Cédric Le Goater 9daa7347ff vfio/pci: Reject invalid MSI-X Table and PBA BIR values ...

The 3-bit MSI-X BIR fields permit values 0-7, but VFIOPCIDevice::bars[]
only contains BAR0-BAR5 (6 entries). An invalid BIR value of 6 or 7
can cause an out-of-bounds array access (CWE-129) in vfio_msix_early_setup().

Add range checks immediately after extracting the BIR values.

Reported-by: Feifan Qian <bea1e@proton.me>
Fixes: 65501a745d ("vfio: vfio-pci device assignment driver")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3878
Reviewed-by: Alex Williamson <alex@shazbot.org>
Link: https://lore.kernel.org/qemu-devel/20260706161334.2165482-1-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>

2026-07-07 07:12:46 +02:00

..

ap.c

vfio/ap: Return false when IRQ notifier setup fails

2026-05-20 15:05:20 +02:00

ccw.c

vfio/ccw: Return false when IRQ notifier setup fails

2026-05-20 15:05:20 +02:00

container-legacy.c

…

container.c

vfio/iommufd: Merge .dma_map_file() into .dma_map()

2026-07-07 07:12:46 +02:00

cpr-iommufd.c

…

cpr-legacy.c

system/memory: constify section arguments

2026-06-22 17:08:48 -04:00

cpr.c

…

device.c

vfio/iommufd: Create nesting parent hwpt with IOMMU_HWPT_ALLOC_PASID flag

2026-06-03 08:36:11 -04:00

display.c

vfio/pci: close display console during unrealize, not finalize

2026-06-24 15:41:14 +04:00

helpers.c

hw/vfio: Drop superfluous inclusion of hw-error.h

2026-05-20 15:05:20 +02:00

igd-stubs.c

…

igd.c

hw/vfio: Drop superfluous inclusion of hw-error.h

2026-05-20 15:05:20 +02:00

iommufd-stubs.c

…

iommufd.c

vfio/iommufd: Merge .dma_map_file() into .dma_map()

2026-07-07 07:12:46 +02:00

Kconfig

…

kvm-helpers.c

hw/vfio: Drop superfluous inclusion of hw-error.h

2026-05-20 15:05:20 +02:00

kvm-spapr.c

…

kvm-spapr.h

…

kvm-stubs.c

…

listener.c

vfio/listener: Fix translated_addr for non-identity-mapped RAM sections

2026-07-07 07:12:46 +02:00

meson.build

hw/vfio: use stub_ss for iommufd-stubs.c

2026-05-28 18:44:05 +02:00

migration-multifd.c

…

migration-multifd.h

…

migration.c

vfio/migration: Check VFIO_PRECOPY_INFO_REINIT during switchover

2026-07-07 07:12:46 +02:00

pci-quirks.c

…

pci-quirks.h

…

pci.c

vfio/pci: Reject invalid MSI-X Table and PBA BIR values

2026-07-07 07:12:46 +02:00

pci.h

vfio/pci: Add ats property

2026-07-07 07:12:46 +02:00

region.c

vfio: Clean up vfio_region_unmap()

2026-05-27 10:41:47 +02:00

spapr.c

…

trace-events

vfio/migration: Implement VFIO_PRECOPY_INFO_REINIT feature

2026-07-07 07:12:46 +02:00

trace.h

…

types.h

…

vfio-display.h

…

vfio-helpers.h

…

vfio-iommufd.h

…

vfio-listener.h

…

vfio-migration-internal.h

vfio/migration: Implement VFIO_PRECOPY_INFO_REINIT feature

2026-07-07 07:12:46 +02:00

vfio-region.h

vfio: Clean up vfio_region_unmap()

2026-05-27 10:41:47 +02:00