{"id":2230213,"url":"http://patchwork.ozlabs.org/api/1.1/patches/2230213/?format=json","web_url":"http://patchwork.ozlabs.org/project/qemu-devel/patch/20260429122845.2119072-1-physicalmtea@gmail.com/","project":{"id":14,"url":"http://patchwork.ozlabs.org/api/1.1/projects/14/?format=json","name":"QEMU Development","link_name":"qemu-devel","list_id":"qemu-devel.nongnu.org","list_email":"qemu-devel@nongnu.org","web_url":"","scm_url":"","webscm_url":""},"msgid":"<20260429122845.2119072-1-physicalmtea@gmail.com>","date":"2026-04-29T12:28:45","name":"hw/cxl: bound remaining Set Feature writes","commit_ref":null,"pull_url":null,"state":"new","archived":false,"hash":"26db89b06e7ab61e35c21e3fdd438c8932934047","submitter":{"id":93269,"url":"http://patchwork.ozlabs.org/api/1.1/people/93269/?format=json","name":"Jia Jia","email":"physicalmtea@gmail.com"},"delegate":null,"mbox":"http://patchwork.ozlabs.org/project/qemu-devel/patch/20260429122845.2119072-1-physicalmtea@gmail.com/mbox/","series":[{"id":502053,"url":"http://patchwork.ozlabs.org/api/1.1/series/502053/?format=json","web_url":"http://patchwork.ozlabs.org/project/qemu-devel/list/?series=502053","date":"2026-04-29T12:28:45","name":"hw/cxl: bound remaining Set Feature writes","version":1,"mbox":"http://patchwork.ozlabs.org/series/502053/mbox/"}],"comments":"http://patchwork.ozlabs.org/api/patches/2230213/comments/","check":"pending","checks":"http://patchwork.ozlabs.org/api/patches/2230213/checks/","tags":{},"headers":{"Return-Path":"","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256\n header.s=20251104 header.b=c0empiY/;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=nongnu.org\n (client-ip=209.51.188.17; helo=lists1p.gnu.org;\n envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org;\n receiver=patchwork.ozlabs.org)"],"Received":["from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17])\n\t(using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g5H9q3PsDz1yHZ\n\tfor ; Wed, 29 Apr 2026 22:46:37 +1000 (AEST)","from localhost ([::1] helo=lists1p.gnu.org)\n\tby lists1p.gnu.org with esmtp (Exim 4.90_1)\n\t(envelope-from )\n\tid 1wI4Ib-0003tU-GI; Wed, 29 Apr 2026 08:45:54 -0400","from eggs.gnu.org ([2001:470:142:3::10])\n by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)\n (Exim 4.90_1) (envelope-from )\n id 1wI42C-0000We-CN\n for qemu-devel@nongnu.org; Wed, 29 Apr 2026 08:28:56 -0400","from mail-pl1-x632.google.com ([2607:f8b0:4864:20::632])\n by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128)\n (Exim 4.90_1) (envelope-from )\n id 1wI42A-00044O-84\n for qemu-devel@nongnu.org; Wed, 29 Apr 2026 08:28:56 -0400","by mail-pl1-x632.google.com with SMTP id\n d9443c01a7336-2b7adb38d65so61685855ad.2\n for ; Wed, 29 Apr 2026 05:28:53 -0700 (PDT)","from jia.. ([114.249.134.218]) by smtp.gmail.com with ESMTPSA id\n d9443c01a7336-2b988772e9csm21079935ad.9.2026.04.29.05.28.49\n (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n Wed, 29 Apr 2026 05:28:51 -0700 (PDT)"],"DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=gmail.com; s=20251104; t=1777465732; x=1778070532; darn=nongnu.org;\n h=content-transfer-encoding:mime-version:message-id:date:subject:cc\n :to:from:from:to:cc:subject:date:message-id:reply-to;\n bh=5eMx0iBuYl2OSxD/RccAMVzR1/aIPsHq+RnfmrGkecI=;\n b=c0empiY/r8PfCWgEWHciPoGBvgPUHMgMC8/LJXULThKxw/h8ag/jo8TsMe1aKoWB4m\n EWkaVAfh9EMAYs+pG+IqWk8heq91yguvIP0t5UdpkIFYmCr5XBbYCS2X37LT2h6X+24E\n B+EV9aaYV4MT+ErVhwFh3N1YRd0asTsCsovQ1fSQV2oeQSevvX2KcKOgXlonixgK4Mjf\n ux5plYI8l0Hihd7Vk3naC0+V/0hNJxLyWVyV6XAlcUbwigBCFbTeCLXdDJ657H6yIDm4\n JIzAGua7XYJL/fa+TUTkkEgGjA+8F8Vgh4ZAGjfMMYDlmty1l0l6UxV094kpzyfJ2ckx\n LhyA==","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1777465732; x=1778070532;\n h=content-transfer-encoding:mime-version:message-id:date:subject:cc\n :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date\n :message-id:reply-to;\n bh=5eMx0iBuYl2OSxD/RccAMVzR1/aIPsHq+RnfmrGkecI=;\n b=DiWr53XWfEzkrLRBoygs17GhG9xY/1A6or7jfgi7p1T5rs8lT+kn23G9yCzUg7l5uz\n qrfdfEDV3Zo0696FaeuZmFddalVZZl4/ad873rLWuUkfvHU1cyLcEhpxbqp9nn2kn6MF\n iE9iO0KV1isK/iA6YJkuPfiVB7LKsMui1HvfCa+wVJ7YeEm7JkxV3iJjLx5vXG404FFu\n kJjJt136Ddf+Z3/DsQ7PXj+mOWDrlPy8Zk1ZznkmiCUIpdHFYQn1c5EM/1lx/vepqFTW\n 8q07c1YteRAJ9pXr2hISUH4IO093+2IjNu38jfVK8hLRU78vuekup0VZWYGlEacBC+8v\n 0obg==","X-Gm-Message-State":"AOJu0Yw6/SqTFBGxucVy1JBjpbVzKeXpp+A/bt52ZB75YiNvg19Bbaig\n YLZn3GQSiP2elDK/LxUU3dk0bThy/T63hQO6gpP2kPzU9R6g0RCjnVi1Jki436IZZy+FuA==","X-Gm-Gg":"AeBDievIsF9dZWANCuRFcDQZ6qiuBXHEuuGdDKPlXrh1ERGFnjeCGG1FHAfw+km5GCo\n iiu5umRCo0Eul2DU2JYZvdk6sPoeNK/7O+yprvlqh5QTCwezY9HUbIZGS/l2om86oq6/o1NtRDW\n JpweZhHRhK6YRQCW5DQDtBjuNYdzoBNxGe8T2vnPDAbdsWz2bqTN18gqtquBHDX29eVEtwwzwHN\n cIBkJabtCtmaQGC1UYZZEb8P5Vyuu5LW7VmE3v6NLWIrBQ5Z9lFIRXaBwzw5OJJ5g7I9BgTJI9n\n borqlxUDp8q67R+lCd0qfCFAQNdzxHZCiFQpIk6147XJcYsjKR9E2LZPHZKJrxJ/qVq2135Nkdh\n 8Kp8D1ckeUD/+BSiMtiS5GqVe+dOFJtPiAVGqwhjZ+YgkAG0Z7mGh3SWSKZJYlDunwLf/BJeH8P\n XzDVvrfqHUowNhGJrp4lOO6NcMgKGuGQ==","X-Received":"by 2002:a17:903:2acc:b0:2b2:4cd2:e162 with SMTP id\n d9443c01a7336-2b97c48d869mr71975645ad.34.1777465731581;\n Wed, 29 Apr 2026 05:28:51 -0700 (PDT)","From":"Jia Jia ","To":"qemu-devel@nongnu.org","Cc":"jonathan.cameron@huawei.com, fan.ni@samsung.com, farosas@suse.de,\n lvivier@redhat.com, pbonzini@redhat.com","Subject":"[PATCH] hw/cxl: bound remaining Set Feature writes","Date":"Wed, 29 Apr 2026 20:28:45 +0800","Message-Id":"<20260429122845.2119072-1-physicalmtea@gmail.com>","X-Mailer":"git-send-email 2.34.1","MIME-Version":"1.0","Content-Transfer-Encoding":"8bit","Received-SPF":"pass client-ip=2607:f8b0:4864:20::632;\n envelope-from=physicalmtea@gmail.com; helo=mail-pl1-x632.google.com","X-Spam_score_int":"-20","X-Spam_score":"-2.1","X-Spam_bar":"--","X-Spam_report":"(-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1,\n DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001,\n RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001,\n SPF_PASS=-0.001 autolearn=ham autolearn_force=no","X-Spam_action":"no action","X-Mailman-Approved-At":"Wed, 29 Apr 2026 08:45:51 -0400","X-BeenThere":"qemu-devel@nongnu.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"qemu development ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Errors-To":"qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org","Sender":"qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org"},"content":"Commit c1c4d6b38b13 added offset + length checks for the\npatrol_scrub and ecs Set Feature branches, but the remaining\nbranches still copy mailbox payload data into fixed-size\nwrite-attribute objects without the same validation.\n\nA full mailbox payload can still reach rank_sparing and overrun\nCXLMemSparingWriteAttrs on current master. With an ASan build\nthis aborts the host process with:\n\n ERROR: AddressSanitizer: heap-buffer-overflow\n WRITE of size 2016\n #0 __interceptor_memcpy\n #1 cmd_features_set_feature ../hw/cxl/cxl-mailbox-utils.c:1908\n #2 cxl_process_cci_message ../hw/cxl/cxl-mailbox-utils.c:4622\n #3 mailbox_reg_write ../hw/cxl/cxl-device-utils.c:209\n\nApply the same offset + length validation to soft_ppr,\nhard_ppr, cacheline_sparing, row_sparing, bank_sparing, and\nrank_sparing so oversized requests fail with\nCXL_MBOX_INVALID_PAYLOAD_LENGTH instead of overflowing the\nwrite-attribute buffers.\n\nAdd a qtest covering the rank_sparing path.\n\nResolves: https://gitlab.com/qemu-project/qemu/-/work_items/3458\nSigned-off-by: Jia Jia \n---\n hw/cxl/cxl-mailbox-utils.c | 20 ++++++++\n tests/qtest/cxl-test.c | 99 ++++++++++++++++++++++++++++++++++++++\n 2 files changed, 119 insertions(+)","diff":"diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c\nindex d8ba7e8625..ce139e30eb 100644\n--- a/hw/cxl/cxl-mailbox-utils.c\n+++ b/hw/cxl/cxl-mailbox-utils.c\n@@ -1713,6 +1713,7 @@ static CXLRetCode cmd_features_set_feature(const struct cxl_cmd *cmd,\n CXLSetFeatureInHeader *hdr = (void *)payload_in;\n CXLSetFeatureInfo *set_feat_info;\n uint16_t bytes_to_copy = 0;\n+ uint32_t end_offset;\n uint8_t data_transfer_flag;\n CXLType3Dev *ct3d;\n uint16_t count;\n@@ -1746,6 +1747,7 @@ static CXLRetCode cmd_features_set_feature(const struct cxl_cmd *cmd,\n set_feat_info->data_transfer_flag = data_transfer_flag;\n set_feat_info->data_offset = hdr->offset;\n bytes_to_copy = len_in - sizeof(CXLSetFeatureInHeader);\n+ end_offset = (uint32_t)hdr->offset + bytes_to_copy;\n \n if (bytes_to_copy == 0) {\n return CXL_MBOX_INVALID_PAYLOAD_LENGTH;\n@@ -1813,6 +1815,9 @@ static CXLRetCode cmd_features_set_feature(const struct cxl_cmd *cmd,\n return CXL_MBOX_UNSUPPORTED;\n }\n \n+ if (end_offset > sizeof(ct3d->soft_ppr_wr_attrs)) {\n+ return CXL_MBOX_INVALID_PAYLOAD_LENGTH;\n+ }\n memcpy((uint8_t *)&ct3d->soft_ppr_wr_attrs + hdr->offset,\n sppr_write_attrs, bytes_to_copy);\n set_feat_info->data_size += bytes_to_copy;\n@@ -1832,6 +1837,9 @@ static CXLRetCode cmd_features_set_feature(const struct cxl_cmd *cmd,\n return CXL_MBOX_UNSUPPORTED;\n }\n \n+ if (end_offset > sizeof(ct3d->hard_ppr_wr_attrs)) {\n+ return CXL_MBOX_INVALID_PAYLOAD_LENGTH;\n+ }\n memcpy((uint8_t *)&ct3d->hard_ppr_wr_attrs + hdr->offset,\n hppr_write_attrs, bytes_to_copy);\n set_feat_info->data_size += bytes_to_copy;\n@@ -1851,6 +1859,9 @@ static CXLRetCode cmd_features_set_feature(const struct cxl_cmd *cmd,\n return CXL_MBOX_UNSUPPORTED;\n }\n \n+ if (end_offset > sizeof(ct3d->cacheline_sparing_wr_attrs)) {\n+ return CXL_MBOX_INVALID_PAYLOAD_LENGTH;\n+ }\n memcpy((uint8_t *)&ct3d->cacheline_sparing_wr_attrs + hdr->offset,\n mem_sparing_write_attrs, bytes_to_copy);\n set_feat_info->data_size += bytes_to_copy;\n@@ -1869,6 +1880,9 @@ static CXLRetCode cmd_features_set_feature(const struct cxl_cmd *cmd,\n return CXL_MBOX_UNSUPPORTED;\n }\n \n+ if (end_offset > sizeof(ct3d->row_sparing_wr_attrs)) {\n+ return CXL_MBOX_INVALID_PAYLOAD_LENGTH;\n+ }\n memcpy((uint8_t *)&ct3d->row_sparing_wr_attrs + hdr->offset,\n mem_sparing_write_attrs, bytes_to_copy);\n set_feat_info->data_size += bytes_to_copy;\n@@ -1887,6 +1901,9 @@ static CXLRetCode cmd_features_set_feature(const struct cxl_cmd *cmd,\n return CXL_MBOX_UNSUPPORTED;\n }\n \n+ if (end_offset > sizeof(ct3d->bank_sparing_wr_attrs)) {\n+ return CXL_MBOX_INVALID_PAYLOAD_LENGTH;\n+ }\n memcpy((uint8_t *)&ct3d->bank_sparing_wr_attrs + hdr->offset,\n mem_sparing_write_attrs, bytes_to_copy);\n set_feat_info->data_size += bytes_to_copy;\n@@ -1905,6 +1922,9 @@ static CXLRetCode cmd_features_set_feature(const struct cxl_cmd *cmd,\n return CXL_MBOX_UNSUPPORTED;\n }\n \n+ if (end_offset > sizeof(ct3d->rank_sparing_wr_attrs)) {\n+ return CXL_MBOX_INVALID_PAYLOAD_LENGTH;\n+ }\n memcpy((uint8_t *)&ct3d->rank_sparing_wr_attrs + hdr->offset,\n mem_sparing_write_attrs, bytes_to_copy);\n set_feat_info->data_size += bytes_to_copy;\ndiff --git a/tests/qtest/cxl-test.c b/tests/qtest/cxl-test.c\nindex 8fb7e58d4f..a9fcd98736 100644\n--- a/tests/qtest/cxl-test.c\n+++ b/tests/qtest/cxl-test.c\n@@ -7,6 +7,7 @@\n \n #include \"qemu/osdep.h\"\n #include \"libqtest-single.h\"\n+#include \"hw/cxl/cxl_device.h\"\n \n #define QEMU_PXB_CMD \\\n \"-machine q35,cxl=on \" \\\n@@ -59,6 +60,12 @@\n \"-object memory-backend-file,id=lsa0,mem-path=%s,size=256M \" \\\n \"-device cxl-type3,bus=rp0,volatile-memdev=cxl-mem0,lsa=lsa0,id=mem0 \"\n \n+#define QEMU_T3D_DIRECT_PMEM \\\n+ \"-machine q35,cxl=on -nodefaults \" \\\n+ \"-object memory-backend-file,id=cxl-mem0,mem-path=%s,size=256M \" \\\n+ \"-object memory-backend-file,id=lsa0,mem-path=%s,size=1M \" \\\n+ \"-device cxl-type3,bus=pcie.0,persistent-memdev=cxl-mem0,lsa=lsa0,id=pmem0 \"\n+\n #define QEMU_2T3D \\\n \"-object memory-backend-file,id=cxl-mem0,mem-path=%s,size=256M \" \\\n \"-object memory-backend-file,id=lsa0,mem-path=%s,size=256M \" \\\n@@ -81,6 +88,17 @@\n \"-object memory-backend-file,id=lsa3,mem-path=%s,size=256M \" \\\n \"-device cxl-type3,bus=rp3,persistent-memdev=cxl-mem3,lsa=lsa3,id=pmem3 \"\n \n+#define CXL_T3D_DEVFN 0x08\n+#define CXL_T3D_BAR2_ADDR 0x10000000ULL\n+\n+typedef struct QEMU_PACKED CXLSetFeatureInHeaderTest {\n+ uint8_t uuid[16];\n+ uint32_t flags;\n+ uint16_t offset;\n+ uint8_t version;\n+ uint8_t rsvd[9];\n+} CXLSetFeatureInHeaderTest;\n+\n static void cxl_basic_hb(void)\n {\n qtest_start(\"-machine q35,cxl=on\");\n@@ -118,6 +136,85 @@ static void cxl_2root_port(void)\n }\n \n #ifdef CONFIG_POSIX\n+static uint32_t cxl_test_pci_config_addr(uint8_t devfn, uint8_t offset)\n+{\n+ return 0x80000000U | (devfn << 8) | offset;\n+}\n+\n+static void cxl_test_t3d_enable_bar2(void)\n+{\n+ outl(0xcf8, cxl_test_pci_config_addr(CXL_T3D_DEVFN, 0x18));\n+ outl(0xcfc, CXL_T3D_BAR2_ADDR);\n+ outl(0xcf8, cxl_test_pci_config_addr(CXL_T3D_DEVFN, 0x1c));\n+ outl(0xcfc, 0);\n+ outl(0xcf8, cxl_test_pci_config_addr(CXL_T3D_DEVFN, 0x04));\n+ outl(0xcfc, 0x2);\n+}\n+\n+static uint64_t cxl_test_t3d_mailbox_base(void)\n+{\n+ return CXL_T3D_BAR2_ADDR + CXL_MAILBOX_REGISTERS_OFFSET;\n+}\n+\n+static uint64_t cxl_test_t3d_payload_base(void)\n+{\n+ return cxl_test_t3d_mailbox_base() + A_CXL_DEV_CMD_PAYLOAD;\n+}\n+\n+static void cxl_test_t3d_submit_set_feature(const void *payload, size_t len)\n+{\n+ memwrite(cxl_test_t3d_payload_base(), payload, len);\n+ writeq(cxl_test_t3d_mailbox_base() + A_CXL_DEV_MAILBOX_CMD,\n+ ((uint64_t)len << 16) | (0x05 << 8) | 0x02);\n+ writel(cxl_test_t3d_mailbox_base() + A_CXL_DEV_MAILBOX_CTRL, 1);\n+}\n+\n+static uint16_t cxl_test_t3d_mailbox_errno(void)\n+{\n+ return (readq(cxl_test_t3d_mailbox_base() + A_CXL_DEV_MAILBOX_STS) >>\n+ 32) & 0xffff;\n+}\n+\n+static void cxl_test_fill_set_feature_header(CXLSetFeatureInHeaderTest *hdr,\n+ const uint8_t uuid[16],\n+ uint16_t offset,\n+ uint8_t version)\n+{\n+ memset(hdr, 0, sizeof(*hdr));\n+ memcpy(hdr->uuid, uuid, 16);\n+ hdr->offset = cpu_to_le16(offset);\n+ hdr->version = version;\n+}\n+\n+static void cxl_t3d_set_feature_rejects_oversized_rank_sparing(void)\n+{\n+ static const uint8_t rank_sparing_uuid[16] = {\n+ 0x34, 0xdb, 0xaf, 0xf5, 0x05, 0x52, 0x42, 0x81,\n+ 0x8f, 0x76, 0xda, 0x0b, 0x5e, 0x7a, 0x76, 0xa7,\n+ };\n+ g_autoptr(GString) cmdline = g_string_new(NULL);\n+ g_autofree const char *tmpfs = NULL;\n+ uint8_t payload[CXL_MAILBOX_MAX_PAYLOAD_SIZE] = { 0 };\n+ CXLSetFeatureInHeaderTest *hdr = (void *)payload;\n+\n+ tmpfs = g_dir_make_tmp(\"cxl-test-XXXXXX\", NULL);\n+ g_string_printf(cmdline, QEMU_T3D_DIRECT_PMEM, tmpfs, tmpfs);\n+\n+ qtest_start(cmdline->str);\n+ cxl_test_t3d_enable_bar2();\n+\n+ cxl_test_fill_set_feature_header(hdr, rank_sparing_uuid, 0,\n+ CXL_MEMDEV_SPARING_SET_FEATURE_VERSION);\n+ memset(payload + sizeof(*hdr), 0x41,\n+ sizeof(payload) - sizeof(*hdr));\n+ cxl_test_t3d_submit_set_feature(payload, sizeof(payload));\n+ g_assert_cmphex(cxl_test_t3d_mailbox_errno(), ==,\n+ CXL_MBOX_INVALID_PAYLOAD_LENGTH);\n+\n+ qtest_end();\n+ rmdir(tmpfs);\n+}\n+\n static void cxl_t3d_deprecated(void)\n {\n g_autoptr(GString) cmdline = g_string_new(NULL);\n@@ -238,6 +335,8 @@ int main(int argc, char **argv)\n qtest_add_func(\"/pci/cxl/type3_device_pmem\", cxl_t3d_persistent);\n qtest_add_func(\"/pci/cxl/type3_device_vmem\", cxl_t3d_volatile);\n qtest_add_func(\"/pci/cxl/type3_device_vmem_lsa\", cxl_t3d_volatile_lsa);\n+ qtest_add_func(\"/pci/cxl/type3_device_set_feature_rank_sparing_bounds\",\n+ cxl_t3d_set_feature_rejects_oversized_rank_sparing);\n qtest_add_func(\"/pci/cxl/rp_x2_type3_x2\", cxl_1pxb_2rp_2t3d);\n qtest_add_func(\"/pci/cxl/pxb_x2_root_port_x4_type3_x4\",\n cxl_2pxb_4rp_4t3d);\n","prefixes":[]}