starred/qemu-qemu-1
1
0
Fork 0
mirror of https://github.com/qemu/qemu.git synced 2026-07-08 17:56:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

vfio/pci: Reject invalid MSI-X Table and PBA BIR values

Browse Source 
The 3-bit MSI-X BIR fields permit values 0-7, but VFIOPCIDevice::bars[]
only contains BAR0-BAR5 (6 entries). An invalid BIR value of 6 or 7
can cause an out-of-bounds array access (CWE-129) in vfio_msix_early_setup().

Add range checks immediately after extracting the BIR values.

Reported-by: Feifan Qian <bea1e@proton.me>
Fixes: 65501a745d ("vfio: vfio-pci device assignment driver")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3878
Reviewed-by: Alex Williamson <alex@shazbot.org>
Link: https://lore.kernel.org/qemu-devel/20260706161334.2165482-1-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
This commit is contained in:
Cédric Le Goater
2026-07-06 18:13:34 +02:00
parent 5c18838cb8
commit 9daa7347ff
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
hw/vfio/pci.c
View File

@@ -1791,6 +1791,14 @@ static bool vfio_msix_early_setup(VFIOPCIDevice *vdev, Error **errp)
msix->pba_offset = pba & ~PCI_MSIX_FLAGS_BIRMASK;
msix->entries = (ctrl & PCI_MSIX_FLAGS_QSIZE) + 1;
if (msix->table_bar >= ARRAY_SIZE(vdev->bars) ||
msix->pba_bar >= ARRAY_SIZE(vdev->bars)) {
error_setg(errp, "invalid MSI-X BIR, table_bar=%d pba_bar=%d",
msix->table_bar, msix->pba_bar);
g_free(msix);
return false;
}
ret = vfio_device_get_irq_info(&vdev->vbasedev, VFIO_PCI_MSIX_IRQ_INDEX,
&irq_info);
if (ret < 0) {