{"id":2224972,"url":"http://patchwork.ozlabs.org/api/1.1/patches/2224972/?format=json","web_url":"http://patchwork.ozlabs.org/project/qemu-devel/patch/20260420-virtio-fixups-v3-1-07aef1eff9d2@linaro.org/","project":{"id":14,"url":"http://patchwork.ozlabs.org/api/1.1/projects/14/?format=json","name":"QEMU Development","link_name":"qemu-devel","list_id":"qemu-devel.nongnu.org","list_email":"qemu-devel@nongnu.org","web_url":"","scm_url":"","webscm_url":""},"msgid":"<20260420-virtio-fixups-v3-1-07aef1eff9d2@linaro.org>","date":"2026-04-20T05:07:05","name":"[v3,1/2] virtio-snd: check rx buffer descriptor size","commit_ref":null,"pull_url":null,"state":"new","archived":false,"hash":"dc63a3d6ab28d6a379568b65afaceefc6a2ce4c7","submitter":{"id":86526,"url":"http://patchwork.ozlabs.org/api/1.1/people/86526/?format=json","name":"Manos Pitsidianakis","email":"manos.pitsidianakis@linaro.org"},"delegate":null,"mbox":"http://patchwork.ozlabs.org/project/qemu-devel/patch/20260420-virtio-fixups-v3-1-07aef1eff9d2@linaro.org/mbox/","series":[{"id":500552,"url":"http://patchwork.ozlabs.org/api/1.1/series/500552/?format=json","web_url":"http://patchwork.ozlabs.org/project/qemu-devel/list/?series=500552","date":"2026-04-20T05:07:04","name":"More virtio-snd fortifications/coverity fixes","version":3,"mbox":"http://patchwork.ozlabs.org/series/500552/mbox/"}],"comments":"http://patchwork.ozlabs.org/api/patches/2224972/comments/","check":"pending","checks":"http://patchwork.ozlabs.org/api/patches/2224972/checks/","tags":{},"headers":{"Return-Path":"","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=linaro.org header.i=@linaro.org header.a=rsa-sha256\n header.s=google header.b=M4Ns0dU9;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=nongnu.org\n (client-ip=209.51.188.17; helo=lists1p.gnu.org;\n envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org;\n receiver=patchwork.ozlabs.org)"],"Received":["from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17])\n\t(using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fzYRL0qMBz1yHr\n\tfor ; Mon, 20 Apr 2026 15:08:28 +1000 (AEST)","from localhost ([::1] helo=lists1p.gnu.org)\n\tby lists1p.gnu.org with esmtp (Exim 4.90_1)\n\t(envelope-from )\n\tid 1wEgqw-0004rc-7K; Mon, 20 Apr 2026 01:07:22 -0400","from eggs.gnu.org ([2001:470:142:3::10])\n by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)\n (Exim 4.90_1) (envelope-from )\n id 1wEgqu-0004qV-8l\n for qemu-devel@nongnu.org; Mon, 20 Apr 2026 01:07:20 -0400","from mail-wr1-x434.google.com ([2a00:1450:4864:20::434])\n by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128)\n (Exim 4.90_1) (envelope-from )\n id 1wEgqr-0002av-Eg\n for qemu-devel@nongnu.org; Mon, 20 Apr 2026 01:07:19 -0400","by mail-wr1-x434.google.com with SMTP id\n ffacd0b85a97d-43d77f6092eso1706840f8f.2\n for ; Sun, 19 Apr 2026 22:07:13 -0700 (PDT)","from [127.0.1.1] (athedsl-4440559.home.otenet.gr. [79.129.177.223])\n by smtp.gmail.com with ESMTPSA id\n ffacd0b85a97d-43fe4e3a341sm28886954f8f.24.2026.04.19.22.07.10\n (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n Sun, 19 Apr 2026 22:07:10 -0700 (PDT)"],"DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=linaro.org; s=google; t=1776661632; x=1777266432; darn=nongnu.org;\n h=cc:to:in-reply-to:references:message-id:content-transfer-encoding\n :mime-version:subject:date:from:from:to:cc:subject:date:message-id\n :reply-to; bh=L4L7y6C8teQb1pIcSjZXj7EqDslM7XaqTZ3gXfLwQzU=;\n b=M4Ns0dU9X1TbftFbZamnsLWv6UFZWGXKk+TcxiGkYGcKEJ4Oh5elq9ouqP+E3caGDy\n 4kWWZHaz/fl00h1ahFPb5bmgdHowsaIEolMRoimWmNkbUB1wtW8RdHmNqSToVRa+Q3N4\n MvktqHUoe4SB9qRax2VP7WK1JT2A4DSD7qBHmlUoOTBMWWD+g0CLhgjhdkIEs+Z1JRyV\n XeUb3rUbCLblZAq10SOco5IWqpHwmuNoraWXB/IoiZw9gzKizmYCmJtnPhKLocbFMag4\n kxPL9UX2lPts2T6TO247NW31cXRAcAfr4EvY7e++CuiqJXf7ypIRqVD001kNr9G1d+CP\n 9/2Q==","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1776661632; x=1777266432;\n h=cc:to:in-reply-to:references:message-id:content-transfer-encoding\n :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to\n :cc:subject:date:message-id:reply-to;\n bh=L4L7y6C8teQb1pIcSjZXj7EqDslM7XaqTZ3gXfLwQzU=;\n b=AAEwQN1DBFaYSLZmo/NtT8XD2R//ggkRzg69d9LBdDrfZqcPlfq+6W/GKaEPrk68oy\n qqQmeE9rWHu6dSDVFgdQUT9iX65NPqO9CzliTvyksSj/1vZ6WP6gcMqc10rqoteoRPkK\n wFWdz39Etl8wEi1mrKpQl97wHLno2YHNHtO4drSqewMjJItHyaViCR2X4EZgzghnPNZF\n 3944ydbhOMTikPW9vKO0UwkE6UgeyX+SKHqs1q+fjcrGCzNR6e4s8uQu9GJ4/qekTjLM\n GUl6SwrkPcRKBAGwSb6hihSdpkBaIqx0HCci6hgUzK57F1qIns627+1SKkgZF6LMsRLJ\n C3DA==","X-Gm-Message-State":"AOJu0Yxs5iQhyahX4S8I++b2o42pIMD79gl/W77q4gntMnN6rTIRvTln\n d7jvRqEUE9uACRXXfCURR5yxCf9VIupeJcJ2hxnE+WYkivY6upbOWjd8/Iow53UIKhh8po9w3CV\n Ac+EOwfQ=","X-Gm-Gg":"AeBDievyd1gudUw8+NUP67S8L/GlSKJ215gkvn3asEk7Iub26ktiqTKSJgs2MrneVDK\n XdQ5eHRTBuvLyYAd5bl/f9OJPQ1kqFo0/VxREQdBL+SlOxoILKTBJoENoMDB0kF1uy0xKqmlzzo\n Hv38LIKymi+ZZn/2SGvGFkm/i0ReAR84U+tMMrbOhmNV/xCi2ivtzfs6tEYHuI7MUWTvrTM7yr3\n Va/XTFBh1btVir+wljfYcGmpCYGa3gIkwwz62MiVL+yENs10M/SwZj46P+wrrlpKScG9k/RwV4j\n wokIpEFxQpOBlh+ZXHC1Znmm6AgB3zS0BysyUYfx//juy0RqigfxqkJ+hQy+tvsX43VkC6irbsi\n QsK3z6o6jtIp3lOHjn719ORXjiZPHBYnomtiXrluwLp7ipEcGBBTi8iON0+nyfs+6UgGF8ZSGwq\n W+C9KjBr8PvC8RKJCHZh+viwsgg/4YG+eM/7U/iOEbyaOkg3OALSdrYIOdmmfgesKLE47nYkB+1\n XxUFSSS4QpEiHHYqC1yLNLOMaG1j0zP2O5+HcqSuC1GiBbKUIs=","X-Received":"by 2002:a05:6000:2307:b0:43b:3e40:2223 with SMTP id\n ffacd0b85a97d-43fe3dcc52cmr18293730f8f.19.1776661630925;\n Sun, 19 Apr 2026 22:07:10 -0700 (PDT)","From":"Manos Pitsidianakis ","Date":"Mon, 20 Apr 2026 08:07:05 +0300","Subject":"[PATCH v3 1/2] virtio-snd: check rx buffer descriptor size","MIME-Version":"1.0","Content-Type":"text/plain; charset=\"utf-8\"","Content-Transfer-Encoding":"8bit","Message-Id":"<20260420-virtio-fixups-v3-1-07aef1eff9d2@linaro.org>","References":"<20260420-virtio-fixups-v3-0-07aef1eff9d2@linaro.org>","In-Reply-To":"<20260420-virtio-fixups-v3-0-07aef1eff9d2@linaro.org>","To":"qemu-devel@nongnu.org","Cc":"Gerd Hoffmann , \"Michael S. Tsirkin\" ,\n\t=?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= , =?utf-8?q?Alex?=\n\t=?utf-8?q?_Benn=C3=A9e?= ,\n Richard Henderson , qemu-stable@nongnu.org,\n Manos Pitsidianakis ","X-Mailer":"b4 0.14.2","X-Developer-Signature":"v=1; a=openpgp-sha256; l=1448;\n i=manos.pitsidianakis@linaro.org; h=from:subject:message-id;\n bh=0XTx6kbq4YY1BBPqSAfMX1GSupccz3LwWPrnsQLDA7E=;\n b=LS0tLS1CRUdJTiBQR1AgTUVTU0FHRS0tLS0tCgpvd0VCYlFLUy9aQU5Bd0FLQVhjcHgzQi9mZ\n 25RQWNzbVlnQnA1YlI4TU83V0ZtRzZFaTlpMzBhQTBESjA4RW8yCnNpcGQxcHpzenA5dDgwVnhE\n ckdKQWpNRUFBRUtBQjBXSVFUTVhCdE9SS0JXODRkd0hSQjNLY2R3ZjM0SjBBVUMKYWVXMGZBQUt\n DUkIzS2Nkd2YzNEowSkZwRC8wYzJxM2xkTlY4Q3J1VVpYWUhNd3dwNjNtREdKckdheitVdm1BUw\n pXRDZoYmpnWGtaV2FEb1RoaUZIMWpGRitFUHRlK2xJOUg2MU1WeC9OblYxaERCQzVEbko4WElrK\n zYzZ2FwQXFPCkFyVlZDbm9MbDZxTVZRbVB5dHJweHRXSk4zalNXZVh5ZjdyWjNKZFNHYVV5MU1R\n MzFBSnBvQUZyUmdleXlQMXAKMVdZZk9sVFZMMnZ0ek5xeWZkWEVOMHRQd0ppVC9GK1ZHK1lHTWR\n PZTl1NHd3VHdFbnlaVVpoT1B6OVlRZmNGSgpXcVJwanBWSk0vZlRicVRNQzBEeUZWVnhTNHBFa2\n xVRTFzM3JobDdmZGVYT2g5cWV4VVlSOCtpNys3MnhVTG9CCmY3VS9XdTgxUmVJZ0VJMzhLYnpvW\n DNadzhrQ2paRTVsTHBTczJoQjR2T3R1ZFBnQ2JDc0ZvV1VXb1FpZTRHOVYKTFN3dmZhai9Sc3NJ\n M2c1L1BtTUN5SGRaaE1rYlJ0TW02WUxOdElHNUJ1VDE1MDNwUGtGRFNKdUQwenhIUTdqSwpwNW9\n MZmtRZXVucUM0UlcybHAyMFpuVlYwZ3EyanYvUllld1dSNVAvdndBTWtRZnU0OHRYNWZoY0F4RX\n hyZ2wvClRUZklRYm0zMzJSZ0JwVWRsN2VpT0srSXdGazM3T21tRk1meXgxR3NEMzFnNkJrTk42M\n 2NSQ1pGUmNocU9vNkEKaUV1clhEMVFzeTVFVHpiUGJ5WG5RQVNHSVQ1NmIvdUkyNnFxS0J6eHNH\n ZXlUdTZUdFl6Z1JmejdmbVlJOXl4KwpqRDJQWGMwUkRadzQwbkRxQlZZNWRacXl3RXFyRXB6UWI\n 2aEI4eG9ONldvcG94aDh3UEFaZEErTHBweVc5NTFOCm5lVVFnQT09Cj1odmtMCi0tLS0tRU5EIF\n BHUCBNRVNTQUdFLS0tLS0K","X-Developer-Key":"i=manos.pitsidianakis@linaro.org; a=openpgp;\n fpr=7C721DF9DB3CC7182311C0BF68BC211D47B421E1","Received-SPF":"pass client-ip=2a00:1450:4864:20::434;\n envelope-from=manos.pitsidianakis@linaro.org; helo=mail-wr1-x434.google.com","X-Spam_score_int":"-20","X-Spam_score":"-2.1","X-Spam_bar":"--","X-Spam_report":"(-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1,\n DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1,\n RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001,\n SPF_PASS=-0.001 autolearn=unavailable autolearn_force=no","X-Spam_action":"no action","X-BeenThere":"qemu-devel@nongnu.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"qemu development ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Errors-To":"qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org","Sender":"qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org"},"content":"It must be at least sizeof(virtio_snd_pcm_status).\n\nI haven't verified if it's possible to get an underflow, but coverity\npoints it out in CID 1547527 so add a check.\n\nReviewed-by: Alex Bennée \nSigned-off-by: Manos Pitsidianakis \n---\n hw/audio/virtio-snd.c | 8 +++++---\n 1 file changed, 5 insertions(+), 3 deletions(-)","diff":"diff --git a/hw/audio/virtio-snd.c b/hw/audio/virtio-snd.c\nindex fb5cff386606d03e5cfce88f79e404e510bbcde7..93fbcfb43f7fdcfd5c164b496015da743822f5eb 100644\n--- a/hw/audio/virtio-snd.c\n+++ b/hw/audio/virtio-snd.c\n@@ -970,12 +970,14 @@ static void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n }\n \n stream = vsnd->pcm.streams[stream_id];\n- if (stream == NULL || stream->info.direction != VIRTIO_SND_D_INPUT) {\n+ size = iov_size(elem->in_sg, elem->in_num);\n+ if (stream == NULL\n+ || stream->info.direction != VIRTIO_SND_D_INPUT\n+ || size < sizeof(virtio_snd_pcm_status)) {\n goto rx_err;\n }\n+ size -= sizeof(virtio_snd_pcm_status);\n WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n- size = iov_size(elem->in_sg, elem->in_num) -\n- sizeof(virtio_snd_pcm_status);\n buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size);\n buffer->elem = elem;\n buffer->vq = vq;\n","prefixes":["v3","1/2"]}