmail-av-0.2.10.1.5.2/285.167.77 X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785180037706158500 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Currently, within virtio-iommu, handle_command processes the command vq without any limits on the number of entries processed. This can easily and repeatedly enable/disable multiple memory regions. Within the memory code, this causes an accumulation of an unbounded number of RCU-deferred FlatViews - each of these is supposed to be freed with call_rcu, but that never happens because the main thread never returns to the main loop. Given FlatView is big, it's easy to have this balloon out to multiple Gigabytes of memory. Limit the loop defer any remaining work to a timer. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3930 Cc: Eric Auger Cc: Jean-Philippe Brucker Reviewed-by: Eric Auger Tested-by: Eric Auger Reported-by: Jia Jia Signed-off-by: Michael S. Tsirkin Message-ID: --- include/hw/virtio/virtio-iommu.h | 1 + hw/virtio/virtio-iommu.c | 29 +++++++++++++++++++++++++++++ 2 files changed, 30 insertions(+) diff --git a/include/hw/virtio/virtio-iommu.h b/include/hw/virtio/virtio-io= mmu.h index 3b86050f2c..1f265540ad 100644 --- a/include/hw/virtio/virtio-iommu.h +++ b/include/hw/virtio/virtio-iommu.h @@ -65,6 +65,7 @@ struct VirtIOIOMMU { GTree *domains; QemuRecMutex mutex; GTree *endpoints; + QEMUTimer *cmd_timer; bool boot_bypass; Notifier machine_done; bool granule_frozen; diff --git a/hw/virtio/virtio-iommu.c b/hw/virtio/virtio-iommu.c index 08f7e8b783..533bd5073f 100644 --- a/hw/virtio/virtio-iommu.c +++ b/hw/virtio/virtio-iommu.c @@ -993,6 +993,18 @@ static int virtio_iommu_handle_probe(VirtIOIOMMU *s, return ret ? ret : virtio_iommu_probe(s, &req, buf); } =20 +static void virtio_iommu_handle_command(VirtIODevice *vdev, VirtQueue *vq); + +static void virtio_iommu_handle_command_timer(void *opaque) +{ + VirtIOIOMMU *s =3D opaque; + VirtIODevice *vdev =3D VIRTIO_DEVICE(s); + + if (virtio_device_started(vdev, vdev->status) && !vdev->broken) { + virtio_iommu_handle_command(vdev, s->req_vq); + } +} + static void virtio_iommu_handle_command(VirtIODevice *vdev, VirtQueue *vq) { VirtIOIOMMU *s =3D VIRTIO_IOMMU(vdev); @@ -1003,10 +1015,17 @@ static void virtio_iommu_handle_command(VirtIODevic= e *vdev, VirtQueue *vq) struct iovec *iov; void *buf =3D NULL; size_t sz; + unsigned int batch =3D 0; =20 for (;;) { size_t output_size =3D sizeof(tail); =20 + if (++batch > virtio_queue_get_num(vdev, virtio_get_queue_index(vq= ))) { + timer_mod(s->cmd_timer, + qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL_RT) + 1); + break; + } + elem =3D virtqueue_pop(vq, sizeof(VirtQueueElement)); if (!elem) { return; @@ -1416,6 +1435,8 @@ static void virtio_iommu_device_realize(DeviceState *= dev, Error **errp) s->req_vq =3D virtio_add_queue(vdev, VIOMMU_DEFAULT_QUEUE_SIZE, virtio_iommu_handle_command); s->event_vq =3D virtio_add_queue(vdev, VIOMMU_DEFAULT_QUEUE_SIZE, NULL= ); + s->cmd_timer =3D timer_new_ns(QEMU_CLOCK_VIRTUAL_RT, + virtio_iommu_handle_command_timer, s); =20 /* * config.bypass is needed to get initial address space early, such as @@ -1498,6 +1519,7 @@ static void virtio_iommu_device_unrealize(DeviceState= *dev) =20 qemu_rec_mutex_destroy(&s->mutex); =20 + timer_free(s->cmd_timer); virtio_delete_queue(s->req_vq); virtio_delete_queue(s->event_vq); virtio_cleanup(vdev); @@ -1509,6 +1531,8 @@ static void virtio_iommu_device_reset_exit(Object *ob= j, ResetType type) =20 trace_virtio_iommu_device_reset_exit(); =20 + timer_del(s->cmd_timer); + if (s->domains) { g_tree_destroy(s->domains); } @@ -1628,6 +1652,11 @@ static int iommu_post_load(void *opaque, int version= _id) * still correct. */ virtio_iommu_switch_address_space_all(s); + + if (virtio_device_started(VIRTIO_DEVICE(s), VIRTIO_DEVICE(s)->status))= { + timer_mod(s->cmd_timer, + qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL_RT) + 1); + } return 0; } =20 --=20 MST From nobody Mon Sep 28 02:05:28 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785180219; cv=none; d=zohomail.com; s=zohoarc; b=meNU/VYfkZo7uLCwAyIaGE3dNcn4n/6W+N6ny6xoiwMtVFmFhbVOTx0AezpVHNzKVYjA4Bl6BYd2NZKCvrUlxnW/GyL2tO2Z4CLp9NTD3Awta2JUCYBUJ+4N9YL0HoxpQO6llDyYjWWeomYjUEs34S65mEz/UESv/v/xI3Y2meo= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785180219; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=2g6MMmyPKzZozOuhiPXxtJVxbTcTWv7RFySNngDrOZ4=; b=i4NAMDkI2DgcpxdriWzbYbwGIA9wyyq+iBIBg4H1ynSDD6AC6D3nD4qFEa8QGP2r2OXyplIMYaKAsZebrtkDIHWGpfAto0xJ5d3CdJX2Sx05iKBFkVg+j9uz+xWzPihwIQxZgSU8088bStzS0ckGwnMO6mqhTqWULyP7Zo0qIiA= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 178518021951195.13217784590802; Mon, 27 Jul 2026 12:23:39 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1woQsE-0000GE-8n; Mon, 27 Jul 2026 15:20:26 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQsC-0000Ez-Qw for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:20:24 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQsB-0000c9-5u for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:20:24 -0400 Received: from mail-wm1-f72.google.com (mail-wm1-f72.google.com [209.85.128.72]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-665-RatjD4wBONqPzy4kKVq86A-1; Mon, 27 Jul 2026 15:20:21 -0400 Received: by mail-wm1-f72.google.com with SMTP id 5b1f17b1804b1-496c06ba017so1247675e9.0 for ; Mon, 27 Jul 2026 12:20:20 -0700 (PDT) Received: from redhat.com (IGLD-80-230-28-14.inter.net.il. [80.230.28.14]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496c444304esm15501925e9.0.2026.07.27.12.20.18 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 12:20:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785180022; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=2g6MMmyPKzZozOuhiPXxtJVxbTcTWv7RFySNngDrOZ4=; b=Uhxg2bP9CcIKWKUq3xa26BDKjbRvqdFYe98d7xrKjrPopTSB3e6lLp1DALY1aK6pddgtzF /CB8WW4zwL92V7x9gQ3gtijBv63fPugc3eBPPT6HBplJPCn9iEmAIjeUQKEHKdAcws/EGn oaXe7PnBpiqy1fK3a23QvtYvYtpDz7g= X-MC-Unique: RatjD4wBONqPzy4kKVq86A-1 X-Mimecast-MFC-AGG-ID: RatjD4wBONqPzy4kKVq86A_1785180020 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1785180020; x=1785784820; darn=nongnu.org; h=in-reply-to:content-transfer-encoding:content-disposition :content-type:mime-version:references:message-id:subject:cc:to:from :date:from:to:cc:subject:date:message-id:reply-to:content-type; bh=2g6MMmyPKzZozOuhiPXxtJVxbTcTWv7RFySNngDrOZ4=; b=cznLWh7brtaYz9M78iqeOXO/ihnNOxHatsOuKizRgasAnPE6Vcqbh+DwH1u51Nqqcl J7JDuZ8VYXf/LBb5BjjF8ccSWviVCTtAmBfblSQ848YIBGO179tjamqIbMslIxx3obJV /SuUifMUTrVjn60RyHq+ByXjTWvfYiUo4leFOYzsmmB/AneIMZI5SnTNXGREAQxpOxgx 0vNgsvJhSK1hiRKefQi5DC5p5nFZYhRzwIqoq677GuDBSY/fJIZFEhYpF/r34C063Uho lHO2fL35lYSq7owgtcoF2uBs/TfxVZjIkp46JaIM9lUGg1wmpxYQxM87uJS6jPxfirRw CNww== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785180020; x=1785784820; h=in-reply-to:content-transfer-encoding:content-disposition :content-type:mime-version:references:message-id:subject:cc:to:from :date:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to:content-type; bh=2g6MMmyPKzZozOuhiPXxtJVxbTcTWv7RFySNngDrOZ4=; b=DQZu3dLeeLw2FKF1Yf7iKL4KKQ42YA/qykaCffUTgZcOYUqh+o9s1IY9KzFN8xBf3F S0X0DJvaPWGz2f5xkHir1AOZoh/Cy9mkxj6C2wnpXkWiNomUDxGXxfrWwPmbY0a9Qhgm w94BE6scWP+bf/IY79EFmVsmk3Aeo87t4qgY2ZJ5DTzROIZlt4iwlQ/JR/ZUxbq2OQxH bDjnXiaYfn+Z2eRENWMr6+BqNk55jLZUmej58mITm4zlzd9gRXv3LGR+nQp9NJY2N7SN 5zbJ9qitUutU1hxJMaMziUqR3MT182f+GEaPkqgM8MJ9tcOHx4reqsg0PqWhIdtC1cbv +W1w== X-Gm-Message-State: AOJu0Yz138OURmazte4ccdbsQyEm5nSps310yJhHW9x7cz2GvnADIoai szLZYgZVqZblXe4DEvoihWUEOme8D0L6hJzn/4nPj4bOesyCfitgNaNd+oNNIWrk2SQU2wa0oBd faAKdqImBhKVYOOkrLL7ln0LeomNdNXNGMK4NZtCdiaOY7kGextf5xf8qfC3DUbUyeEE+/pIWaD aZVp+F65mkXbz6i/4j238/wkKjzy5/b9lIlA== X-Gm-Gg: AR+sD10TKAk9qaBjOq6/C5RT58lBCoVuECBi2x4ElwJNkGoO6nf+GIrm4PiZIHIw+Xk gI4bbuqU1sperJXJL6A2xW0/x55WAWBSfH8hZO7LJy6tq0F9HlCIuevbN3dQC9AQatsKbSl+gVm 0XKoPjVyyW4W4UALZNOSKIf3wmfSnjzCzvKFzoOrW4wrtRUyBz95jAEHDEkpf9Zb7Nq66fy97Yr j7Nd+xVoJTNh5fSFqWzIIMXy/RyxlFzTwen4ghMqLvOSU3/WwEMoVfDGGG194Mim+FHqoKcaxrf q+1mPu5ndC8ZIAiQgxBUcdKxArD2XVP0PP0++/UO3tF7wNBR83i4h3os7jz9cR9u2TH+ZzeAPQJ e635Rl+YqQHRuWkM4kSla2A== X-Received: by 2002:a05:600c:350e:b0:495:4f84:7280 with SMTP id 5b1f17b1804b1-496c5660694mr577295e9.4.1785180019727; Mon, 27 Jul 2026 12:20:19 -0700 (PDT) X-Received: by 2002:a05:600c:350e:b0:495:4f84:7280 with SMTP id 5b1f17b1804b1-496c5660694mr576845e9.4.1785180019291; Mon, 27 Jul 2026 12:20:19 -0700 (PDT) Date: Mon, 27 Jul 2026 15:20:17 -0400 From: "Michael S. Tsirkin" To: qemu-devel@nongnu.org Cc: Peter Maydell , Manos Pitsidianakis , Alex =?utf-8?Q?Benn=C3=A9e?= , Gerd Hoffmann Subject: [PULL v2 19/30] virtio-snd: check rx buffer descriptor size Message-ID: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Disposition: inline Content-Transfer-Encoding: quoted-printable In-Reply-To: X-Mailer: git-send-email 2.51.2.2891.g4157995a80.dirty X-Mutt-Fcc: =sent Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=mst@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -36 X-Spam_score: -3.7 X-Spam_bar: --- X-Spam_report: (-3.7 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-1.58, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-Zoho-Virus-Status: 1 X-Zoho-AV-Stamp: zmail-av-0.2.10.1.5.2/285.167.77 X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785180220406158500 From: Manos Pitsidianakis It must be at least sizeof(virtio_snd_pcm_status). I haven't verified if it's possible to get an underflow, but coverity points it out in CID 1547527 so add a check. Reviewed-by: Alex Benn=C3=A9e Signed-off-by: Manos Pitsidianakis Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin Message-ID: <20260420-virtio-fixups-v3-1-07aef1eff9d2@linaro.org> --- hw/audio/virtio-snd.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/hw/audio/virtio-snd.c b/hw/audio/virtio-snd.c index fb5cff3866..93fbcfb43f 100644 --- a/hw/audio/virtio-snd.c +++ b/hw/audio/virtio-snd.c @@ -970,12 +970,14 @@ static void virtio_snd_handle_rx_xfer(VirtIODevice *v= dev, VirtQueue *vq) } =20 stream =3D vsnd->pcm.streams[stream_id]; - if (stream =3D=3D NULL || stream->info.direction !=3D VIRTIO_SND_D= _INPUT) { + size =3D iov_size(elem->in_sg, elem->in_num); + if (stream =3D=3D NULL + || stream->info.direction !=3D VIRTIO_SND_D_INPUT + || size < sizeof(virtio_snd_pcm_status)) { goto rx_err; } + size -=3D sizeof(virtio_snd_pcm_status); WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) { - size =3D iov_size(elem->in_sg, elem->in_num) - - sizeof(virtio_snd_pcm_status); buffer =3D g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size); buffer->elem =3D elem; buffer->vq =3D vq; --=20 MST From nobody Mon Sep 28 02:05:28 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785180220; cv=none; d=zohomail.com; s=zohoarc; b=T3dLHwMGpitTXFwDkJ8JxGW2uxvUPLwpsrtn3H8VsMvpPLqBto6GJDCPs+S3yt6wnKwbPRW3PTYSvRprJqX8PN8KImwo4lO8+6xOuztUFbZYRpG+HKKJlqNYIjIhbe3Qm7svIhh9GVgW8CT5nGeusOAizZJQ9VMwCKWkBwLEDfY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785180220; h=Content-Type:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=nJ5++lDmKJE8GWzy18k6nmNQiVQ39RoIQiUYRj/hei0=; b=IQQsJcEDj4yF4nqlLw9G2JQaHOH82JI1P6nyJZWc5M+C6sGBhPxnbT06VH5xYZHlFTMoL/GQOaKPEBUJVuPXIvGm7r/+nb2doYtjY/PF9DsWWjC/eciC5Hr8NPoGbt82d214f291Wz+sHo9P1uAFpAhbiq6qdxp+UejeoQgJGuU= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785180220563412.16606230609057; Mon, 27 Jul 2026 12:23:40 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1woQsI-0000Lv-OU; Mon, 27 Jul 2026 15:20:30 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQsH-0000JJ-1m for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:20:29 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQsF-0000cq-ET for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:20:28 -0400 Received: from mail-wr1-f71.google.com (mail-wr1-f71.google.com [209.85.221.71]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-492-Vp2TEFQAP4WkdQwsILq0bg-1; Mon, 27 Jul 2026 15:20:23 -0400 Received: by mail-wr1-f71.google.com with SMTP id ffacd0b85a97d-47f83999cceso2656004f8f.3 for ; Mon, 27 Jul 2026 12:20:23 -0700 (PDT) Received: from redhat.com (IGLD-80-230-28-14.inter.net.il. [80.230.28.14]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-47f85bd850asm50550911f8f.15.2026.07.27.12.20.20 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 12:20:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785180026; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=nJ5++lDmKJE8GWzy18k6nmNQiVQ39RoIQiUYRj/hei0=; b=KJA/V+XGZdhV/dsyxH2faVlmjwjVorVl9823srq+SnOtovvcCanZVM3RlqOOjNZ1nKbFik k5QLFbHQDvbiATDV110CBjGS/t+D4uNOPKvG6s6P9wittAeyEzFeQkEZKhrMwsoxOk9wnP fOBVRl9oFhKIn6M/abjdLhOY4VIYJcU= X-MC-Unique: Vp2TEFQAP4WkdQwsILq0bg-1 X-Mimecast-MFC-AGG-ID: Vp2TEFQAP4WkdQwsILq0bg_1785180022 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1785180022; x=1785784822; darn=nongnu.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=nJ5++lDmKJE8GWzy18k6nmNQiVQ39RoIQiUYRj/hei0=; b=pjyDI2okzFChCJ3l6KNW89vuEvQdU3BqE4fWeu8xD4IJl4VVngmRN82UN4HFWf3Gvp C6cqS2Cbs57fQu7nFsRUYj13MZA64NFzTpNkyJwTd1EBqk2NEVSoTfTrMv/xcIFgiepf YxgKGpkGRsfGAcCfT3J4dUJFOUqhDxugjon2LxD6zq33/cP3FPAk9fQ2JOGTaXKBFev2 s/odSq41OG8ECUSb8HX7vZak9LO3Rh0rbTpdLVbqQ9GKR9Rt3A06pkVno5Wc6uSffzBs 8wRRrUmJmPE4m7Gs2Yis55D7mrnRJ6KFvwUyY7P4adEVyK1tgsfUAJ16fHcf/2WHoFiP UUUA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785180022; x=1785784822; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=nJ5++lDmKJE8GWzy18k6nmNQiVQ39RoIQiUYRj/hei0=; b=OUssaxBQ932nmjKfLZgni2coVAlJQ+1cKR2A3jT+fAW0JOvOHnkNSQxUeDZ+Db8nY5 l/6lC87l+9b73RcrnUVxYTqQtd3688ODZBa/STu62T9NRGPVVLdHCTen+vdQC8wnuCXF sDmmaqI74tQ5Xi5q/1XNo8EN5wHiEwrzMTTSPtn+EnTS75sBvAf1EqN4Ds5vjA7nB/mo xVJHfAFjgsbYClcZLUFGfYCHh5QjeOjPuBMDgunR4B7uixQKlC1CJy/vQ3rwuKx4pp1+ cQRd03oVhBqBPrkIwAytiLjyGeynthkQFb5uQHYi0RmRvssl0nZcD/JPZMEM0ayvdaDl 0x/w== X-Gm-Message-State: AOJu0Yy4bTQgkbUUbFZ8VV2A6S9F0B0cDAW8563RiUOGLR8ZR1iIO0yw 8Oy13EHEysk8WPeXc8OZXFTxJPbcOafkW0S4V5KIr/xpkGSSW5G5np18ok9K8hDrEplVArz6no/ IQEHCW38VE88fbt45YucSOyrvcfPeGi1qILUhrrS97XONqLl+udPJ02pT5xoGEjvUdDcd0kMnLR E9vlMmMlnGFKau3QTD3R3+7Pv60qB5wZxUVQ== X-Gm-Gg: AR+sD10+Zf6u5b/dUFIRbZwXqqJdvlo4cU767Kht4geIVdtXqLQi1JTDMPQLXlDa4n4 Wm4y+93ORutNz0ZIs60+xUd7No5tE0HK9lUXIJ0IHhdsDBQsLY3gXOP5HgEeVOzsOIGsmMZ58Ey m/FWYW4QYR+VVotvs/OTpWfkD0euRzq/Re6m5W35lU7ZuvZvSY5GIvG3r7M6Zqt84g6VYwbk+Yr qlfPaMm+uZ5OVUccackwk9SqOosgg/QJhhy8zQB3fM/HvRgn+tGEt0gpFhCp0KAHEs9IvOHpZET rwPHyOVnbUl/Pnf+npUkOU5VskRRvf+axYQyWNHN8jQ/ssZ+hSLoaYPjZ2tOD5XTDn5qVxE/xGa EWxQ/IE7Bw77p4TkgJFaX8Q== X-Received: by 2002:a05:6000:480c:b0:47f:93b6:8d08 with SMTP id ffacd0b85a97d-47f9fc99455mr12110422f8f.21.1785180022068; Mon, 27 Jul 2026 12:20:22 -0700 (PDT) X-Received: by 2002:a05:6000:480c:b0:47f:93b6:8d08 with SMTP id ffacd0b85a97d-47f9fc99455mr12110394f8f.21.1785180021497; Mon, 27 Jul 2026 12:20:21 -0700 (PDT) Date: Mon, 27 Jul 2026 15:20:19 -0400 From: "Michael S. Tsirkin" To: qemu-devel@nongnu.org Cc: Peter Maydell , Manos Pitsidianakis , Gerd Hoffmann Subject: [PULL v2 20/30] virtio-snd: check for overflow before g_malloc0 Message-ID: References: MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: X-Mailer: git-send-email 2.51.2.2891.g4157995a80.dirty X-Mutt-Fcc: =sent Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=mst@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -36 X-Spam_score: -3.7 X-Spam_bar: --- X-Spam_report: (-3.7 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-1.58, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-Zoho-Virus-Status: 1 X-Zoho-AV-Stamp: zmail-av-0.2.10.1.5.2/285.167.77 X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785180222333158500 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Manos Pitsidianakis Coverity points out one g_malloc0 overflow, but it seems to be a false positive. Add a check to it regardless to fortify the code, and also add checks for every other g_malloc0 use. Resolves: Coverity CID 1547527 Signed-off-by: Manos Pitsidianakis Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin Message-ID: <20260420-virtio-fixups-v3-2-07aef1eff9d2@linaro.org> --- hw/audio/virtio-snd.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/hw/audio/virtio-snd.c b/hw/audio/virtio-snd.c index 93fbcfb43f..694bcebb60 100644 --- a/hw/audio/virtio-snd.c +++ b/hw/audio/virtio-snd.c @@ -850,7 +850,7 @@ static void virtio_snd_handle_tx_xfer(VirtIODevice *vde= v, VirtQueue *vq) VirtIOSound *vsnd =3D VIRTIO_SND(vdev); VirtIOSoundPCMBuffer *buffer; VirtQueueElement *elem; - size_t msg_sz, size; + size_t msg_sz, size, tmp; virtio_snd_pcm_xfer hdr; uint32_t stream_id; /* @@ -880,6 +880,8 @@ static void virtio_snd_handle_tx_xfer(VirtIODevice *vde= v, VirtQueue *vq) if (msg_sz !=3D sizeof(virtio_snd_pcm_xfer)) { goto tx_err; } + assert(iov_size(elem->out_sg, elem->out_num) >=3D msg_sz); + size =3D iov_size(elem->out_sg, elem->out_num) - msg_sz; stream_id =3D le32_to_cpu(hdr.stream_id); =20 if (stream_id >=3D vsnd->snd_conf.streams @@ -892,9 +894,11 @@ static void virtio_snd_handle_tx_xfer(VirtIODevice *vd= ev, VirtQueue *vq) goto tx_err; } =20 + /* Check for g_malloc0 overflow. */ + if (!g_size_checked_add(&tmp, sizeof(VirtIOSoundPCMBuffer), size))= { + goto tx_err; + } WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) { - size =3D iov_size(elem->out_sg, elem->out_num) - msg_sz; - buffer =3D g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size); buffer->elem =3D elem; buffer->populated =3D false; @@ -932,7 +936,7 @@ static void virtio_snd_handle_rx_xfer(VirtIODevice *vde= v, VirtQueue *vq) VirtIOSound *vsnd =3D VIRTIO_SND(vdev); VirtIOSoundPCMBuffer *buffer; VirtQueueElement *elem; - size_t msg_sz, size; + size_t msg_sz, size, tmp; virtio_snd_pcm_xfer hdr; uint32_t stream_id; /* @@ -977,6 +981,10 @@ static void virtio_snd_handle_rx_xfer(VirtIODevice *vd= ev, VirtQueue *vq) goto rx_err; } size -=3D sizeof(virtio_snd_pcm_status); + /* Check for g_malloc0 overflow. */ + if (!g_size_checked_add(&tmp, sizeof(VirtIOSoundPCMBuffer), size))= { + goto rx_err; + } WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) { buffer =3D g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size); buffer->elem =3D elem; --=20 MST From nobody Mon Sep 28 02:05:28 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785180057; cv=none; d=zohomail.com; s=zohoarc; b=h8NSpzKYp6nZBnFp1Z+T16VMYJCCTnyeAVwDaz65sbeR3oFRy8JZt7AyxuNDe1iIsgtLf1MXJH8XMX9cCci9KIL7iMfuzFlW3GdeywF0Q06KAfB5Lnm2mtO3uGGiKi3pxLQyv/IiSG7IHQ9xOQKQacFdhr70Pi8PxEH/hivTUFs= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785180057; h=Content-Type:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=+eny6P5tLUQtN84z7M0HhWHftjc2+DzRoUO9tgnIanU=; b=YPbMlBNvg4P5uNWS25FkJixfSwY4O9n2zGcoJ2r96S7VInMhhn1Cv9pnI9rMkVDeHv99i6nP1LFkBX9SXWAFnYWUOZIAbQWD1koqhjWizyyA27DcS8T2VeCRukG3kni8rbgg5JO996jV5tfu+Atg/xLstT+60M9S9pUd2Viheks= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 178518005722851.548728648993915; Mon, 27 Jul 2026 12:20:57 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1woQsJ-0000PR-Sl; Mon, 27 Jul 2026 15:20:31 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQsI-0000LB-5H for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:20:30 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQsF-0000cs-Lh for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:20:29 -0400 Received: from mail-wm1-f70.google.com (mail-wm1-f70.google.com [209.85.128.70]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-563-J7g7tbBFOp6no4JI3sYBfQ-1; Mon, 27 Jul 2026 15:20:25 -0400 Received: by mail-wm1-f70.google.com with SMTP id 5b1f17b1804b1-493bfc3b84aso17328045e9.0 for ; Mon, 27 Jul 2026 12:20:25 -0700 (PDT) Received: from redhat.com (IGLD-80-230-28-14.inter.net.il. [80.230.28.14]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496c45cb960sm13504705e9.9.2026.07.27.12.20.22 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 12:20:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785180027; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=+eny6P5tLUQtN84z7M0HhWHftjc2+DzRoUO9tgnIanU=; b=PFn38BDdomAcrXoOqwSyn41DAlmF76OkepcsOcC4fwCUDY7bccSbb3OhH6PtaEavBkq0dC whgBRrzN/ibNMc9EJiLnplw5FvqfiEA7e8P7K8+DZeVibWJqFahQvA+0nPan34yOjxmu4F hQZVOuVWOCqRhTjIhwj8miraAYkmYkk= X-MC-Unique: J7g7tbBFOp6no4JI3sYBfQ-1 X-Mimecast-MFC-AGG-ID: J7g7tbBFOp6no4JI3sYBfQ_1785180024 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1785180024; x=1785784824; darn=nongnu.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=+eny6P5tLUQtN84z7M0HhWHftjc2+DzRoUO9tgnIanU=; b=cSIgxlvj5RJwIu3iGi7JVca2YrQEp4bUsfp1tInEOAx5qbppVpZFSxKV6yLb9m4fAS 8RKjowlgr2bYrgBjks7zr30P4dSNbw4AwbUYjz//IpHn5nmyCJpiZSntUs8ZesFjv5R9 OS03YNldCYN/0Sy1d0OY3Qj9C4y94Aju47xE9p08rdZCtJvMaLf7a2moxZYbOhOQs+5J iYQuBvYKQdzoZPMGfVmTP1/8dky/nlsv4BlYSXo65JCE2E8FxQ8F0DFLSbfp70lxNA/v w5pP4XfIdyXmfLjvlb8w5o9/WUR1n3WQ4jDDhJ3Dn4QhyQOPbXLN1CCXpA/69zFK47UF E94A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785180024; x=1785784824; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=+eny6P5tLUQtN84z7M0HhWHftjc2+DzRoUO9tgnIanU=; b=DsHvO6Ewzmjdude8jVLbog9u8OM1vxStXQZ3ghIRiaxoehpXFFELVQFNAhsWj+gWpb 3R9K+JgBp1WqTKlkU2BbeZ2So0zbmhf9V3YNewq5NT9bVX+1P9lSxOkFjZI9AIkkMAH0 Gk0LVDxhNipBPAPOogmyDRn8DTrGcjshvZrVHOfbPES4aRD3UXXkBhZAMFZlopEJbiwN 4Hr84AB0nhegcxYCDslkNvJIC4iSUl26ZF3ymsgCetIP6AqxnEOKcmUAcf7esR9Mo1nQ NxkWuTsLJtH9Wt7RMbblFowrMOnFSACo6TeuyiMwHI5qmI/a/MPsKmg6m8rQVQjQCxuQ HoWQ== X-Gm-Message-State: AOJu0YwSzZIgxLYHYal8/GK5qgr2B9xmCBA+zoe/LXGVWMBIM/LMCoq4 lRiJLaHdhU4FkOS/BLUxmpDbBHPN3r4QfNzd4AWG78aEv1l5zK6g/7Y1V5JVjIw3FWGB0cVlDby A1RAQbF19wXDRsgDGJoUWucneQHwfBKfj20LDQVP3Phv72JGcbio31xPRcLcsoI9Nfz/tbOT2Ly CVfIv731ldMy6lAxfoX9PqkDdl65ymSIZpKg== X-Gm-Gg: AR+sD12owjQ+JjDhU2HivBTHeDGAr9IUF6PJKDQrynNxhpJuQrXBaBcXmHoVTfjqkMy kDMlGoyk2sMb7OUfkxvnGVIyFOITeYokg3CVPPBABhAyJLxRGkt9QgDuInLB8x7OYL6bYyu0u9/ 3l6c7D/qbdGIL5Yux8jl9+b0cIkfdh4u2ml9H6/XTZrlQIRzj9rWPo0F38yxkwRlETYTGRR5qzu QvyDSZRPv1C/Wzjg4I8nAHbGAY2K8RmmD612CyySogeu08WUB+0kEgUiW9QHfylJVxTqk+yLukj RlsR7L5Ap44xrDPWSixoO/0lWQplqusfPCp5DMRjMzXp5H9RyYthz8ZGtt6cXo4SHdy0EHgqnFi Q4GI6/stb4jhtvCYZTSC4UA== X-Received: by 2002:a05:600c:c3db:10b0:495:607e:5ed6 with SMTP id 5b1f17b1804b1-496c4fd965bmr2975285e9.31.1785180024084; Mon, 27 Jul 2026 12:20:24 -0700 (PDT) X-Received: by 2002:a05:600c:c3db:10b0:495:607e:5ed6 with SMTP id 5b1f17b1804b1-496c4fd965bmr2974925e9.31.1785180023567; Mon, 27 Jul 2026 12:20:23 -0700 (PDT) Date: Mon, 27 Jul 2026 15:20:21 -0400 From: "Michael S. Tsirkin" To: qemu-devel@nongnu.org Cc: Peter Maydell , qemu-stable@nongnu.org, Michael Tokarev Subject: [PULL v2 21/30] hw/pci-host/q35.c: Always initialize smram-region even if SMM disabled Message-ID: <7ea56dcc9406b1588699e510439f782da7067d3e.1785179875.git.mst@redhat.com> References: MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: X-Mailer: git-send-email 2.51.2.2891.g4157995a80.dirty X-Mutt-Fcc: =sent Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=mst@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -36 X-Spam_score: -3.7 X-Spam_bar: --- X-Spam_report: (-3.7 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-1.58, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-Zoho-Virus-Status: 1 X-Zoho-AV-Stamp: zmail-av-0.2.10.1.5.2/285.167.77 X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785180057456158500 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Peter Maydell The MCHPCIState::smram_region looks like it ought to be SMM-specific, but it isn't, because its behaviour is "alias the PCI address space into system memory at the SMRAM_C_BASE offset", and it must be enabled for "hide SMRAM", and disabled for "show SMRAM". If the SMRAM regions are disabled, we want "hide SMRAM", so we need to initialize and place this MR. Do this in the minimal way, by moving the "bail out of realize if has_smm_ranges is false" check down below the initialization code. This fixes a bug where disabling SMM causes the VGA screen to be blank during seabios output, until the OS graphics driver is initialized. This is most obvious for accelerators which have no SMM support (e.g. NVMM, HVF, WHPX) as there smm=3Doff is the default, but you can also see it on KVM and TCG if you explicitly pass smm=3Doff: qemu-system-x86_64 -machine q35,accel=3Dkvm,smm=3Doff The early return is bug-prone, so we can refactor the code to clean it up, but this is the minimal bug fix for backports, and is what Debian used to work around this: https://salsa.debian.org/qemu-team/qemu/-/commit/6e0766f0f897dc2b75ab87dd5= 9da0d4639bb37ee Another proposed fix for this: https://patchew.org/QEMU/20260413170407.57574-1-mohamed@unpredictable.fr/ also moves an early return in mch_update-smram() and tweaks mch_update_smram() accordingly. This shouldn't be necessary, because in the no-SMM case smram_region should always be enabled and we don't want to allow the guest to make it disabled. NetBSD bug: https://gnats.NetBSD.org/59721 Cc: qemu-stable@nongnu.org Fixes: b07bf7b7 ("q35: Introduce smm_ranges property for q35-pci-host") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/2608 Reported-by: Kroese (gitlab @kroese) Signed-off-by: Peter Maydell Signed-off-by: Michael Tokarev Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin Message-ID: <20260708121011.1653365-2-peter.maydell@linaro.org> --- hw/pci-host/q35.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c index 4784b8f59b..47e726c41d 100644 --- a/hw/pci-host/q35.c +++ b/hw/pci-host/q35.c @@ -596,11 +596,14 @@ static void mch_realize(PCIDevice *d, Error **errp) PAM_EXPAN_BASE + i * PAM_EXPAN_SIZE, PAM_EXPAN_SIZE); } =20 - if (!mch->has_smm_ranges) { - return; - } - - /* if *disabled* show SMRAM to all CPUs */ + /* + * This memory region looks like it's SMM specific, but it is not. + * It's an alias that makes the pci_address_space appear in system + * memory at the SMRAM_C_BASE address. The alias is enabled when the + * CPU should not see SMRAM, and *disabled* when the low SMRAM should = be + * visible. So for non-SMM configs we need to create the alias, and + * leave it permanently enabled. + */ memory_region_init_alias(&mch->smram_region, OBJECT(mch), "smram-regio= n", mch->pci_address_space, MCH_HOST_BRIDGE_SMRAM= _C_BASE, MCH_HOST_BRIDGE_SMRAM_C_SIZE); @@ -608,6 +611,10 @@ static void mch_realize(PCIDevice *d, Error **errp) &mch->smram_region, 1); memory_region_set_enabled(&mch->smram_region, true); =20 + if (!mch->has_smm_ranges) { + return; + } + memory_region_init_alias(&mch->open_high_smram, OBJECT(mch), "smram-op= en-high", mch->ram_memory, MCH_HOST_BRIDGE_SMRAM_C_BASE, MCH_HOST_BRIDGE_SMRAM_C_SIZE); --=20 MST From nobody Mon Sep 28 02:05:28 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785180088; cv=none; d=zohomail.com; s=zohoarc; b=Miy0C/2fyQy/b8zXv0+CKGV7c+Z0mCzJvBioT91P5uAM7H9GctOFGuJmBatsTL6MwrdhPBgkBnrZNZ8U3DPSJeW/3pM6BsiwQxr4PPVAMSdUxnvQkSZ3/ha176VZjEcNYABFFtC9WDcCIRoo7qB1HQSdB4OIiQInXnnepUE8ToM= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785180088; h=Content-Type:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=myr2FfCTdeCEuGnVsWMQ9NAAavu++eEZIA6gyuM1QZg=; b=VVirlO3FzolNAg2k/y7Y/lpJynGyOOVUkZipvXFCwQ0iueOZ8uj8rSHeDIpnBHUaLA3PEijfuiUTNZa1rjHSlxrlTkell4GGxmDyl+JNrNFPvfRmzqjyUWCWCnDfta4BW2lpppEtd8+nu1hBTvoBXzH7DevbwoIDUojLhAwrEfM= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785180088592863.9599602749572; Mon, 27 Jul 2026 12:21:28 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1woQsO-0000VB-JM; Mon, 27 Jul 2026 15:20:36 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQsJ-0000Oo-6J for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:20:31 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQsH-0000dQ-FS for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:20:30 -0400 Received: from mail-wm1-f69.google.com (mail-wm1-f69.google.com [209.85.128.69]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-576-Vt1AJwZrOxyi65oU4-z5XQ-1; Mon, 27 Jul 2026 15:20:27 -0400 Received: by mail-wm1-f69.google.com with SMTP id 5b1f17b1804b1-49571407d1dso23015875e9.0 for ; Mon, 27 Jul 2026 12:20:27 -0700 (PDT) Received: from redhat.com (IGLD-80-230-28-14.inter.net.il. [80.230.28.14]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-47f85c531basm56595396f8f.19.2026.07.27.12.20.24 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 12:20:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785180028; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=myr2FfCTdeCEuGnVsWMQ9NAAavu++eEZIA6gyuM1QZg=; b=ipEyItSxPNeIS3Egzo7FdSQeKIKy9UYUCfjdLZaPvk8roGRuRtPwRzoAs3/86gfussatgM siF5WajMJPIeDnpCSdQivkf+uOdy5dkT79DqZqV/oSvZnYRPox5+M1qQmR+0zbR5+Ny4JD KBJS5gHDTcQvNsDJ5YwSBEDal5GPsek= X-MC-Unique: Vt1AJwZrOxyi65oU4-z5XQ-1 X-Mimecast-MFC-AGG-ID: Vt1AJwZrOxyi65oU4-z5XQ_1785180026 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1785180026; x=1785784826; darn=nongnu.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=myr2FfCTdeCEuGnVsWMQ9NAAavu++eEZIA6gyuM1QZg=; b=dh5GYhx97iJp7zizvJ4V6BXY0NS0D+/6nJ2iCYqP1mQnPLammf6+0lDK/xO2Ee1nxB lBb8VK3S3H6pozg9ZI1d1gFHwS6FSL1SmGjfBRxanYFEgea4Olw1etxyUPTjcVIJqiI+ KYmPjg4r/6GDarp+dr5NzHHsxbDFYyJV4Idve7w1EmRbxJMD2LizWCkDlxyZ7lA3wfI8 yRqxWBkWZkZmRtX5972OdrgblC6NFGb2VfhWJPC4OMvo7nRC5X7tQbFITrWBcBNOghjN gtRPw7SDJe7lC3eXJsbar7H34F3GwioJy0gZxGR9cI0oY//wcyzJyDO7ofs2GktsIs/K rY9g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785180026; x=1785784826; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=myr2FfCTdeCEuGnVsWMQ9NAAavu++eEZIA6gyuM1QZg=; b=L7tu4eWvmxh37TWu2FohM/GjIhO6S31osmulvZWC5L0r1lwwdxuX1ec+WHJIB+klsI I6DR0UM8qZV8w6YByh8TN14ZpQj6L/YZWxqyJcf64k4PYSORzUJJYlsq6cO356vBQMKc py95GFlaQxVJfrPIKGtmH5HPTMDnyyEfuRvGiR1hMJmfBmz3ygXWLs0OliFDgHixn1b1 bxVjLP6ZdTy1Tt00NiuxoWBe2R5yL40T2UVSUXs47lf5qhr7MYhFd1ZmEsNslEX44W32 jkoz1BReZsYBToWbR0gDlVGaipo5oohhFjxtEQKyEGNktvgYHSCvgjLSYULVGzIIMaQ7 EBaw== X-Gm-Message-State: AOJu0YySXexm0Mxd8FtMlPTv6LZrzugIKKaKt1NSmLohdcSZcpXOQwDi 63h0ZVNl8AnGlx7vQco1UbJ3pY7L22mY38O4uGq8p8pl7HTIIh5Wh/qVLs/qB+xCZvtEEhUjq9e lt1FEdBdyRgQslr5UqyW2ugSMn79yLppKDnj/WD40wE/Fc85qTsPD6Pn/aLBeT1y0NukxGB0WKP L2Lq5FggPpGExXwWm/MbeXTcgPGHoVPMv1Ig== X-Gm-Gg: AR+sD10ixoQqQv7/kKXByKm2xuViuEIvFVmKGichJPAeV4enF+apOdf8rLdp94PukXj LVqjVfHzSWFUz4FL+CzaQN0YiPwt+iXfOb2GPWPKXyg7ZVWv954DFV+/5XWpHLMdK6lJFV1lOZ0 ccTKlacXiyjn25Ck4s86C/cuGN3AuQxeze9eJj0o8/AnAWh0pKvV85unhtr6LPXa1dZeKDrJVeE Zz1igi30gt6/LVxNw/S2lMGxynXSXhirAv2mv5XONy8ui1Si+YruVDOy3caitMogFCM7vBjSdX1 i9dveEVTi/3qwJUyO20NYZCD7Hc4Sn86f2nlYo2yP+MLlhxagUge8UFaDtAjfAJ4JIrZlBD3eDY RyiuSfYO6tsssFrH7I3uyqA== X-Received: by 2002:a05:600c:1d1e:b0:495:5cda:52ec with SMTP id 5b1f17b1804b1-496c4f9ca55mr4185825e9.16.1785180026198; Mon, 27 Jul 2026 12:20:26 -0700 (PDT) X-Received: by 2002:a05:600c:1d1e:b0:495:5cda:52ec with SMTP id 5b1f17b1804b1-496c4f9ca55mr4185415e9.16.1785180025540; Mon, 27 Jul 2026 12:20:25 -0700 (PDT) Date: Mon, 27 Jul 2026 15:20:23 -0400 From: "Michael S. Tsirkin" To: qemu-devel@nongnu.org Cc: Peter Maydell , Michael Tokarev Subject: [PULL v2 22/30] hw/pci-host/q35.c: Factor out creation of SMRAM MRs Message-ID: References: MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: X-Mailer: git-send-email 2.51.2.2891.g4157995a80.dirty X-Mutt-Fcc: =sent Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=mst@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -36 X-Spam_score: -3.7 X-Spam_bar: --- X-Spam_report: (-3.7 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-1.58, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-Zoho-Virus-Status: 1 X-Zoho-AV-Stamp: zmail-av-0.2.10.1.5.2/285.167.77 X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785180089698158500 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Peter Maydell mch_realize has a large section that deals with initializing the SMRAM-specific MemoryRegions. Currently we do an early return from the realize function if mch->has_smm_ranges is false, but this has the potential for bugs if somebody adds new code at the end of the function that isn't SMM-specific. Pull the MR init code out into its own function, so we can do the smm-ranges specific handling in the realize function in a more obvious way. This commit shouldn't change behaviour at all. Signed-off-by: Peter Maydell Reviewed-by: Michael Tokarev Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin Message-ID: <20260708121011.1653365-3-peter.maydell@linaro.org> --- hw/pci-host/q35.c | 91 ++++++++++++++++++++++++----------------------- 1 file changed, 47 insertions(+), 44 deletions(-) diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c index 47e726c41d..e42b84b978 100644 --- a/hw/pci-host/q35.c +++ b/hw/pci-host/q35.c @@ -572,49 +572,9 @@ static void mch_reset(DeviceState *qdev) mch_update(mch); } =20 -static void mch_realize(PCIDevice *d, Error **errp) +static void mch_init_smram_regions(MCHPCIState *mch) { - int i; - MCHPCIState *mch =3D MCH_PCI_DEVICE(d); - - if (mch->ext_tseg_mbytes > MCH_HOST_BRIDGE_EXT_TSEG_MBYTES_MAX) { - error_setg(errp, "invalid extended-tseg-mbytes value: %" PRIu16, - mch->ext_tseg_mbytes); - return; - } - - /* setup pci memory mapping */ - pc_pci_as_mapping_init(mch->system_memory, mch->pci_address_space); - - /* PAM */ - init_pam(&mch->pam_regions[0], OBJECT(mch), mch->ram_memory, - mch->system_memory, mch->pci_address_space, - PAM_BIOS_BASE, PAM_BIOS_SIZE); - for (i =3D 0; i < ARRAY_SIZE(mch->pam_regions) - 1; ++i) { - init_pam(&mch->pam_regions[i + 1], OBJECT(mch), mch->ram_memory, - mch->system_memory, mch->pci_address_space, - PAM_EXPAN_BASE + i * PAM_EXPAN_SIZE, PAM_EXPAN_SIZE); - } - - /* - * This memory region looks like it's SMM specific, but it is not. - * It's an alias that makes the pci_address_space appear in system - * memory at the SMRAM_C_BASE address. The alias is enabled when the - * CPU should not see SMRAM, and *disabled* when the low SMRAM should = be - * visible. So for non-SMM configs we need to create the alias, and - * leave it permanently enabled. - */ - memory_region_init_alias(&mch->smram_region, OBJECT(mch), "smram-regio= n", - mch->pci_address_space, MCH_HOST_BRIDGE_SMRAM= _C_BASE, - MCH_HOST_BRIDGE_SMRAM_C_SIZE); - memory_region_add_subregion_overlap(mch->system_memory, MCH_HOST_BRIDG= E_SMRAM_C_BASE, - &mch->smram_region, 1); - memory_region_set_enabled(&mch->smram_region, true); - - if (!mch->has_smm_ranges) { - return; - } - + /* Initialize all the SMRAM specific MemoryRegions */ memory_region_init_alias(&mch->open_high_smram, OBJECT(mch), "smram-op= en-high", mch->ram_memory, MCH_HOST_BRIDGE_SMRAM_C_BASE, MCH_HOST_BRIDGE_SMRAM_C_SIZE); @@ -670,9 +630,52 @@ static void mch_realize(PCIDevice *d, Error **errp) memory_region_set_enabled(&mch->smbase_window, false); memory_region_add_subregion(&mch->smram, MCH_HOST_BRIDGE_SMBASE_ADDR, &mch->smbase_window); +} =20 - object_property_add_const_link(qdev_get_machine(), "smram", - OBJECT(&mch->smram)); +static void mch_realize(PCIDevice *d, Error **errp) +{ + int i; + MCHPCIState *mch =3D MCH_PCI_DEVICE(d); + + if (mch->ext_tseg_mbytes > MCH_HOST_BRIDGE_EXT_TSEG_MBYTES_MAX) { + error_setg(errp, "invalid extended-tseg-mbytes value: %" PRIu16, + mch->ext_tseg_mbytes); + return; + } + + /* setup pci memory mapping */ + pc_pci_as_mapping_init(mch->system_memory, mch->pci_address_space); + + /* PAM */ + init_pam(&mch->pam_regions[0], OBJECT(mch), mch->ram_memory, + mch->system_memory, mch->pci_address_space, + PAM_BIOS_BASE, PAM_BIOS_SIZE); + for (i =3D 0; i < ARRAY_SIZE(mch->pam_regions) - 1; ++i) { + init_pam(&mch->pam_regions[i + 1], OBJECT(mch), mch->ram_memory, + mch->system_memory, mch->pci_address_space, + PAM_EXPAN_BASE + i * PAM_EXPAN_SIZE, PAM_EXPAN_SIZE); + } + + /* + * This memory region looks like it's SMM specific, but it is not. + * It's an alias that makes the pci_address_space appear in system + * memory at the SMRAM_C_BASE address. The alias is enabled when the + * CPU should not see SMRAM, and *disabled* when the low SMRAM should = be + * visible. So for non-SMM configs we need to create the alias, and + * leave it permanently enabled. + */ + memory_region_init_alias(&mch->smram_region, OBJECT(mch), "smram-regio= n", + mch->pci_address_space, MCH_HOST_BRIDGE_SMRAM= _C_BASE, + MCH_HOST_BRIDGE_SMRAM_C_SIZE); + memory_region_add_subregion_overlap(mch->system_memory, MCH_HOST_BRIDG= E_SMRAM_C_BASE, + &mch->smram_region, 1); + memory_region_set_enabled(&mch->smram_region, true); + + if (mch->has_smm_ranges) { + mch_init_smram_regions(mch); + object_property_add_const_link(qdev_get_machine(), "smram", + OBJECT(&mch->smram)); + } } =20 static const Property mch_props[] =3D { --=20 MST From nobody Mon Sep 28 02:05:28 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785180223; cv=none; d=zohomail.com; s=zohoarc; b=RqS+Gy2ig19lnwmUngj7x/ktL9F68/9fELucNySgmZ3qT18aNmQwBrwrhDxsdeINSxJny4gGiHNS5x5x8UwdUkUXewCy1NCPAknhcboNeIzLMwOG2WZcEUolZqtqO9U6054x5+mUJIo7vqPISJYi1biDoZELXOatSJuQh5nrIio= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785180223; h=Content-Type:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=xTP2mrPTOCEv1S2HwfgF4Ye14Bhz50OTeDYQ5YoPY/s=; b=VzcX6d6v8CT2kC/M1LnmjIQ8k7BPBLUMCRdJdbnlC9ZP7Vse51gsVQ8V18zVN8abFl/1Ze7Fa2YoEVV0G1yzMNXlFdm99khTkfwAiGWi8x38qbu3+X8Pjg6uRQNHRK9IRFxVo/e8DyztjW50lOZm/OsGsW7aWuHYysQMEHWw84g= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785180223187908.4666680386604; Mon, 27 Jul 2026 12:23:43 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1woQsm-0000uT-6D; Mon, 27 Jul 2026 15:21:02 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQsM-0000a9-Vo for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:20:36 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQsL-0000e4-9K for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:20:34 -0400 Received: from mail-wm1-f72.google.com (mail-wm1-f72.google.com [209.85.128.72]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-623-kHCRPHpjNwuKKHMccX49Xg-1; Mon, 27 Jul 2026 15:20:29 -0400 Received: by mail-wm1-f72.google.com with SMTP id 5b1f17b1804b1-4955d314945so21666595e9.0 for ; Mon, 27 Jul 2026 12:20:29 -0700 (PDT) Received: from redhat.com (IGLD-80-230-28-14.inter.net.il. [80.230.28.14]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496c44afaecsm17051265e9.2.2026.07.27.12.20.26 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 12:20:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785180032; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=xTP2mrPTOCEv1S2HwfgF4Ye14Bhz50OTeDYQ5YoPY/s=; b=DgwFVG7Mc1yM0bGVbb2zV5hGNiay4r+mZKeYZZLj1b1eiwVMCPFwvbwJ+uwINTvPmPUeKM SCjJjZfzits5PMRNvPVdu7OhdNjmG2Lzpq0xiO/dlyzTTyrSkFG6N3aYuBA6m5BsXGfyxR RBg7nbMneqbG09yRGkbcJza8RqG9CeU= X-MC-Unique: kHCRPHpjNwuKKHMccX49Xg-1 X-Mimecast-MFC-AGG-ID: kHCRPHpjNwuKKHMccX49Xg_1785180028 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1785180028; x=1785784828; darn=nongnu.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=xTP2mrPTOCEv1S2HwfgF4Ye14Bhz50OTeDYQ5YoPY/s=; b=jDbVnvgidRO9a3FoGTtygOBvo7CFpII+4N13eMbxyi+YBc7RIcsf5cJY66Z2Ps+4oR Jgo5d6UM2JsOUtAuxfQHdlB/ZwjBV3Yu9UQRJjz9kumZ48v0OszUBBY3njJgHhX09I2x zEmb2wugU37Wjn1ZK/zZtWS1hZwHHpjqFGKJ0bPS9+V2BmTTDK4qt9QUWjB4eBoYgqis S6K+cKIktIR0NA1lTOMFZl1uGkqRcfZIDplLhL3OTLXyAMufrcsIwTDRtd7tQyhEJBy3 F3v1UcAlG8h9+fcAe5/6ysqk7ARy7WpEBxqIcEtZ6Bc2Mdb7h0Lg6nv8wvh5eu94nGZt 5lFA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785180028; x=1785784828; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=xTP2mrPTOCEv1S2HwfgF4Ye14Bhz50OTeDYQ5YoPY/s=; b=NOESRYASsI+LhPvXJY8472bokEZ/dQvGSSU9CrBMlrmKBJURHkCxKqtFdvnpzpld7P 0xfzLDZhSbSyMHb9schBNzF2lPlJP498cHnD7gVsNc1OEIEgLj1ZBrz9XDuHZr/j5+6E YnwOjPV/e4lUWNcnp6rzmmAEK3X1YtSRYdgSEninmJ1Az94KYUeAJxJf/vKcXWMPrkb9 1SB/bDAKmaGAT/N2ImqzKDB3Q9MslBUsFTWH1jFYH6eEL4Rvp0XY+VswaikpOWcebRTp /e/p+xiF7XGN95aS1f/1SMYG7sZjtpbZdnW+T/+JwUO3RnI8ENpb8Z19XtLXaWh3wcps UdXQ== X-Gm-Message-State: AOJu0YxxnKxDA55YituwAeMy9xkzgUD4OmDqJEt5/AgkZHfeCUjlDyOF WdHdMrHM7xF/2tc8rBV5lBT11tc4BoNqaY0jNWyRkgAEdOVB5dCMIkyJZEr65J2XGxaeNmH4BM5 HmP7TgLzkvWXoFVKM7VLQE5KO4AnFAvGfhTz2iWMY2wdhrFNC8ci2wSOCuK0ls8fIvO+p2GbIf4 UY/BJsWZfmRZFTQrtoHN7bUnOiaILQbDSNow== X-Gm-Gg: AR+sD11nz8flfFo6ZyOuICf5a/jUfYFCeAIfVmC1eZmbhYsq6AYuzHxtiQMydwegkXY 7kUYCmmrvSFK3uRuFJf8InseT8eF3DQkfiKKKSHE8FmhmuibfJQMiodAJV4OaEkAZ5mDVzMuegH 1T2RxIUaD0ld92x/dRb0UCQfkaJMugA0yaCXCHi4XOas2Fi6zMohHPbS2f2Zm2CGCKu/7FYikNN +CCmQEUqMBOdzewa6XTrXvS4TBAPRdC+HICjYKGwN4fxI/Ic7nOq9TNk24rfqyUvK0Y4n8bq5ZV r9C7XlMKOYvqyCP5i1FxuRLOYUnig6HB6Esr1sZXHb5dAHvF2ShuVKM4DKCbHy+5RNASMZfl09C vTK+WeUVECcIC4e22lcc//w== X-Received: by 2002:a05:600c:1d1b:b0:495:6f6b:fb75 with SMTP id 5b1f17b1804b1-496b57678e5mr141548675e9.38.1785180028056; Mon, 27 Jul 2026 12:20:28 -0700 (PDT) X-Received: by 2002:a05:600c:1d1b:b0:495:6f6b:fb75 with SMTP id 5b1f17b1804b1-496b57678e5mr141548305e9.38.1785180027528; Mon, 27 Jul 2026 12:20:27 -0700 (PDT) Date: Mon, 27 Jul 2026 15:20:25 -0400 From: "Michael S. Tsirkin" To: qemu-devel@nongnu.org Cc: Peter Maydell , Michael Tokarev Subject: [PULL v2 23/30] hw/pci-host/q35.c: Avoid early return in mch_write_config() Message-ID: References: MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: X-Mailer: git-send-email 2.51.2.2891.g4157995a80.dirty X-Mutt-Fcc: =sent Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=mst@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -36 X-Spam_score: -3.7 X-Spam_bar: --- X-Spam_report: (-3.7 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-1.58, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-Zoho-Virus-Status: 1 X-Zoho-AV-Stamp: zmail-av-0.2.10.1.5.2/285.167.77 X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785180224268158500 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Peter Maydell In mch_write_config() we return early if has_smm_ranges is false. This is slightly bug-prone because it leaves the door open to somebody later adding non-SMM-specific code at the bottom of the function. This case isn't as bad as the one in realize, because the function is a lot shorter. But putting the handling of the three SMM specific ranges into an if() rather than having an early return seems better. Signed-off-by: Peter Maydell Reviewed-by: Michael Tokarev Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin Message-ID: <20260708121011.1653365-4-peter.maydell@linaro.org> --- hw/pci-host/q35.c | 26 ++++++++++++-------------- 1 file changed, 12 insertions(+), 14 deletions(-) diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c index e42b84b978..f4556ad03a 100644 --- a/hw/pci-host/q35.c +++ b/hw/pci-host/q35.c @@ -485,22 +485,20 @@ static void mch_write_config(PCIDevice *d, mch_update_pciexbar(mch); } =20 - if (!mch->has_smm_ranges) { - return; - } + if (mch->has_smm_ranges) { + if (ranges_overlap(address, len, MCH_HOST_BRIDGE_SMRAM, + MCH_HOST_BRIDGE_SMRAM_SIZE)) { + mch_update_smram(mch); + } =20 - if (ranges_overlap(address, len, MCH_HOST_BRIDGE_SMRAM, - MCH_HOST_BRIDGE_SMRAM_SIZE)) { - mch_update_smram(mch); - } + if (ranges_overlap(address, len, MCH_HOST_BRIDGE_EXT_TSEG_MBYTES, + MCH_HOST_BRIDGE_EXT_TSEG_MBYTES_SIZE)) { + mch_update_ext_tseg_mbytes(mch); + } =20 - if (ranges_overlap(address, len, MCH_HOST_BRIDGE_EXT_TSEG_MBYTES, - MCH_HOST_BRIDGE_EXT_TSEG_MBYTES_SIZE)) { - mch_update_ext_tseg_mbytes(mch); - } - - if (ranges_overlap(address, len, MCH_HOST_BRIDGE_F_SMBASE, 1)) { - mch_update_smbase_smram(mch); + if (ranges_overlap(address, len, MCH_HOST_BRIDGE_F_SMBASE, 1)) { + mch_update_smbase_smram(mch); + } } } =20 --=20 MST From nobody Mon Sep 28 02:05:28 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785180098; cv=none; d=zohomail.com; s=zohoarc; b=j8vOAlMmJv6r8u78ll2TAauiIEJGqAyR5IJlCEGFfsL7GPdz9vmjPnkrQetpY2sX117pKF/z/EtJDYXxJOXxe93JoSm6s7NFyM3vmtLgX7S2JzG62Hp8Jxypm4vtmEc9ulTReyZae7YOGGHBAEvZe5VnxnshLFFiBwlavf3Yv3g= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785180098; h=Content-Type:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=qGDDGWT38pNxOONe007eUvij33uws6GbrZoTgh2JBM8=; b=CHWv0xcOMq5SOiYM0ghKG9bmY+0ALfVQi7uH4U4zWV1jYcnZYQCilvFQVUuPuCKG+AZSeny6OTfiLJIxS8preyAwqBEKx5HPsNpDY8xAanxx5bOo8GmAwSyXqkrXWkg5nvE7PlmoIhZgBYPD+ruUZSrpOSIkPwG11uihzaHKorM= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785180098496107.98895308837541; Mon, 27 Jul 2026 12:21:38 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1woQsT-0000iX-Ph; Mon, 27 Jul 2026 15:20:43 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQsN-0000ce-V8 for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:20:36 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQsM-0000eD-BV for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:20:35 -0400 Received: from mail-wm1-f69.google.com (mail-wm1-f69.google.com [209.85.128.69]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-184-EMMuC_CZO1Gn2QazUjz-6A-1; Mon, 27 Jul 2026 15:20:32 -0400 Received: by mail-wm1-f69.google.com with SMTP id 5b1f17b1804b1-4954b1c6310so28147815e9.0 for ; Mon, 27 Jul 2026 12:20:31 -0700 (PDT) Received: from redhat.com (IGLD-80-230-28-14.inter.net.il. [80.230.28.14]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496c45e92eesm14309415e9.15.2026.07.27.12.20.28 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 12:20:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785180033; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=qGDDGWT38pNxOONe007eUvij33uws6GbrZoTgh2JBM8=; b=VE18v7zPpVjQUoEJIfI7aLUu2Yar9MaBy8Zxi1E9gNFzirG+EOHWvi1bJ3ceWYgQ0bzGIu ydlffMtJkMUkmL+RmAuy1aXOJl0cXIad2iBfSYnpCSusujOUD1Xe0GxiK0pvTScJ2d3bgP sb0q525MdZxJUeFWt6OASmfdiQFk9Rs= X-MC-Unique: EMMuC_CZO1Gn2QazUjz-6A-1 X-Mimecast-MFC-AGG-ID: EMMuC_CZO1Gn2QazUjz-6A_1785180031 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1785180031; x=1785784831; darn=nongnu.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=qGDDGWT38pNxOONe007eUvij33uws6GbrZoTgh2JBM8=; b=iUWtshSlWc3X1gaRGrlTx4tu7Mre/4OEc+2uePoONFqZgv0zq15YYsKo07WGUrQoDs LqZyadId2h6e3oQtzzYoOU1iuaV0welNiR7L7y0Rfsp/38yotU1bdMzBCf2YZhI2e5uR sKjDhnyBEtd84HcvtSMyj+sPxYBb4AiJu+ItsHUCx7L/fJ29dmyA0tjZPL9lUh8AOiny t3GuxxIKuQPR0uQy/AndLgeqdDoDdP/Sw2Jsocy6BKMBT9U5M8EFVyGMZEEP0QfNyjaQ zb4nNvaydDn5rEUtxVx4jkbJbd3Mgl9eFUAy5q5shHS0EBKeqi7O3rmorR0P56kOxI34 ikKQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785180031; x=1785784831; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=qGDDGWT38pNxOONe007eUvij33uws6GbrZoTgh2JBM8=; b=G60gzFCsK8uwez99IJw2AXCM+3mdq5etHBc3yAX21c8opCzNgwqAk6yukALTB7Zgur jIrrTW3Jee1Cqu8owe91zoVN+rPf7sWes/F1pc5S+8edWH/n6s1j6b89ty9nAOvOvzAL BxS0iY+X8TtxGt3THqp9isPmBM/O06BNDYR6tMGBtJu0aiSfTIne5SspmpMSXbhfe+Cc eHJPNau/qJkXE0IyJEUBBuTafVh04JqOW3Wva54HPpQI1gyKsSWYxB/FxdA6DMiViT7n hXy01EuyjIX2xDTiP0CddYX2uOeTuVMRA67CEaBPqMHo6KHEDnw5nw+f/JS1bSBG2H4z yeFQ== X-Gm-Message-State: AOJu0YxFMi480J3EpUGchzpKVmfGxWz6WJQttg9QkamjnbgNJdEXIzGM lmJk+w35jqCEVo0xYfmZgIbefaRrczaIwGyEbPE3cod0RN3VNsmMxYxfi8NVHKP9TJ7OROAkEqq QApLOGUxT6hQeUK6jxjI8v1h1o7gx0nonzi45C5frsPUH3YWjqkPDRM2rFvqpHSGuGk8/h+xs1q K4eYRqVkq1pmsmcSFShCM4H63ENLMsDiKaGg== X-Gm-Gg: AR+sD12kS57a2ycqFNcFNFGGOhSsV2TCU2swM/f5FOVqB7UhpkJSbTuymKAN0mfIwRR LpUvL/qwsLtbl095S8Zgq4DtUL4GhsYWVPvBNtyO44FQo7e7hNq8VmT7CoxB5s2uc6iVfOjcO79 m87Je6v6xfi+99pSJmQaWIpu0L1+HR7gMR3aNG4C2O/N3qlnYiCMCVjEvCA4UJ/soV7YQIRDntc u2bTDyKESzJclcY/lCQHnYJV6u/JrVErZZC2BhzzwuUIdUstknYae4tmR/iYgqkyi8aM+DRl/lk 9QjkTf1+p2vqAflIyU/mYlJYgg8DnyE1VyXKV/tQvUaGiNAmFe6/AS1QgJnb6xb4wcmaHlsBMcH /+VEsI/BfYZmUMtak/Hxv7Q== X-Received: by 2002:a05:600c:6d83:b0:495:7d78:7fb2 with SMTP id 5b1f17b1804b1-496b570027amr78367455e9.27.1785180030628; Mon, 27 Jul 2026 12:20:30 -0700 (PDT) X-Received: by 2002:a05:600c:6d83:b0:495:7d78:7fb2 with SMTP id 5b1f17b1804b1-496b570027amr78367265e9.27.1785180029976; Mon, 27 Jul 2026 12:20:29 -0700 (PDT) Date: Mon, 27 Jul 2026 15:20:27 -0400 From: "Michael S. Tsirkin" To: qemu-devel@nongnu.org Cc: Peter Maydell , GuoHan Zhao , Paolo Bonzini , Daniil Tatianin , Vladimir Sementsov-Ogievskiy , Li Zhaoxin Subject: [PULL v2 24/30] hw/virtio/vdpa-dev: pass set_config buffer to vhost backend Message-ID: <421f45d03f328267ebf77fab823a7a25ab3d6c83.1785179875.git.mst@redhat.com> References: MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: X-Mailer: git-send-email 2.51.2.2891.g4157995a80.dirty X-Mutt-Fcc: =sent Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=mst@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -36 X-Spam_score: -3.7 X-Spam_bar: --- X-Spam_report: (-3.7 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-1.58, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-Zoho-Virus-Status: 1 X-Zoho-AV-Stamp: zmail-av-0.2.10.1.5.2/285.167.77 X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785180100333158500 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: GuoHan Zhao vhost_vdpa_device_set_config() receives the updated config buffer, but forwards s->config to the vhost backend. Since s->config is refreshed by get_config(), it may contain stale backend state. Pass the supplied config buffer to vhost_dev_set_config() instead. Fixes: b430a2bd2303 ("vdpa: add vdpa-dev support") Signed-off-by: GuoHan Zhao Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin Message-ID: <20260709073225.2341642-1-zhaoguohan@kylinos.cn> --- hw/virtio/vdpa-dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/virtio/vdpa-dev.c b/hw/virtio/vdpa-dev.c index 089a77f4d0..6dc684ab09 100644 --- a/hw/virtio/vdpa-dev.c +++ b/hw/virtio/vdpa-dev.c @@ -212,7 +212,7 @@ vhost_vdpa_device_set_config(VirtIODevice *vdev, const = uint8_t *config) VhostVdpaDevice *s =3D VHOST_VDPA_DEVICE(vdev); int ret; =20 - ret =3D vhost_dev_set_config(&s->dev, s->config, 0, s->config_size, + ret =3D vhost_dev_set_config(&s->dev, config, 0, s->config_size, VHOST_SET_CONFIG_TYPE_FRONTEND); if (ret) { error_report("set device config space failed"); --=20 MST From nobody Mon Sep 28 02:05:28 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785180146; cv=none; d=zohomail.com; s=zohoarc; b=K2G7TbaUCuGDzGGvfhF22ypv/rv1hBhjeJmsWQ7dTeQuQ/RdbfXs+Jm2pU8pbvICgmJUON/CtEXvnfTCjUmj6lanA3wqTgQvK2UjXBskSJwr1sehZr249JkTPlCnlu15ROfizXzodxQIhnZR4W2VMcx1FdxlR8+/vCq7Y74ba48= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785180146; h=Content-Type:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=SmGEwUN6ZoBQwWGEsj9lWjkAqkITIK5CY/izBuC1F/k=; b=aEK9PRGYBKcA232VolybZXD7pGsaVKuEZeLOOTXLrMbop/KxN75HY0yeMPop7f6kpVfq0MUNjgpSTtO8x7s1Q6m237NuZxwlV+rtkxauUNWhLePnm5IoxDHJ8858Wkc2Kq/WcOyqBZc0xDytX/y/aw24MtTbwsVgEUZzNV/V1hw= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785180146541428.67721558962603; Mon, 27 Jul 2026 12:22:26 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1woQt3-0001Wm-BF; Mon, 27 Jul 2026 15:21:17 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQsP-0000i1-UM for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:20:39 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQsO-0000eZ-Cg for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:20:37 -0400 Received: from mail-wr1-f69.google.com (mail-wr1-f69.google.com [209.85.221.69]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-61-6zX6PCLVOrO7_Zxb_CyT1g-1; Mon, 27 Jul 2026 15:20:34 -0400 Received: by mail-wr1-f69.google.com with SMTP id ffacd0b85a97d-47f7700ffdeso1225023f8f.2 for ; Mon, 27 Jul 2026 12:20:33 -0700 (PDT) Received: from redhat.com (IGLD-80-230-28-14.inter.net.il. [80.230.28.14]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496c45ba4b0sm15597205e9.6.2026.07.27.12.20.31 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 12:20:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785180035; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=SmGEwUN6ZoBQwWGEsj9lWjkAqkITIK5CY/izBuC1F/k=; b=ZFE08BzVp2CfOJ1XLPSiVVd0pB1OFJO0fhGT8ATchi4ftb1M4CWuXRzrPoEu/IsbLCri2j aHIldtJWjeCy0VJtr2gFCqELXnYUCH3Aee9VeHbDYmdBOpTw8z94MrvKL0gy0GknIFxx1w 7Pp/OpXj09Nrbaw9sEo1/e2fPWGl/MA= X-MC-Unique: 6zX6PCLVOrO7_Zxb_CyT1g-1 X-Mimecast-MFC-AGG-ID: 6zX6PCLVOrO7_Zxb_CyT1g_1785180033 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1785180033; x=1785784833; darn=nongnu.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=SmGEwUN6ZoBQwWGEsj9lWjkAqkITIK5CY/izBuC1F/k=; b=fDPaqcbw4JWivkFJI7s9S3y+xAv03vKC0DiiUUu3wC2DQ5ZkWO27TVUQ9Q6rYCAGbN CnFjdmfl8H8l+rx4SG084EVQP8GRer4XgwtFAcl6RI//VZPLLj6wrmsYc+96egwgPHE5 rwb5wnsAvqitmGIdsIAuU3SpOaG2d6nnj48k0GreUT6dtrPxWp4ywyYm6FlVBKOebWyf N3apRf3YqbxnPClQty4mzz1LOztOXIJCdka3iQJh0FH+A5Sr4peBHWPJX3Ata4DDyCH6 9KmWR221aQ4QwQ0qIFsv44R0FqykLb8vIRJPFWgL3CrloM/E4Aos2tHqjKwZtzc0uJby jZyg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785180033; x=1785784833; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=SmGEwUN6ZoBQwWGEsj9lWjkAqkITIK5CY/izBuC1F/k=; b=RnmMMVQwtn18ulsoCoDrbRFncLFMbh+OG7goKWrjJ/Ecvs48Rq23gYBOcoqUxsqsXU xllcKKvODGNNRUXb4hrW6ixUsQrm0zZM4xydTkj3qOfUf9nSx6HMZLzSi+xkYRzN/Q2y e9ddjYffFNYrSHAnR2hwTAVZmUe5Pmr6hQdG8AVtPgosHn5FmCLZQnzy8tZ39Ya4LLuQ gUDgUhKKx78GfNAzaLunKY2hFcbJhSyk/nj+0aGPK3qx8bx1awB9TWj+LRjCy8nqj4NS plJjydQYzBvwjWuKfIdAAJ1pwR9X3IgCvHX3zAmMsFrn9WERL5/dPYp1dmKr0n4TO5g6 fJQg== X-Gm-Message-State: AOJu0Yxgrlf0xNNHLh5Q/bTu5IihY5Nxoo94328yDWLTS016iPornmUm M3fhiuO8rGCSMxnBFiru+TeJTsuTzdXxJljft6/3D0ij2m5tBaH6cqFHrFRZmvp1lPQIbZ5e1l1 s6qzJIAHSbLHW4xWf/3rrrVJPA0G4pUc6uobAsVLfpChMRCgXPNKtaRleWn4ezjEpF/HPCpDMaq bkkNoKMoB2BBbfpLagU6w9oRVtB+ZlDqMlmg== X-Gm-Gg: AR+sD12iLW7kk38iukg/CGNVfbeqCJ7l9zCMLBwtlNphtwy+pHDIdVd9uAr5qVp5cCK sskgHPk13f0EkdCRvng4+Wyp33yehj5yxD+6tYwATI3jPNW4lrPsZBi1nrYswqCPLPuGlsaoVwr GonAVkQH+gD7zTS/aeslZ0KzOy33vHB2V35+eQBxQReEpPRPlpm79Uj8RshuZha+TTBiP7hsP01 3SMSwfGI5hP4x0bUUO2Ue+QwRXXBp6nKi+xPtw1uXJbMbKG7TZpE66tWzzcN6kCMdKdIx/Pu9SN MRLq+MOV033l+AYBLZa0EFtGq4K/tm1E7o5xPi4T1ZVIUtcJKFM4CcOf/tfjY9EZ4ZL6Ku+P1no 8ISQ7GFvVaf6Gm16W5jV96Q== X-Received: by 2002:a05:600c:5487:b0:495:503f:cf9a with SMTP id 5b1f17b1804b1-496b57170aamr112105255e9.9.1785180032841; Mon, 27 Jul 2026 12:20:32 -0700 (PDT) X-Received: by 2002:a05:600c:5487:b0:495:503f:cf9a with SMTP id 5b1f17b1804b1-496b57170aamr112105055e9.9.1785180032344; Mon, 27 Jul 2026 12:20:32 -0700 (PDT) Date: Mon, 27 Jul 2026 15:20:30 -0400 From: "Michael S. Tsirkin" To: qemu-devel@nongnu.org Cc: Peter Maydell , Haotian Jiang , qemu-stable@nongnu.org, Jonathan Cameron , linux-cxl@vger.kernel.org Subject: [PULL v2 25/30] hw/cxl: fix OOB access in cxl_doe_cdat_rsp via entry_handle Message-ID: <292902ae4e93dcf33414ec3c6951e02d497cc850.1785179875.git.mst@redhat.com> References: MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: X-Mailer: git-send-email 2.51.2.2891.g4157995a80.dirty X-Mutt-Fcc: =sent Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=mst@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -36 X-Spam_score: -3.7 X-Spam_bar: --- X-Spam_report: (-3.7 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-1.58, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=unavailable autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-Zoho-Virus-Status: 1 X-Zoho-AV-Stamp: zmail-av-0.2.10.1.5.2/285.167.77 X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785180147840158500 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Haotian Jiang cxl_doe_cdat_rsp() takes ent =3D req->entry_handle (uint16_t, fully guest-controlled, 0..0xFFFF) and directly indexes cdat->entry[ent] without checking ent < cdat->entry_len. For a default cxl-type3 with one volatile memory region, entry_len =3D 1 + CT3_CDAT_NUM_ENTRIES =3D 7, so any entry_handle >=3D 7 reads past the CDATEntry array into host heap. The OOB-read base/length are then used in memcpy(read_mbox + offset, base, len) at cxl_type3.c:298-299, leaking host heap memory to the guest via PCI_EXP_DOE_RD_DATA_MBOX, and potentially overflowing the 1 MiB read_mbox heap buffer when the OOB length field is large. The same bug exists in the cxl-upstream implementation. Existing checks do not bound ent: assert(cdat->entry_len) only ensures the table is loaded; the minimum-length check only guards against a truncated CDATReq; the entry_handle ternary at line 293 only decides the next-handle echo, not the current access; pcie_doe_get_obj_len reads header.length, not entry_handle. Reproduce: build QEMU with CONFIG_CXL, boot -M q35,cxl=3Don -device pxb-cxl,bus_nr=3D52 ... -device cxl-type3,... then send a CDATReq with entry_handle=3D0xFFFF via the DOE mailbox at config offset 0x190. Under ASAN this reports SEGV in cxl_doe_cdat_rsp at cxl_type3.c:281. Fixes: f5ee7413d5 ("hw/mem/cxl-type3: Add CXL CDAT Data Object Exchange") Fixes: 882877fc35 ("hw/pci-bridge/cxl-upstream: Add a CDAT table access DOE= ") Signed-off-by: Haotian Jiang Cc: qemu-stable@nongnu.org Reviewed-by: Jonathan Cameron Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin Message-ID: <20260713072336.623604-2-jianghaotian.sunday@gmail.com> --- hw/mem/cxl_type3.c | 3 +++ hw/pci-bridge/cxl_upstream.c | 3 +++ 2 files changed, 6 insertions(+) diff --git a/hw/mem/cxl_type3.c b/hw/mem/cxl_type3.c index cba05ec57d..28f41fa623 100644 --- a/hw/mem/cxl_type3.c +++ b/hw/mem/cxl_type3.c @@ -278,6 +278,9 @@ static bool cxl_doe_cdat_rsp(DOECap *doe_cap) } =20 ent =3D req->entry_handle; + if (ent >=3D cdat->entry_len) { + return false; + } base =3D cdat->entry[ent].base; len =3D cdat->entry[ent].length; =20 diff --git a/hw/pci-bridge/cxl_upstream.c b/hw/pci-bridge/cxl_upstream.c index b6281cbd4c..69773ff163 100644 --- a/hw/pci-bridge/cxl_upstream.c +++ b/hw/pci-bridge/cxl_upstream.c @@ -158,6 +158,9 @@ static bool cxl_doe_cdat_rsp(DOECap *doe_cap) } =20 ent =3D req->entry_handle; + if (ent >=3D cdat->entry_len) { + return false; + } base =3D cdat->entry[ent].base; len =3D cdat->entry[ent].length; =20 --=20 MST From nobody Mon Sep 28 02:05:28 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785180098; cv=none; d=zohomail.com; s=zohoarc; b=PJ5uHeQYKj8z0xw0hH71DRBf69AbyJOZdPfcws+njPRuiB3X4KJMqpZV6r6sQIRR+tBNz/kyhQPDD6e28eC5Z21hNO6KC0D8O4TkRazsoJFKT8lnmPVOrwOaElKDYZKr6DWL364p/8nw1tXN0eiLvDdquWHRsIlhfRRnpNMPNiA= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785180098; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=0MxmzfN26C9n4Ays3a2bCnXLUUqqhyEZkzXAkW/X4jw=; b=NrsIbC5wBYJ+uJGXEacyTFMApseFicUbt6mSg/H3XN406vARhYjN5u+60SismXGr72s1rGUmyeSwoo8UfgZW5MhAzvonTIBs2NRkctM2xxoJyWTMsEV0XayBd4ne025C9f/zl1NdZ/Mq2hPUzDKqTz1DRKyfOTevly3fHKFI8F8= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785180098002221.67666358300335; Mon, 27 Jul 2026 12:21:38 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1woQt4-0001i5-Mt; Mon, 27 Jul 2026 15:21:18 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQsT-0000j4-3S for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:20:41 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQsR-0000fI-5Y for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:20:40 -0400 Received: from mail-wr1-f72.google.com (mail-wr1-f72.google.com [209.85.221.72]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-311-qDStU4weNZy075WgB2o-TA-1; Mon, 27 Jul 2026 15:20:36 -0400 Received: by mail-wr1-f72.google.com with SMTP id ffacd0b85a97d-47f6d70223dso1995948f8f.1 for ; Mon, 27 Jul 2026 12:20:36 -0700 (PDT) Received: from redhat.com (IGLD-80-230-28-14.inter.net.il. [80.230.28.14]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-47f85bb5127sm48274196f8f.10.2026.07.27.12.20.33 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 12:20:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785180038; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=0MxmzfN26C9n4Ays3a2bCnXLUUqqhyEZkzXAkW/X4jw=; b=HgwBKSlmoxv4UtKWg2JbAVcnGHeoZApSFRfGJideSciMYs1Ya2YZdTJkekFnSReqJY+drn HkSk9wR1+Aao5TpRe/SH47Ab8xihr4e0PU7sktICeeivSDgbKXbpBA7jdPPUsmnzoItn1X qBsa2lfFiYfWuEUszveurgnj5L3fGp0= X-MC-Unique: qDStU4weNZy075WgB2o-TA-1 X-Mimecast-MFC-AGG-ID: qDStU4weNZy075WgB2o-TA_1785180036 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1785180036; x=1785784836; darn=nongnu.org; h=in-reply-to:content-transfer-encoding:content-disposition :content-type:mime-version:references:message-id:subject:cc:to:from :date:from:to:cc:subject:date:message-id:reply-to:content-type; bh=0MxmzfN26C9n4Ays3a2bCnXLUUqqhyEZkzXAkW/X4jw=; b=Lvn6MGnZmH7W04TBlh+tVyhhk2xNdEwWNe/9hCTRAn0IDtvoF25Bd6TLMLFEqhKKZv 46f39CxakpQDh+hInYOYg586hpPqfM0nIa39a+KBV6/5wV3XqfyyehtU/qfOnD/ih4z6 yvweUBBBBuwN6tzl4S1Yxeum+U/oD0qWCqCg8QJArT4RxnvDTCQyR8Hg7A+4xsqdtsxX KlVZGoQjke30Z2NHDbQkwW2JXZTVcYIYl7iU6n/CrB8L5VTf1w8EQJ0i86+HosIX00dM dl4cJBLWwwGK3wvwXiLRqJsQ9GgpvtyycSbDDphWa87/xMvqWHLIRlEmO8yyJUlqNXBh 0yYQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785180036; x=1785784836; h=in-reply-to:content-transfer-encoding:content-disposition :content-type:mime-version:references:message-id:subject:cc:to:from :date:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to:content-type; bh=0MxmzfN26C9n4Ays3a2bCnXLUUqqhyEZkzXAkW/X4jw=; b=gAyWFGrU43tFUeMHbYWwYtdyqsxJOv6rGJQTcxzPScFebB1w6aAzZCGoIoJivFJWP3 WM6jLgR+CpHfi8cNeSpmawcnw9emEXR2tUAfHaqrptK6JEXuyu7m28V5mjUPVvNvhzzK vgYBJLoXByYyR5mgdu+m2cz7rDCx+YeMWJQJKos1BipkNGdiouB527XXNpTQpsa6hrrT OQY9UO4rtEJtY8SeIRCbUwqzdJKJlgvUAfVIw/DWNOrm9nOH3iX7kOTlE+jnMcSyQqcF FKXTq2zwNS6HcY2mcILDWPTkn8kMhqntFIr+cQpk8GTZBZa7oSUXeJ6bllmKBOjiayIW cueA== X-Gm-Message-State: AOJu0Yz8x9b7KTWhvCXCs5a05ZgW3SGidlbSwHJ1UxPqnaSs8vf/6L1E uQUQOhT0E9lv/gP+skYpSKc85TEaPhuWNVp7zP5o8R86aMmFW2sWiUbuAHvVETdtQ5CKyu9J6PL S0wQ6ALsfZVk7w09WUACdiiB5/5V8fiIbJ67+Y01KMSM+XQCG/BTzZTCSAJkd4fjzCt598fnMKI dVwaIkJ0Mh0C73cnaRRueQ+RsQRqIVcxvgQA== X-Gm-Gg: AR+sD13wmsFY0GGSeuYAN859iQgxT0IgpZvxSZmvbclhfHbI3sZTOjf0gW29v3EfsG5 a5l15qrRSVUS/SV16qLNZ+xXRbRw93xYwGs+NYiOTarO0JKZCF82gi7rxEn8JDEmgRVJRuEPU5t IQf+c09UjNsoCRgACr0JAklWSqLlr9h5ZP6sju1j2poVLq0lJ1xCW+0YtBHnUFofHnLWYusGOdB rvwDJcO8VgwEpDMKjO+sIfROWXZPRRmDaAYFTIl5JtYPTyazf18Z1pP8dZFmzHd/KzEG2aMGTfX G73L8lOuRXWHlGTfXhPayPlPVep82UiJCzCqcmNg3JNP+8bp/AajjppPAqdz1x9lla+uPsGl2fx AoMW3Gjuyx4jnpK6vXPZVfg== X-Received: by 2002:a5d:5888:0:b0:47f:9cc2:ddd2 with SMTP id ffacd0b85a97d-47fafa88458mr441437f8f.35.1785180035504; Mon, 27 Jul 2026 12:20:35 -0700 (PDT) X-Received: by 2002:a5d:5888:0:b0:47f:9cc2:ddd2 with SMTP id ffacd0b85a97d-47fafa88458mr441395f8f.35.1785180034799; Mon, 27 Jul 2026 12:20:34 -0700 (PDT) Date: Mon, 27 Jul 2026 15:20:32 -0400 From: "Michael S. Tsirkin" To: qemu-devel@nongnu.org Cc: Peter Maydell , =?utf-8?Q?Cl=C3=A9ment?= MATHIEU--DRIF , huntr bubble , Philippe =?utf-8?Q?Mathieu-Daud=C3=A9?= , Zhenzhong Duan , Jason Wang , Yi Liu , Paolo Bonzini , Richard Henderson Subject: [PULL v2 26/30] intel_iommu: Check address mask before using it in pasid-based iotlb invalidation Message-ID: <0691bb257a7cbfd62127208b49988705bfa2dfe8.1785179875.git.mst@redhat.com> References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Disposition: inline Content-Transfer-Encoding: quoted-printable In-Reply-To: X-Mailer: git-send-email 2.51.2.2891.g4157995a80.dirty X-Mutt-Fcc: =sent Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=mst@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -36 X-Spam_score: -3.7 X-Spam_bar: --- X-Spam_report: (-3.7 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-1.58, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-Zoho-Virus-Status: 1 X-Zoho-AV-Stamp: zmail-av-0.2.10.1.5.2/285.167.77 X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785180101988158500 From: Cl=C3=A9ment MATHIEU--DRIF Prevent a buggy driver to execute malformed invalidation operations. Add the same assert as in vtd_iotlb_page_invalidate. Link: https://gitlab.com/qemu-project/qemu/-/work_items/3619 Fixes: 6ebe6cf2a066 ("intel_iommu: Process PASID-based iotlb invalidation") Reported-by: huntr bubble Signed-off-by: Clement Mathieu--Drif Reviewed-by: Philippe Mathieu-Daud=C3=A9 Reviewed-by: Zhenzhong Duan Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin Message-ID: <20260724111424.376680-1-clement.mathieu--drif@bull.com> --- hw/i386/intel_iommu.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c index d1af7a3135..82c3c3b2c3 100644 --- a/hw/i386/intel_iommu.c +++ b/hw/i386/intel_iommu.c @@ -3021,6 +3021,8 @@ static void vtd_piotlb_page_invalidate(IntelIOMMUStat= e *s, uint16_t domain_id, { VTDIOTLBPageInvInfo info; =20 + assert(am <=3D VTD_MAMV); + info.domain_id =3D domain_id; info.pasid =3D pasid; info.addr =3D addr; @@ -3060,6 +3062,13 @@ static bool vtd_process_piotlb_desc(IntelIOMMUState = *s, =20 case VTD_INV_DESC_PIOTLB_PSI_IN_PASID: am =3D VTD_INV_DESC_PIOTLB_AM(inv_desc->val[1]); + if (am > VTD_MAMV) { + error_report_once("%s: invalid piotlb inv desc: hi=3D0x%"PRIx64 + ", lo=3D0x%"PRIx64" (am=3D%u > VTD_MAMV=3D%l= lu)", + __func__, inv_desc->val[1], inv_desc->val[0], + am, VTD_MAMV); + return false; + } addr =3D (hwaddr) VTD_INV_DESC_PIOTLB_ADDR(inv_desc->val[1]); vtd_piotlb_page_invalidate(s, domain_id, pasid, addr, am, VTD_INV_DESC_PIOTLB_IH(inv_desc)); --=20 MST From nobody Mon Sep 28 02:05:28 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785180166; cv=none; d=zohomail.com; s=zohoarc; b=YGoE+FEUlQs+mA71QZ6ymn0mfDrwoZqA2XL8P37MyXUuazbrLq8OLgnR6PBbd+Ipsjy2katIdU4rEzBUpUSrG0ZZL7c0IhFvuwZSMU4Mt6zh5ZTn90hXK6UDEwqkglyi8nlKCGcI/BR9y35sibxGC+N8cCw/D/GykbbIP+/aXZA= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785180166; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=EdJn1rkxxE4Yq/DoPEG7mWd+n94EmQAMEDDDrQky7J8=; b=YSuKckWEwkvoXhWoxUhWSHmOkmD4Y3QCglepUt13FUDO+XDvjfvMMdVGSnzyIckGs0Y60JIAqBP3P6V0XXjJ6jefdPSFNU7Ed9uv0iGZZ2AtygIWle6J3r21sDfHMPyqkv55ix6lqN8/pCmiwpR9wcocAprmp2UJhD2lamj2kwc= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 178518016661248.4071921858573; Mon, 27 Jul 2026 12:22:46 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1woQt4-0001im-QR; Mon, 27 Jul 2026 15:21:18 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQsU-0000lb-LV for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:20:43 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQsT-0000fw-2N for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:20:42 -0400 Received: from mail-wr1-f71.google.com (mail-wr1-f71.google.com [209.85.221.71]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-447-0pa9BLCmMBaDzJoQkZ8AFQ-1; Mon, 27 Jul 2026 15:20:39 -0400 Received: by mail-wr1-f71.google.com with SMTP id ffacd0b85a97d-472a798fc7cso2396422f8f.1 for ; Mon, 27 Jul 2026 12:20:38 -0700 (PDT) Received: from redhat.com (IGLD-80-230-28-14.inter.net.il. [80.230.28.14]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496c44b84edsm22071515e9.5.2026.07.27.12.20.35 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 12:20:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785180040; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=EdJn1rkxxE4Yq/DoPEG7mWd+n94EmQAMEDDDrQky7J8=; b=MRhNOjw7Lr53k53af5Oi1W5FiuycUuZ77U4an7Qx/Kd1EYAcMOTawhTNBioA3iwESaTmWX 78+oX2oh6vMd1Em8b2yA4C7zm2Z5Vtk5tGXTIT6mseUhPM7OBD7MDCOZJAXUiVdGPUJ7P4 N2wqvYgpwG6JafOKhSqouj7xBdICVqg= X-MC-Unique: 0pa9BLCmMBaDzJoQkZ8AFQ-1 X-Mimecast-MFC-AGG-ID: 0pa9BLCmMBaDzJoQkZ8AFQ_1785180038 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1785180038; x=1785784838; darn=nongnu.org; h=in-reply-to:content-transfer-encoding:content-disposition :content-type:mime-version:references:message-id:subject:cc:to:from :date:from:to:cc:subject:date:message-id:reply-to:content-type; bh=EdJn1rkxxE4Yq/DoPEG7mWd+n94EmQAMEDDDrQky7J8=; b=ZbQCoMdh20Yrh9I6prMI8/FHR0pKdbVtZZjlxWRAT5U+Gm0d4vddJHYaUiWzh3st8s 8PHOS9huj5P+hBJI5DSQnGUYJivgmOZjN8UMHUMI+lPo3nz/Oq96c/epUaXoyuM1r7ei XDwVhuObgHwqmjz1GHzo9+DpdUVEu1pDZ24vrfLO7yk59ko2qdl9rLKysdSXeoAcJjxn PZa78M7eQMwR1tdokkupinLiDgEMjmJoB3Rjo1I01oPI9OIFY6bE33DENR7lyl2v9MQY OHAYnbDh1TL+2MaB3D6T//3G7xu3sClR2HHxirTTGgllstCjiker4SAAJSDcZ+eOYFtc bxRQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785180038; x=1785784838; h=in-reply-to:content-transfer-encoding:content-disposition :content-type:mime-version:references:message-id:subject:cc:to:from :date:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to:content-type; bh=EdJn1rkxxE4Yq/DoPEG7mWd+n94EmQAMEDDDrQky7J8=; b=ZMb3JdeerisqcXMpTQhdwKrbSNHsHJN3DVDo5NRiDa5/QU/bNzCrU6pDZFYIc0Rh01 +3HgGK/1NcSd+cKNqHaOQEWsPE1CSWtc1VeeCQCQIpJwQ6QVYF6THEuQyrwb6o6LsXKZ RvUgRNerICiXJkSXrEwtbUOswr6ppngVHuUC/iciLItNGkL7xrgRZOGEjdJ5R5N8FSDl QiJ1EzfrkWZ+7QToIDjBghdBq2SKCaAsA/FBgEh/g9mcNZBOJH/KIVo5Q3q5YzVW5LEi zHeEoJrKrGh7gWO5DqrBxpTCuX5wA19WXkF+YFqRckk2lVcJH+xh39HgoJGZ2LZ1KI28 +Pmw== X-Gm-Message-State: AOJu0YyWV6tYW7ty28H9HsGhAgVtN8hSb7tMk0tCW6/vMLXZvlSBfCa5 x/TPFua2uwwJqfd8S/305Ryp10o4sgEs+WPYUZcRzaN5k+is2U/ZwQHngynB30T+LbHN9ioI1XS p2YH75fTO1rpt/SZWuNgO3fUe2fNyZaiYZlSH4jmDX+H/IeakfrrET9JLkptH53VKsKvbwhfZMz 0X0OdzuEg8aL5uM2rQmO9zEf+otOqPgZbJnA== X-Gm-Gg: AR+sD10JziAmvhHbx6G/b7+FHVn+3YCyOKWg/ZB3qLC4sTW67osMhXCU+xZwnINoGAl 9vNZuq3vCKGqI91zSPjkq5wbfsaVNxfR+d0Zg3f4kgoroXs6u9qcapgdv7xAoaxSda/6znJrAuL GwFrUQSAt80YFcsUP7rC5pvGfvfRu2d1fXPXimN/wkQxUUab4whTnSp9FJy0vbkLdTu9+kVmjqY RfCCh40bzO4wxHFi1dDTaKJacR7MDbdWjCMrjRrMutL/fm4zDCYky8D5V3IPAJOuc+xGLNf42I6 5RXRSOCdpziI9Psuvs1Hi9hL8pPhBoQT7VntWi3/P/HddYGK25F6kGIg6Oc52nA9nddFxXUE10O 5yHhmTwtewzWy21GAG2DzjA== X-Received: by 2002:a05:600c:4295:b0:495:7990:a1d0 with SMTP id 5b1f17b1804b1-496b571a0c6mr80384985e9.19.1785180037795; Mon, 27 Jul 2026 12:20:37 -0700 (PDT) X-Received: by 2002:a05:600c:4295:b0:495:7990:a1d0 with SMTP id 5b1f17b1804b1-496b571a0c6mr80384665e9.19.1785180037255; Mon, 27 Jul 2026 12:20:37 -0700 (PDT) Date: Mon, 27 Jul 2026 15:20:35 -0400 From: "Michael S. Tsirkin" To: qemu-devel@nongnu.org Cc: Peter Maydell , Laurent Vivier , qemu-stable@nongnu.org, Philippe =?utf-8?Q?Mathieu-Daud=C3=A9?= , alxndr@bu.edu, Giovanni Vignone , Jason Wang Subject: [PULL v2 27/30] hw/net/virtio-net: Protect from DMA re-entrancy bugs Message-ID: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Disposition: inline Content-Transfer-Encoding: quoted-printable In-Reply-To: X-Mailer: git-send-email 2.51.2.2891.g4157995a80.dirty X-Mutt-Fcc: =sent Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=mst@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -36 X-Spam_score: -3.7 X-Spam_bar: --- X-Spam_report: (-3.7 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-1.58, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-Zoho-Virus-Status: 1 X-Zoho-AV-Stamp: zmail-av-0.2.10.1.5.2/285.167.77 X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785180167961158500 From: Laurent Vivier Replace qemu_bh_new_guarded() by virtio_bh_new_guarded() so the bus and device use the same guard. Otherwise the DMA-reentrancy protection can be bypassed. This update was missing in CVE-2024-3446 fix. Fixes: CVE-2026-66022 Cc: qemu-stable@nongnu.org Cc: Philippe Mathieu-Daud=C3=A9 Cc: alxndr@bu.edu Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4073 Reported-by: Giovanni Vignone Signed-off-by: Laurent Vivier Reviewed-by: Philippe Mathieu-Daud=C3=A9 Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin Message-ID: <20260723233555.2970619-1-lvivier@redhat.com> --- hw/net/virtio-net.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c index 7e0c984ec6..814b99a43d 100644 --- a/hw/net/virtio-net.c +++ b/hw/net/virtio-net.c @@ -3009,8 +3009,9 @@ static void virtio_net_add_queue(VirtIONet *n, int in= dex) n->vqs[index].tx_vq =3D virtio_add_queue(vdev, n->net_conf.tx_queue_size, virtio_net_handle_tx_bh); - n->vqs[index].tx_bh =3D qemu_bh_new_guarded(virtio_net_tx_bh, &n->= vqs[index], - &DEVICE(vdev)->mem_reent= rancy_guard); + n->vqs[index].tx_bh =3D virtio_bh_new_guarded(DEVICE(vdev), + virtio_net_tx_bh, + &n->vqs[index]); } =20 n->vqs[index].tx_waiting =3D 0; --=20 MST From nobody Mon Sep 28 02:05:28 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785180222; cv=none; d=zohomail.com; s=zohoarc; b=CjuzOYDD6TCUpE5/d/36eD5CAeJEDNeZiGQhJwU7N+mWCAG7CFL/itCCKSulvkiol27apF1+ipbnodS8s41iWwOMBgVk7x4sN+d3cjYsU9TPow5ZcMLIRamcxlHZdnbjRB3w7IeXbVlqc2QlyN/+HPIxcLkPbVWxpHqgsoweVxk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785180222; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=yZu81sJRfUDJ7gSNX62NjmG3vC2DfnNRoaluf11vifQ=; b=WtpGngCE7ny1Ghzk/pWfV3pGwy3FuvaPT7uEanhZ+psf4UFsImiZU0tmqaGbApJP2z8oxXEKsJXb6Mz+MKSvHvNziP/ztUggigG3zDNiMViUxwbyoERuVqFdACswrWWqdUPC/GqaS5Y67zFwPWtEe/ykcueR/lCN/m6/ZUB8+MQ= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785180222622975.4065028045259; Mon, 27 Jul 2026 12:23:42 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1woQt5-0001tU-VI; Mon, 27 Jul 2026 15:21:20 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQsY-0000t3-5g for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:20:52 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQsW-0000gc-EJ for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:20:45 -0400 Received: from mail-wm1-f71.google.com (mail-wm1-f71.google.com [209.85.128.71]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-360-7NkdR8pJNjmwNkyJpXbm4g-1; Mon, 27 Jul 2026 15:20:41 -0400 Received: by mail-wm1-f71.google.com with SMTP id 5b1f17b1804b1-495495ad5ddso17017945e9.3 for ; Mon, 27 Jul 2026 12:20:41 -0700 (PDT) Received: from redhat.com (IGLD-80-230-28-14.inter.net.il. [80.230.28.14]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496c44a9451sm16951185e9.1.2026.07.27.12.20.38 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 12:20:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785180043; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=yZu81sJRfUDJ7gSNX62NjmG3vC2DfnNRoaluf11vifQ=; b=Dd/221DIwAblHUnFdbKEWQtPXmuPET19/bEZHpvFWxGVWjv2RXMwDiFe08imWimx++mAjp QY+0OkLnx07wHTLO/Yz/kRrv4puCTbim60YoddUus3ZiBqS9UqsycLiCDk8PVb6JhNVaHo kGibaTG+pEMfHVPIlDTW5uoxtULj6AU= X-MC-Unique: 7NkdR8pJNjmwNkyJpXbm4g-1 X-Mimecast-MFC-AGG-ID: 7NkdR8pJNjmwNkyJpXbm4g_1785180040 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1785180040; x=1785784840; darn=nongnu.org; h=in-reply-to:content-transfer-encoding:content-disposition :content-type:mime-version:references:message-id:subject:cc:to:from :date:from:to:cc:subject:date:message-id:reply-to:content-type; bh=yZu81sJRfUDJ7gSNX62NjmG3vC2DfnNRoaluf11vifQ=; b=s4mctFqx0aN9XuZZWTo3eoAXL/vSlHWa/Xu2pYD/pwIBx/RXSh7CUmWAvzwXgceFia RvhfWh2s+XaD5LLErrdeOWwBIJ/PzIx9jMRl2ksRMv3lVv4Y+uOb8MqAeWpq5I9DI8QZ wXSHRQVe3Gtr2pA79CU6yJd+AjqjAc6X2ZHSDPBYBpIJRCIe/gcUi7MlF2kcDSJhURnC iYMdgcQ8K0o74nbS4qn833NaLJ5JfMO1kHeaAT/SDgflnUghCDP+Wf9dyNH/LpGfYCPG obTGIOdB4Aeyp2rHBncEqdBU8hmB6aUEGBMrexFeikJKwoviEyGcvEMKdrr9LUem6rtL FwCA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785180040; x=1785784840; h=in-reply-to:content-transfer-encoding:content-disposition :content-type:mime-version:references:message-id:subject:cc:to:from :date:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to:content-type; bh=yZu81sJRfUDJ7gSNX62NjmG3vC2DfnNRoaluf11vifQ=; b=F9bH69tr4UniXcfoKJHhYBYJprEwoXpCQRyRVOBkaRGueq/++7h/T//hueGz6HNFfJ cHu6RukIp58h0I6L2+bGTQBOfaiUnDeCgdgjNKGVfIbyIlRsGB96IJ/Bbi9QLyO5yemU VuIAPL6C0cA11ZuvH0Ph9HFdPk5W+LSuE+8ngNNQ9PoTKLjeE5pViMWlj50OzPj6l3as rSSQT9JhWmAdR5d/mo4r5zUrlvO6+s2bNnUYCyQYZousPDUTHmwYX37QKk7z9xUr4hZS UEuxB24WlsZAiy4p05t/RrQS+i6m5MpMLa26qKXCzw3wpXVhCxwcL0SF9b16BNSvNqWS cFmw== X-Gm-Message-State: AOJu0YzCkaFZU1zV2gCwlw5O0I5IwT4ysASndp02O3C30k2DGo03VHqP j1cHO+cL4GrL2BtlujUU5MN1+RReVZ331R9oq9fuOcJXlAnheSqvfxCyN5Fs721DVv6hU1ehfzW auANcWCZfP5jR9hpJt7KJsDlu+uMb4n7Gdjs2olRaC9D+mydMoK7MlxNCQo+9a1E2X05WxEi1mO BvujmufvbCgBbzmn/CxfxerbtAEVfGE0ijTQ== X-Gm-Gg: AR+sD13Qedk9cbe2g+Hjjk5K6OstCAm2NFPQv1j9I48tW6rgGKzRuMwDMbxlgsD8qSV xCcOZqjuck13gNIJYC8lPK18bYugwrGR6VYjLXEe7PFzoYu0xhZwPb21v5HuknAvwYV5cgVqvES ovKhq4qh9qEVdBqbTsIHnB6lMJ0BaqxXyoS7X4gkporXTwkuygx4aZUsub3ZRfCLGR0NGZV43ke DL0/y5PVPDQ7byoI7unjDeCjMwrhSj4cfx6H7xnrZ2++ZCGhWwnZJxUKFez04aky4uMoI8ULlfk eU5pr740zHJrQ60iz8Og2FWIwyfLBRukD96nHWp5MOe8wQgxzM+uSOjZsfq5AUwE+Yy4Bv7dJlm 6Bk+bDCwK1YlV6L9nPurB8Q== X-Received: by 2002:a05:600c:a4f:b0:493:d741:5d72 with SMTP id 5b1f17b1804b1-496b57116e2mr154280405e9.38.1785180040001; Mon, 27 Jul 2026 12:20:40 -0700 (PDT) X-Received: by 2002:a05:600c:a4f:b0:493:d741:5d72 with SMTP id 5b1f17b1804b1-496b57116e2mr154280075e9.38.1785180039456; Mon, 27 Jul 2026 12:20:39 -0700 (PDT) Date: Mon, 27 Jul 2026 15:20:37 -0400 From: "Michael S. Tsirkin" To: qemu-devel@nongnu.org Cc: Peter Maydell , Laurent Vivier , Jia Jia , Philippe =?utf-8?Q?Mathieu-Daud=C3=A9?= , Amit Shah Subject: [PULL v2 28/30] hw/virtio-rng: Fix host use-after-free (CVE-2026-50624) Message-ID: <0be94d8d9c28e6b7235b34133d057090fe93be6c.1785179875.git.mst@redhat.com> References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Disposition: inline Content-Transfer-Encoding: quoted-printable In-Reply-To: X-Mailer: git-send-email 2.51.2.2891.g4157995a80.dirty X-Mutt-Fcc: =sent Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=mst@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -36 X-Spam_score: -3.7 X-Spam_bar: --- X-Spam_report: (-3.7 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-1.58, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-Zoho-Virus-Status: 1 X-Zoho-AV-Stamp: zmail-av-0.2.10.1.5.2/285.167.77 X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785180224297158500 From: Laurent Vivier Fix a heap-use-after-free in the virtio-rng frontend when a delayed rng-random backend completion arrives after the virtio-rng device has been hot-unplugged. Fixes: CVE-2026-50624 Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3917 Reported-by: Jia Jia Reviewed-by: Philippe Mathieu-Daud=C3=A9 Signed-off-by: Laurent Vivier Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin Message-ID: <20260724094931.3005968-1-lvivier@redhat.com> --- include/system/rng.h | 14 ++++++++++++++ backends/rng.c | 16 ++++++++++++++++ hw/virtio/virtio-rng.c | 2 ++ 3 files changed, 32 insertions(+) diff --git a/include/system/rng.h b/include/system/rng.h index e383f87d20..a2667d75ef 100644 --- a/include/system/rng.h +++ b/include/system/rng.h @@ -86,4 +86,18 @@ void rng_backend_request_entropy(RngBackend *s, size_t s= ize, * deleted. */ void rng_backend_finalize_request(RngBackend *s, RngRequest *req); + +/** + * rng_backend_cancel_requests: + * @s: the backend that created the request + * @receive_entropy: the function invoked when entropy is available + * @opaque: data passed to @receive_entropy + * + * This function is used by the front-end to cancel all requests to a + * given backend. Requests to cancel are identified by the receive_entropy + * function and the data passed to the function. + */ +void rng_backend_cancel_requests(RngBackend *s, + EntropyReceiveFunc *receive_entropy, + const void *opaque); #endif diff --git a/backends/rng.c b/backends/rng.c index ab94dfea85..7bed62616a 100644 --- a/backends/rng.c +++ b/backends/rng.c @@ -68,6 +68,22 @@ static void rng_backend_free_request(RngRequest *req) g_free(req); } =20 +void rng_backend_cancel_requests(RngBackend *s, + EntropyReceiveFunc *receive_entropy, + const void *opaque) +{ + RngRequest *req, *next; + + QSIMPLEQ_FOREACH_SAFE(req, &s->requests, next, next) { + if (req->receive_entropy !=3D receive_entropy || + req->opaque !=3D opaque) { + continue; + } + QSIMPLEQ_REMOVE(&s->requests, req, RngRequest, next); + rng_backend_free_request(req); + } +} + static void rng_backend_free_requests(RngBackend *s) { RngRequest *req, *next; diff --git a/hw/virtio/virtio-rng.c b/hw/virtio/virtio-rng.c index 66690a34dc..d68d901195 100644 --- a/hw/virtio/virtio-rng.c +++ b/hw/virtio/virtio-rng.c @@ -234,6 +234,8 @@ static void virtio_rng_device_unrealize(DeviceState *de= v) VirtIODevice *vdev =3D VIRTIO_DEVICE(dev); VirtIORNG *vrng =3D VIRTIO_RNG(dev); =20 + rng_backend_cancel_requests(vrng->rng, chr_read, vrng); + qemu_del_vm_change_state_handler(vrng->vmstate); timer_free(vrng->rate_limit_timer); virtio_del_queue(vdev, 0); --=20 MST From nobody Mon Sep 28 02:05:28 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785180226; cv=none; d=zohomail.com; s=zohoarc; b=jy7B0J2LUhNpRPQZhLzzA0z10j1L1tKAPcq+otYF8k0U5vS+iPwxTCG8pLVPFQAOOQkzkh27+WQSZzW4UFseUrI0vh+IivoGNwGMG3L7bQn4jfw9F3PzGr6ggLeGhrXBpVT7ScuHiEFZRLeCcmrPQCtf50jK+u1RJZ/iRYBPq28= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785180226; h=Content-Type:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=yAMl0TJC2lTfXtPmX3khS6ok/xChyA7rdCzEl3eAPrg=; b=QmjBd/DyQ+ai+RBFfleUM0aRyAXXqgrVxrkPcC/XznROcbjLDWYl3ubkEux5GZCj4aHkPa4IKDlGZQ8bCbi6ZcuTA1HETFlTRiLd5eaOqohGRgIB/Xc5pAPq6cajLZN6bgqqLNfqPVUUkc/bfFNzZLCir2Egs1+xKbsm+1XU9S4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785180226280452.08289797902773; Mon, 27 Jul 2026 12:23:46 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1woQt6-0001wi-JV; Mon, 27 Jul 2026 15:21:20 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQsb-0000uK-UB for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:20:55 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQsZ-0000h3-AR for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:20:49 -0400 Received: from mail-wm1-f70.google.com (mail-wm1-f70.google.com [209.85.128.70]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-315-kGoGJUODNY2Ffaw0vqQBsg-1; Mon, 27 Jul 2026 15:20:43 -0400 Received: by mail-wm1-f70.google.com with SMTP id 5b1f17b1804b1-4955843c6cdso34164025e9.1 for ; Mon, 27 Jul 2026 12:20:43 -0700 (PDT) Received: from redhat.com (IGLD-80-230-28-14.inter.net.il. [80.230.28.14]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-47f85c6287csm52087602f8f.25.2026.07.27.12.20.40 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 12:20:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785180046; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=yAMl0TJC2lTfXtPmX3khS6ok/xChyA7rdCzEl3eAPrg=; b=fnEtB7eW6bH6aXNBKNiliMGhKgviDt0RovZ21hw9p3kXDU4q/uENYSwbl3S7eyXWLXtHWj Jd0zL6PzCfksCdvH8pQEIzI67JSSV7lLJeIab/CeSRCa7PE6OJYJ60pe5n+4GF7YCQtZMR KqWI+IV4BtgvU3p6sQINAlED7GAPiYo= X-MC-Unique: kGoGJUODNY2Ffaw0vqQBsg-1 X-Mimecast-MFC-AGG-ID: kGoGJUODNY2Ffaw0vqQBsg_1785180042 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1785180042; x=1785784842; darn=nongnu.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=yAMl0TJC2lTfXtPmX3khS6ok/xChyA7rdCzEl3eAPrg=; b=S0UtN9DXRPRDEKsK95ZZ37CrZHU37WX02OnyEPRFy13RQfLY/iQ65NLe0S4mZ116rU hEwDfimApI/0lMwCOKJKuXihtFyouk2yZEhybBB7/FFA6wvjM912i3xSLJYD3rog5Yq4 gBmXcBTtEmLBbf/rVUZ4ZBjVnzGEjB9rCYeXWWR/Xe1iWcZJhi/u8TAmbD69VGgGUYOz R39kX41MG0XRuywcnSQizt/1XNlNoBr8LTuqDNHLY25idu1FKgmQ2l2ERvDcwe3HpaY1 DO89cSDIvIdjSF7NCjIaeaBEyIZh3NZ8s4zQ9hI7asSCD6rfHRw4opKqouHyabWwPzI9 XNVg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785180042; x=1785784842; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=yAMl0TJC2lTfXtPmX3khS6ok/xChyA7rdCzEl3eAPrg=; b=OvwYxyIiN4PnntFLAeTu3UugXdIBABs3LKr32Eja2ESVSgPn+2EVjStzKKXLUr+9bw ejmac+vGWTpoQx7Pt8lGb+gX3NmG0UThylFwS0xO+btleJa37VGJ7AlS+HMSUCqdYI4a 0aWBfrMbmplxI9UiWUK1TGKkjZU+yGKhZh1k0TasovPeTjpK/WuhK/HsXbUoIgrZNNay sNusxOXUJShvZIODfb7ljKTXp/4X+mTnFGFFDZrJaxr8pZut0p1VHF2XJdjySI24e8Zu 9pD0Tthp3EZ8Rc8EttDRV4BmulFMGCFRDvoaPjwblVieTzzPkQNxYeCCj4IMiZfDRe/k I1rw== X-Gm-Message-State: AOJu0YwVPsgbxMITXtlh10ts0djypOeK+ZenYnKdpa0DE2/sCNzGxKW4 5MU3cGzVdDWAir1X3yMud/08YT81sGSNHiEfQ+x/1G6cM4O3FZo55qV3FbTdQgJSTPlEEp4n8g/ TGISuzVuTIJfPvmcOCFLm2zeIdIghzDQ3ydH6AMHxRXTDp1Kta3s3iA1O+nnqDBYCGV3H9oGT4n mk62f2wT+I0miOXNBbcYtqwa26h3XKN2Q9fA== X-Gm-Gg: AR+sD12Lrhk7p5Vby4PI4jtzTkVvX/vyUEec5Jerqq2WFFADDbna89dFjH/bb0gOiz4 KtzFAQyWM2ynfJZ5NOMN7eNcXFM9Zp5DLL9KSSuqTi8OibJFj0JYlg2kETp/HOkAxHuQ1/b9TTd IYZkouboQDGC8jDTKUHihSwjWsxk31kRgITMHF86udmrI49+PUXvKW3AgbigkxrOt0AN+IWczRM 1qSzkShpWrNh1Tp3xXcbG1oanMaM9PV6eu+ToQzbN3HCzooKMwIx76+lNwhZpZnagEW22Jv9C5G GFU6ocSPMt/rt10OEoL412F54qRNzVVKx2iePUV84fJpiGOPcrjny7jXgjuBopyzc9bELmTcBxg rl2FKh+pGTJOaws7irjpPGQ== X-Received: by 2002:a05:6000:2313:b0:47f:91eb:342 with SMTP id ffacd0b85a97d-47f9fc8840bmr12978628f8f.13.1785180042286; Mon, 27 Jul 2026 12:20:42 -0700 (PDT) X-Received: by 2002:a05:6000:2313:b0:47f:91eb:342 with SMTP id ffacd0b85a97d-47f9fc8840bmr12978592f8f.13.1785180041712; Mon, 27 Jul 2026 12:20:41 -0700 (PDT) Date: Mon, 27 Jul 2026 15:20:39 -0400 From: "Michael S. Tsirkin" To: qemu-devel@nongnu.org Cc: Peter Maydell , Laurent Vivier , qemu-stable@nongnu.org, dong ling , Thomas Huth , Amit Shah Subject: [PULL v2 29/30] backends/rng: cap request size to avoid oversized allocation Message-ID: <70074cc48f450e6c95881ac534e67013c8773cb2.1785179875.git.mst@redhat.com> References: MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: X-Mailer: git-send-email 2.51.2.2891.g4157995a80.dirty X-Mutt-Fcc: =sent Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=mst@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -36 X-Spam_score: -3.7 X-Spam_bar: --- X-Spam_report: (-3.7 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-1.58, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-Zoho-Virus-Status: 1 X-Zoho-AV-Stamp: zmail-av-0.2.10.1.5.2/285.167.77 X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785180228268158500 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Laurent Vivier rng_backend_request_entropy() uses the requested size to allocate a buffer with g_malloc(). With virtio-rng, this size comes from guest-supplied descriptor lengths. A malicious guest can set a very large descriptor length, causing QEMU to attempt a multi-gigabyte allocation and abort. Cap the allocation to 64 KiB. The virtio-rng queue size is hardcoded to 8 entries, the EGD backend protocol limits requests to 255 bytes, the Linux kernel hwrng framework requests at most SMP_CACHE_BYTES per call (64 bytes on x86_64), and the Windows viorng driver uses a 4 KiB buffer. The worst legitimate case is 8 x 4 KiB =3D 32 KiB, so 64 KiB is well above any legitimate use. Fixes: 14417039653d ("virtio-rng: use virtqueue_get_avail_bytes, fix migrat= ion") Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3983 Reported-by: dong ling Signed-off-by: Laurent Vivier Reviewed-by: Thomas Huth Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin Message-ID: <20260715141300.2295392-1-lvivier@redhat.com> --- backends/rng.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/backends/rng.c b/backends/rng.c index 7bed62616a..bc9c7a5ab3 100644 --- a/backends/rng.c +++ b/backends/rng.c @@ -11,11 +11,14 @@ */ =20 #include "qemu/osdep.h" +#include "qemu/units.h" #include "system/rng.h" #include "qapi/error.h" #include "qemu/module.h" #include "qom/object_interfaces.h" =20 +#define RNG_MAX_REQUEST_SIZE (64 * KiB) + void rng_backend_request_entropy(RngBackend *s, size_t size, EntropyReceiveFunc *receive_entropy, void *opaque) @@ -27,7 +30,7 @@ void rng_backend_request_entropy(RngBackend *s, size_t si= ze, req =3D g_malloc(sizeof(*req)); =20 req->offset =3D 0; - req->size =3D size; + req->size =3D MIN(size, RNG_MAX_REQUEST_SIZE); req->receive_entropy =3D receive_entropy; req->opaque =3D opaque; req->data =3D g_malloc(req->size); --=20 MST From nobody Mon Sep 28 02:05:28 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785180240; cv=none; d=zohomail.com; s=zohoarc; b=a3LkkuC5B2eKtsj4R9Saw/5gqyvYovWsCs+DvJtTVnupWB7VKrYLHOPwJYjXSr8HX7AUlTT0z+zEfHq2Yo8RVbCEtKeuXP/uaBrYXGOg3uCZfr4UEkVYcDlz3cWdYMBzgtoMXR2S89Bx5ip2Zy1uex2VWdCuwYeUP7nNqT9S7RU= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785180240; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=XYF0DkjUHUea+23rjlBko6Uu+m8zVNRGqc1kXP54qOc=; b=bhnFXdnq4U5BT1tvMxvoN6nUmeegNhx/ICMn2bMYiCkHi4rym7jJYYbAb5OfJCDn93HkCZz5qvEbStp7JEoWbCAmyqMqyQnfgkjeITuR++PCsGfB7yukbUICEL3RQxaOUnfsaGgj583HRSRxwDwN4L/u/dvLsxRahgtez9KLMdk= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785180240039188.9788166814419; Mon, 27 Jul 2026 12:24:00 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1woQt7-00024T-Ei; Mon, 27 Jul 2026 15:21:21 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQsc-0000uP-0k for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:20:55 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woQsa-0000hE-0M for qemu-devel@nongnu.org; Mon, 27 Jul 2026 15:20:49 -0400 Received: from mail-wm1-f72.google.com (mail-wm1-f72.google.com [209.85.128.72]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-133-YJqvQHDYMIWRkw5t6DwmUQ-1; Mon, 27 Jul 2026 15:20:45 -0400 Received: by mail-wm1-f72.google.com with SMTP id 5b1f17b1804b1-495569acf8dso20983155e9.1 for ; Mon, 27 Jul 2026 12:20:45 -0700 (PDT) Received: from redhat.com (IGLD-80-230-28-14.inter.net.il. [80.230.28.14]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496c45b1c2asm15362255e9.5.2026.07.27.12.20.42 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 12:20:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785180047; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=XYF0DkjUHUea+23rjlBko6Uu+m8zVNRGqc1kXP54qOc=; b=C47koQP5zwCvwYsdPA7b3utyTvY4QjG+a29vaU4MjjfjolPPJR4Ycfysq7YogiIMVae3fn +5uMVFZsXOj9bbDcDZO4TRk4yPNNISL1fb5tjc92L78R/YcmVpzKQZLzOgiLH25e5yO1o9 ImfSk+WADCeN92oI7WO/qyS9rnzt+E4= X-MC-Unique: YJqvQHDYMIWRkw5t6DwmUQ-1 X-Mimecast-MFC-AGG-ID: YJqvQHDYMIWRkw5t6DwmUQ_1785180044 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1785180044; x=1785784844; darn=nongnu.org; h=in-reply-to:content-transfer-encoding:content-disposition :content-type:mime-version:references:message-id:subject:cc:to:from :date:from:to:cc:subject:date:message-id:reply-to:content-type; bh=XYF0DkjUHUea+23rjlBko6Uu+m8zVNRGqc1kXP54qOc=; b=tUl8R1PZTPs++8J43oxjgJxPOcMFM+w3x9cmJY0Bhh2D7DzfuzsuWN6xBel3ZzIgpb Rl3wnykyfLGtFE2t1hCjCfZnq00DSAIMn8g/QNM002ErrYPBekJ/QML51W6hhKpra8tn QgPsKNzwxTYMjNeUKcGfas6iyFrppr63LfW4IjF8bwivJfr1Du6N5Uj/VsJ5vMU+qpHP UUC337WDddvrz0KCwjiWeoXI0Cq5zhK+s8jcUR9k0CeMlWMiPnCT+WChic4Aj86YRpEz /q623YPLuB24/Qg5mCSkQOysPlyR/aeueFjWxP9J0C+V1uMujhlObw6t7Q3xPCfNeaR7 tpWw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785180044; x=1785784844; h=in-reply-to:content-transfer-encoding:content-disposition :content-type:mime-version:references:message-id:subject:cc:to:from :date:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to:content-type; bh=XYF0DkjUHUea+23rjlBko6Uu+m8zVNRGqc1kXP54qOc=; b=JL5tRIDH4vy+8dKW0YgPrh9OS6VarmkuSc/6hqP29Go7oHSE9M2pTTB4jsRVhhejEG y39paf7xXx2dimdr6y7obdsN0QtyAuV6eIGFiLSP1TDj4MmTV1HuAQeOItqKNB/B01cq 6hdHCVdc8XVpKwAlCG3ZVIQ7btJUmztAsT9xhja5Z8eyE2gwA3QTqLhW+X+JYgCxIhOK Au71tyoDn0sigJMJN0116eRafMHOs3y+QJ0bxEtC+HY9jzPiRGoRdBojKmq+QN/maLv1 ec+mEZxPk9FqT4TUse17sY1NuEP/w/pj/tjNdxwvE69hYzyfligjKo04CjOCM7jpBDTS cilg== X-Gm-Message-State: AOJu0YxZIf2dtseSeONTvan4YNgLz7hfK1Qd/e4u9pNK3MKzePuAwmPo OP6xRC1H9MJXMRgY9N3IaKHCdfJCTJSt0rsi+PEtOgiqd9r/TstAf7uDj4tY3i7qCLaypjCySty cY5RJ2utydkl93H1/OeJPM4nzw2vBr1Y9TNn1xPjbTzQq3VbiEKLkygefx15TgC3vjO3fxk/Bjy 7NAKJ1XBpl/stt9FLBHxhyDY+VFhN/nhr3/w== X-Gm-Gg: AR+sD12THZ79AWEOW37VJ9fYP3I8V+5KSnZJcIN8VD2dvzx3ertegASpc/Co3XHZFRa aSOG56kMTk1Omgx6xqCcmZ2ELOmpREAQ1PuJmGZSYoQKXAshYXcWLlNr/6l+ZpaMabvsh3KzNcZ eqwDac9CLyK9TWB/fx6e3PAP14fX/H2wMW2f40LlopZQeSkMEI1XDh/FEaHXMfhfuLFm3YW+WSB tl45/xK/ZtGE+GBzOKlQERwqcjfYh9ujrn1wSw+RxUXck0ixGys2RM/y4WVCj5BKmJ42567IGqx DAiSainvKXSlxcS0jxwnf6KGOWufiUmP1EMkT97us5rHeaJ0m4RgnkX64EpM5eA39FmaoO5B5v/ 29+yieaLlF1r/GCuya9rI1g== X-Received: by 2002:a05:600c:3595:b0:495:7379:17b1 with SMTP id 5b1f17b1804b1-496c4fcc80fmr3941375e9.30.1785180044381; Mon, 27 Jul 2026 12:20:44 -0700 (PDT) X-Received: by 2002:a05:600c:3595:b0:495:7379:17b1 with SMTP id 5b1f17b1804b1-496c4fcc80fmr3941115e9.30.1785180043838; Mon, 27 Jul 2026 12:20:43 -0700 (PDT) Date: Mon, 27 Jul 2026 15:20:41 -0400 From: "Michael S. Tsirkin" To: qemu-devel@nongnu.org Cc: Peter Maydell , Stefan Hajnoczi , Anatol Belski , Philippe =?utf-8?Q?Mathieu-Daud=C3=A9?= Subject: [PULL v2 30/30] virtio: avoid packed vring virtio_queue_empty() infinite loops (CVE-2026-16457) Message-ID: <6682ea3391277e732a6d74c5758206ba834e1615.1785179875.git.mst@redhat.com> References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Disposition: inline Content-Transfer-Encoding: quoted-printable In-Reply-To: X-Mailer: git-send-email 2.51.2.2891.g4157995a80.dirty X-Mutt-Fcc: =sent Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=mst@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -36 X-Spam_score: -3.7 X-Spam_bar: --- X-Spam_report: (-3.7 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-1.58, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-Zoho-Virus-Status: 1 X-Zoho-AV-Stamp: zmail-av-0.2.10.1.5.2/285.167.77 X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785180242368158500 From: Stefan Hajnoczi Virtqueue handler functions in device emulation code often look something like this: while (!virtio_queue_empty(vq)) { ...pop and process virtqueue element... } virtio-blk, virtio-scsi, virtio-crypto, and vhost-shadow-virtqueue use this pattern. The device may break (i.e. hit an error that requires device reset) during the loop. virtio_queue_empty() returns 1 for broken split vrings but not for broken packed vrings, leading to an infinite loop. Adjust the packed vring behavior to match split vrings and avoid infinite loops. Fixes: CVE-2026-16457 Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3968 Reported-by: Anatol Belski Signed-off-by: Stefan Hajnoczi Reviewed-by: Philippe Mathieu-Daud=C3=A9 Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin Message-ID: <20260721134424.196337-1-stefanha@redhat.com> --- hw/virtio/virtio.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c index 979c4065b7..daa5607338 100644 --- a/hw/virtio/virtio.c +++ b/hw/virtio/virtio.c @@ -763,6 +763,10 @@ static int virtio_queue_packed_empty_rcu(VirtQueue *vq) struct VRingPackedDesc desc; VRingMemoryRegionCaches *cache; =20 + if (virtio_device_disabled(vq->vdev)) { + return 1; + } + if (unlikely(!vq->vring.desc)) { return 1; } --=20 MST