From: Jonathan Cameron Date: Fri, 1 Nov 2024 13:39:11 +0000 (+0000) Subject: hw/cxl: Check enough data in cmd_firmware_update_transfer() X-Git-Tag: v9.2.0-rc0~17^2~15 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a3995360aeec62902f045142840c1fd334e9725f;p=thirdparty%2Fqemu.git hw/cxl: Check enough data in cmd_firmware_update_transfer() Buggy guest can write a message that advertises more data that is provided. As QEMU internally duplicates the reported message size, this may result in an out of bounds access. Add sanity checks on the size to avoid this. Reported-by: Esifiel Signed-off-by: Jonathan Cameron Message-Id: <20241101133917.27634-5-Jonathan.Cameron@huawei.com> Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin --- diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c index 3cb499a24fd..27fadc4fa81 100644 --- a/hw/cxl/cxl-mailbox-utils.c +++ b/hw/cxl/cxl-mailbox-utils.c @@ -705,6 +705,10 @@ static CXLRetCode cmd_firmware_update_transfer(const struct cxl_cmd *cmd, } QEMU_PACKED *fw_transfer = (void *)payload_in; size_t offset, length; + if (len < sizeof(*fw_transfer)) { + return CXL_MBOX_INVALID_PAYLOAD_LENGTH; + } + if (fw_transfer->action == CXL_FW_XFER_ACTION_ABORT) { /* * At this point there aren't any on-going transfers