[{"id":3678270,"web_url":"http://patchwork.ozlabs.org/comment/3678270/","msgid":"<20260416165924.00002043@huawei.com>","list_archive_url":null,"date":"2026-04-16T15:59:24","subject":"Re: [PATCH qemu] hw/cxl: Avoid out of bounds read when userspace\n requests data off end of CDAT.","submitter":{"id":71988,"url":"http://patchwork.ozlabs.org/api/people/71988/","name":"Jonathan Cameron","email":"Jonathan.Cameron@huawei.com"},"content":"On Thu, 16 Apr 2026 16:54:21 +0100\nJonathan Cameron via qemu development wrote:\n\n> The requested entry is controlled by the guest so must be checked against\n> the number of entries that actually exist.\n> \n> Reported as a security issue, but CXL emulation has since been declared\n> to not be suitable (yet) for virtualization use cases and so the security\n> handling policy does not apply.\n> \n> Fixes: f5ee7413d592 (\"hw/mem/cxl-type3: Add CXL CDAT Data Object Exchange\")\n> Fixes: 882877fc359d (\"hw/pci-bridge/cxl-upstream: Add a CDAT table access DOE\")\n> Reported-by: Buzzy \n> Signed-off-by: Jonathan Cameron \n> Cc: \n\nI have a very short memory it seems and forgot to add linux-cxl\ndespite adding it to the MAINTAINERS entry yesterday. \n\n> ---\n> hw/mem/cxl_type3.c | 4 ++++\n> hw/pci-bridge/cxl_upstream.c | 4 ++++\n> 2 files changed, 8 insertions(+)\n> \n> diff --git a/hw/mem/cxl_type3.c b/hw/mem/cxl_type3.c\n> index 4739239da3c5..763b6a024403 100644\n> --- a/hw/mem/cxl_type3.c\n> +++ b/hw/mem/cxl_type3.c\n> @@ -278,6 +278,10 @@ static bool cxl_doe_cdat_rsp(DOECap *doe_cap)\n> }\n> \n> ent = req->entry_handle;\n> + if (ent >= cdat->entry_len) {\n> + return false;\n> + }\n> +\n> base = cdat->entry[ent].base;\n> len = cdat->entry[ent].length;\n> \n> diff --git a/hw/pci-bridge/cxl_upstream.c b/hw/pci-bridge/cxl_upstream.c\n> index b6281cbd4cb0..fa53fa2777fd 100644\n> --- a/hw/pci-bridge/cxl_upstream.c\n> +++ b/hw/pci-bridge/cxl_upstream.c\n> @@ -158,6 +158,10 @@ static bool cxl_doe_cdat_rsp(DOECap *doe_cap)\n> }\n> \n> ent = req->entry_handle;\n> + if (ent >= cdat->entry_len) {\n> + return false;\n> + }\n> +\n> base = cdat->entry[ent].base;\n> len = cdat->entry[ent].length;\n>","headers":{"Return-Path":"","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":"legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=nongnu.org\n (client-ip=209.51.188.17; helo=lists1p.gnu.org;\n envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org;\n receiver=patchwork.ozlabs.org)","Received":["from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17])\n\t(using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fxN521twTz1yHP\n\tfor ; Fri, 17 Apr 2026 02:00:06 +1000 (AEST)","from localhost ([::1] helo=lists1p.gnu.org)\n\tby lists1p.gnu.org with esmtp (Exim 4.90_1)\n\t(envelope-from )\n\tid 1wDP7t-0004nZ-OP; Thu, 16 Apr 2026 11:59:34 -0400","from eggs.gnu.org ([2001:470:142:3::10])\n by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)\n (Exim 4.90_1) (envelope-from )\n id 1wDP7s-0004nO-0f\n for qemu-devel@nongnu.org; Thu, 16 Apr 2026 11:59:32 -0400","from frasgout.his.huawei.com ([185.176.79.56])\n by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)\n (Exim 4.90_1) (envelope-from )\n id 1wDP7q-0005C5-3M\n for qemu-devel@nongnu.org; Thu, 16 Apr 2026 11:59:31 -0400","from mail.maildlp.com (unknown [172.18.224.150])\n by frasgout.his.huawei.com (SkyGuard) with ESMTPS id 4fxN3w3hkBzHnGjl;\n Thu, 16 Apr 2026 23:59:08 +0800 (CST)","from dubpeml500005.china.huawei.com (unknown [7.214.145.207])\n by mail.maildlp.com (Postfix) with ESMTPS id CED7D40571;\n Thu, 16 Apr 2026 23:59:26 +0800 (CST)","from localhost (10.123.51.176) by dubpeml500005.china.huawei.com\n (7.214.145.207) with Microsoft SMTP Server (version=TLS1_2,\n cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Thu, 16 Apr\n 2026 16:59:25 +0100"],"Date":"Thu, 16 Apr 2026 16:59:24 +0100","To":"Jonathan Cameron via qemu development ","CC":"Jonathan Cameron , ,\n , , ,\n ","Subject":"Re: [PATCH qemu] hw/cxl: Avoid out of bounds read when userspace\n requests data off end of CDAT.","Message-ID":"<20260416165924.00002043@huawei.com>","In-Reply-To":"<20260416155421.9876-1-Jonathan.Cameron@huawei.com>","References":"<20260416155421.9876-1-Jonathan.Cameron@huawei.com>","X-Mailer":"Claws Mail 4.3.0 (GTK 3.24.42; x86_64-w64-mingw32)","MIME-Version":"1.0","Content-Type":"text/plain; charset=\"US-ASCII\"","Content-Transfer-Encoding":"7bit","X-Originating-IP":"[10.123.51.176]","X-ClientProxiedBy":"lhrpeml100010.china.huawei.com (7.191.174.197) To\n dubpeml500005.china.huawei.com (7.214.145.207)","Received-SPF":"pass client-ip=185.176.79.56;\n envelope-from=jonathan.cameron@huawei.com; helo=frasgout.his.huawei.com","X-Spam_score_int":"-41","X-Spam_score":"-4.2","X-Spam_bar":"----","X-Spam_report":"(-4.2 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3,\n RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001,\n RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001,\n SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no","X-Spam_action":"no action","X-BeenThere":"qemu-devel@nongnu.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"qemu development ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Reply-to":"Jonathan Cameron ","From":"Jonathan Cameron via qemu development ","Errors-To":"qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org","Sender":"qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org"}}]