Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/2224040/?format=api
{ "id": 2224040, "url": "http://patchwork.ozlabs.org/api/patches/2224040/?format=api", "web_url": "http://patchwork.ozlabs.org/project/qemu-devel/patch/20260416155421.9876-1-Jonathan.Cameron@huawei.com/", "project": { "id": 14, "url": "http://patchwork.ozlabs.org/api/projects/14/?format=api", "name": "QEMU Development", "link_name": "qemu-devel", "list_id": "qemu-devel.nongnu.org", "list_email": "qemu-devel@nongnu.org", "web_url": "", "scm_url": "", "webscm_url": "", "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<20260416155421.9876-1-Jonathan.Cameron@huawei.com>", "list_archive_url": null, "date": "2026-04-16T15:54:21", "name": "[qemu] hw/cxl: Avoid out of bounds read when userspace requests data off end of CDAT.", "commit_ref": null, "pull_url": null, "state": "new", "archived": false, "hash": "dcd4276d6b95ac0f391d732cb0b4c16670d8669a", "submitter": { "id": 71988, "url": "http://patchwork.ozlabs.org/api/people/71988/?format=api", "name": "Jonathan Cameron", "email": "Jonathan.Cameron@huawei.com" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/qemu-devel/patch/20260416155421.9876-1-Jonathan.Cameron@huawei.com/mbox/", "series": [ { "id": 500183, "url": "http://patchwork.ozlabs.org/api/series/500183/?format=api", "web_url": "http://patchwork.ozlabs.org/project/qemu-devel/list/?series=500183", "date": "2026-04-16T15:54:21", "name": "[qemu] hw/cxl: Avoid out of bounds read when userspace requests data off end of CDAT.", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/500183/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2224040/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2224040/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "<qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org>", "X-Original-To": "incoming@patchwork.ozlabs.org", "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=nongnu.org\n (client-ip=209.51.188.17; helo=lists1p.gnu.org;\n envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org;\n receiver=patchwork.ozlabs.org)", "Received": [ "from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17])\n\t(using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fxMzV0HBmz1yHP\n\tfor <incoming@patchwork.ozlabs.org>; Fri, 17 Apr 2026 01:55:16 +1000 (AEST)", "from localhost ([::1] helo=lists1p.gnu.org)\n\tby lists1p.gnu.org with esmtp (Exim 4.90_1)\n\t(envelope-from <qemu-devel-bounces@nongnu.org>)\n\tid 1wDP38-0002LT-0o; Thu, 16 Apr 2026 11:54:38 -0400", "from eggs.gnu.org ([2001:470:142:3::10])\n by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)\n (Exim 4.90_1) (envelope-from <jonathan.cameron@huawei.com>)\n id 1wDP36-0002Ik-OL\n for qemu-devel@nongnu.org; Thu, 16 Apr 2026 11:54:36 -0400", "from frasgout.his.huawei.com ([185.176.79.56])\n by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)\n (Exim 4.90_1) (envelope-from <jonathan.cameron@huawei.com>)\n id 1wDP33-00040T-VZ\n for qemu-devel@nongnu.org; Thu, 16 Apr 2026 11:54:36 -0400", "from mail.maildlp.com (unknown [172.18.224.107])\n by frasgout.his.huawei.com (SkyGuard) with ESMTPS id 4fxMy40wsfzHnGkW;\n Thu, 16 Apr 2026 23:54:04 +0800 (CST)", "from dubpeml500005.china.huawei.com (unknown [7.214.145.207])\n by mail.maildlp.com (Postfix) with ESMTPS id 6E3A240584;\n Thu, 16 Apr 2026 23:54:22 +0800 (CST)", "from SecurePC-101-06.huawei.com (10.123.51.176) by\n dubpeml500005.china.huawei.com (7.214.145.207) with Microsoft SMTP Server\n (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id\n 15.2.1544.11; Thu, 16 Apr 2026 16:54:21 +0100" ], "To": "<buzzy0257@gmail.com>, <jic23@kernel.org>, <linxuarm@huawei.com>,\n <qemu-devel@nongnu.org>", "CC": "<linuxarm@huawei.com>, <berrange@redhat.com>", "Subject": "[PATCH qemu] hw/cxl: Avoid out of bounds read when userspace requests\n data off end of CDAT.", "Date": "Thu, 16 Apr 2026 16:54:21 +0100", "Message-ID": "<20260416155421.9876-1-Jonathan.Cameron@huawei.com>", "X-Mailer": "git-send-email 2.51.0", "MIME-Version": "1.0", "Content-Transfer-Encoding": "8bit", "Content-Type": "text/plain", "X-Originating-IP": "[10.123.51.176]", "X-ClientProxiedBy": "lhrpeml100010.china.huawei.com (7.191.174.197) To\n dubpeml500005.china.huawei.com (7.214.145.207)", "Received-SPF": "pass client-ip=185.176.79.56;\n envelope-from=jonathan.cameron@huawei.com; helo=frasgout.his.huawei.com", "X-Spam_score_int": "-41", "X-Spam_score": "-4.2", "X-Spam_bar": "----", "X-Spam_report": "(-4.2 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3,\n RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001,\n RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001,\n SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no", "X-Spam_action": "no action", "X-BeenThere": "qemu-devel@nongnu.org", "X-Mailman-Version": "2.1.29", "Precedence": "list", "List-Id": "qemu development <qemu-devel.nongnu.org>", "List-Unsubscribe": "<https://lists.nongnu.org/mailman/options/qemu-devel>,\n <mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>", "List-Archive": "<https://lists.nongnu.org/archive/html/qemu-devel>", "List-Post": "<mailto:qemu-devel@nongnu.org>", "List-Help": "<mailto:qemu-devel-request@nongnu.org?subject=help>", "List-Subscribe": "<https://lists.nongnu.org/mailman/listinfo/qemu-devel>,\n <mailto:qemu-devel-request@nongnu.org?subject=subscribe>", "Reply-to": "Jonathan Cameron <Jonathan.Cameron@huawei.com>", "From": "Jonathan Cameron via qemu development <qemu-devel@nongnu.org>", "Errors-To": "qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org", "Sender": "qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org" }, "content": "The requested entry is controlled by the guest so must be checked against\nthe number of entries that actually exist.\n\nReported as a security issue, but CXL emulation has since been declared\nto not be suitable (yet) for virtualization use cases and so the security\nhandling policy does not apply.\n\nFixes: f5ee7413d592 (\"hw/mem/cxl-type3: Add CXL CDAT Data Object Exchange\")\nFixes: 882877fc359d (\"hw/pci-bridge/cxl-upstream: Add a CDAT table access DOE\")\nReported-by: Buzzy <buzzy0257@gmail.com>\nSigned-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>\nCc: <jic23@kernel.org>\n---\n hw/mem/cxl_type3.c | 4 ++++\n hw/pci-bridge/cxl_upstream.c | 4 ++++\n 2 files changed, 8 insertions(+)", "diff": "diff --git a/hw/mem/cxl_type3.c b/hw/mem/cxl_type3.c\nindex 4739239da3c5..763b6a024403 100644\n--- a/hw/mem/cxl_type3.c\n+++ b/hw/mem/cxl_type3.c\n@@ -278,6 +278,10 @@ static bool cxl_doe_cdat_rsp(DOECap *doe_cap)\n }\n \n ent = req->entry_handle;\n+ if (ent >= cdat->entry_len) {\n+ return false;\n+ }\n+\n base = cdat->entry[ent].base;\n len = cdat->entry[ent].length;\n \ndiff --git a/hw/pci-bridge/cxl_upstream.c b/hw/pci-bridge/cxl_upstream.c\nindex b6281cbd4cb0..fa53fa2777fd 100644\n--- a/hw/pci-bridge/cxl_upstream.c\n+++ b/hw/pci-bridge/cxl_upstream.c\n@@ -158,6 +158,10 @@ static bool cxl_doe_cdat_rsp(DOECap *doe_cap)\n }\n \n ent = req->entry_handle;\n+ if (ent >= cdat->entry_len) {\n+ return false;\n+ }\n+\n base = cdat->entry[ent].base;\n len = cdat->entry[ent].length;\n \n", "prefixes": [ "qemu" ] }