Stefan Hajnoczi [Tue, 28 Jul 2026 21:00:42 +0000 (17:00 -0400)]
Merge tag 'pull-parallels-2026-07-28' of https://gitlab.com/dlunev/qemu into staging
Parallels block driver patches
- fix a reachable assert()/process abort on a crafted image with an
inconsistent BAT vs. advertised disk size (GitLab #3804)
- fix related integer overflows capping the format's usable catalog
size below its documented maximum
- reject BAT entries pointing outside the data area in either
direction
- harden the dirty-bitmap extension loader against a reachable
abort and an unsafe allocator
# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCgAdFiEEC66qh9MCCtwRUOUfXgdxtstmbKsFAmpoy6UACgkQXgdxtstm
# bKvDcA/7Bis1fqsgvsLDiLfxPmNXmaA6JwsHLCgcqnBtrlfucLpDghsE6Nr6Lthb
# zgkYuWrNRtnIwbGEe4oW4jEukLb8k6hyUlwfQvIQik3rV0nnv1G4ewQMH7TmLKX+
# xqFSK+TUpW5bQMphH3yOM2IShgytCXirPSZLfz1GY76eOSWcab/SgzPhANTf6bG3
# o3eVZML9GrPDeDx3MuNdqfup+pX081xOM9l3Ub1hn8YRVvvZiaEmaw4HvT66Qnul
# XL9/biNii0r7b4uITOj6Pvvft7W5yW5d+VL9P5hiidDvhwpC6CAjpu7/qScA3ZH2
# v3MWnXwOEPLnmUE43ZR/8Vb07bHdSHuVLGgD7RPdmWGMMM2pzaCpbMRkdr9ABY5k
# IdPISsijSeGt4Vi9hhXsBiL2tzBJ0w8w+x6o7YNM8RkHzKm7APWwKssJ6kIyQC7g
# ImNgSVRbXBf+4bAD2MUiy3MOfkJ8li9oCXuFaC9fUx5Y4Y4DZdAmARjccUNwttMa
# oixwlypndqJsXspikAsqQqMqA/cVAUd+rec2jDVx3W2nhZsV3KsMu8hD4jYeQkTx
# CRi7owYuA0Z+eNLVvdsji292GcQKP7jcriM1gsSbhyyYDJUT3FHtpNKUxWOr1nFz
# YWj8xSPy5rCpO9CheSXWtk7v/GKpq3riQ48KBbnfArBNxPBPNDY=
# =aCB6
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 28 Jul 2026 11:32:53 EDT
# gpg: using RSA key 0BAEAA87D3020ADC1150E51F5E0771B6CB666CAB
# gpg: Good signature from "Denis V. Lunev <den@openvz.org>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 0BAE AA87 D302 0ADC 1150 E51F 5E07 71B6 CB66 6CAB
* tag 'pull-parallels-2026-07-28' of https://gitlab.com/dlunev/qemu:
MAINTAINERS: update parallels tree location
parallels: validate BAT capacity against advertised disk size
parallels: avoid fatal abort on large bitmap L1 table
parallels: skip loading a genuinely empty bitmap L1 table
parallels: validate bitmap L1 table size before allocating it
parallels: reject BAT entries pointing outside backed storage
parallels: fix bat_entries overflow in image creation
parallels: read header/BAT table in bounded chunks
parallels: fix integer overflow in header size calculation
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Klaus Jensen [Tue, 28 Jul 2026 09:42:29 +0000 (11:42 +0200)]
hw/nvme: fix unintentional integer overflow in shift
Fix potentially overflowing shift operation.
Cc: qemu-stable@nongnu.org Suggested-by: Peter Maydell <peter.maydell@linaro.org> Suggested-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Resolves: Coverity CID 1663674 Fixes: ec917cd49918 ("hw/nvme: fix FDP set FDP events") Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
The NVMe specification allows a controller with multiple namespaces to
use different LBA formats per namespace. One implication of this is that
the destination namespace may have a metadata area for PI, but the
source does not. In that case, the controller shall generate the
protection information, but the bounce buffer is erroneously allocated
without space for that, causing a buffer overflow.
Fix the allocation.
Cc: qemu-stable@nongnu.org Fixes: d522aef88d42 ("hw/nvme: add cross namespace copy support")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3387 Reported-by: Jihe Wang <wangjihe.mail@gmail.com> Reported-by: boy juju <agx1657748706@gmail.com> Reported-by: contact <contact@xchglabs.com> Reported-by: david korczynski <david@adalogics.com> Reported-by: Brian Chastain (off_by_one / Curious-Keeper) <brian@scalingsuccess.io> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
Daniel Paziyski [Sun, 26 Jul 2026 18:30:08 +0000 (20:30 +0200)]
hw/nvme: fix assertion failure on subregion removal
When a controller is created with a MSI-X exclusive BAR, the bar0 memory region
is not used at all, and so, the iomem region is not added as a subregion of it.
However, when removing a NVMe controller, the iomem region is unconditionally
removed as a subregion of bar0, causing an assertion failure. Remove the iomem
memory region as a subregion of bar0 only if not using a MSI-X exclusive BAR.
Let's use GPtrArray to build a list of blocker features and then
g_strjoinv() to build a final comma-delimited string.
While previous approach was technically correct, it is fragile
(because we need to take care of static buffer size choice) and
Coverity dislikes it too.
Note, that we use g_ptr_array_new() to allocate array which means
that GDestroyNotify callback is not set, so we can pass pointers to
a static memory like g_ptr_array_add(..., (gpointer) "SR-IOV") without
any problems as there won't be any attempt to free that memory.
Resolves: Coverity CID 1663673 Suggested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@futurfusion.io> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Klaus Jensen <k.jensen@samsung.com>
[k.jensen: change cast from gpointer to void ptr] Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
parallels: validate BAT capacity against advertised disk size
parallels_open() copied nb_sectors, tracks, and bat_entries from the
image header without checking that the BAT actually covers the
advertised virtual disk size. An image whose header claims more
sectors than its BAT covers passes the generic block-layer bounds
check on open. A write into the gap between BAT coverage and the
advertised size then reaches allocate_clusters(), whose internal
assert(idx < s->bat_size && idx + to_allocate <= s->bat_size) aborts
the process instead of returning a normal I/O error.
Reject such images at open time by requiring
bat_size * tracks >= total_sectors, matching the invariant that
allocate_clusters() already assumes.
Reported-by: Feifan Qian <bea1e@proton.me>
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3804 Signed-off-by: Denis V. Lunev <den@openvz.org> CC: Thomas Huth <thuth@redhat.com> CC: Stefan Hajnoczi <stefanha@redhat.com>
parallels: skip loading a genuinely empty bitmap L1 table
parallels_load_bitmap_data() unconditionally calls
bdrv_dirty_bitmap_deserialize_finish() even when there is nothing to
deserialize, which hits an assertion in hbitmap
(hbitmap_iter_init: 'pos < hb->size') when the bitmap itself has
zero size, i.e. the disk is a zero-sector image.
Skip allocating, populating and loading the L1 table entirely when
l1_size == 0. This is safe only because the previous commit already
guarantees l1_size == 0 exclusively means the disk has 0 size.
Signed-off-by: Denis V. Lunev <den@openvz.org> CC: Thomas Huth <thuth@redhat.com> CC: Stefan Hajnoczi <stefanha@redhat.com>
parallels: validate bitmap L1 table size before allocating it
parallels_load_bitmap() allocated the L1 table sized directly from
the untrusted l1_size field, only cross-checking it against the
bitmap's actual size after the allocation and the L1 table copy had
already happened.
Compute the expected size and reject a mismatch before touching the
allocator, instead of after.
Signed-off-by: Denis V. Lunev <den@openvz.org> CC: Thomas Huth <thuth@redhat.com> CC: Stefan Hajnoczi <stefanha@redhat.com>
parallels: reject BAT entries pointing outside backed storage
parallels_open()'s BAT scan and parallels_check_outside_image() only
checked entries against the file's upper end, matching just half of
what docs/interop/parallels.rst requires: an entry's offset must be
both >= data_start and < the file size. An entry below data_start
resolves into the header/BAT region itself, corrupting metadata on
write or losing the write silently on a partial overlap, and neither
qemu-img check nor the open-time scan ever caught it.
Check both bounds everywhere a BAT entry is resolved to a host
offset: seek_to_sector(), the open-time scan (without letting a bad
entry inflate data_end), and parallels_check_outside_image().
Signed-off-by: Denis V. Lunev <den@openvz.org> CC: Thomas Huth <thuth@redhat.com> CC: Stefan Hajnoczi <stefanha@redhat.com>
parallels: fix bat_entries overflow in image creation
parallels_co_create() computed the BAT entry count directly into a
uint32_t, wrapping silently to zero at exactly 2^32 entries and
writing out a header whose BAT no longer matches its advertised
size. Compute it in an int64_t first and reject it once it no longer
fits, matching the cap parallels_open() already enforces. Also
reject cluster-size 0, and clamp header.cylinders instead of letting
it truncate the same way.
Signed-off-by: Denis V. Lunev <den@openvz.org> CC: Thomas Huth <thuth@redhat.com> CC: Stefan Hajnoczi <stefanha@redhat.com>
parallels: read header/BAT table in bounded chunks
parallels_open() read the whole header+BAT table with a single
bdrv_pread() call sized s->header_size. For an image whose catalog
approaches the "Catalog too large" bound (INT_MAX / sizeof(uint32_t)
entries), that size approaches BDRV_REQUEST_MAX_BYTES, and the block
layer legitimately refuses a single request that large, so the image
failed to open with a generic I/O error even though the catalog size
itself is within the format's documented limit.
Read the header and BAT table in fixed-size chunks instead, so the
maximum catalog size parallels_open() can actually address matches
the bound it already enforces, independent of the file's block-layer
alignment requirements.
Signed-off-by: Denis V. Lunev <den@openvz.org> CC: Thomas Huth <thuth@redhat.com> CC: Stefan Hajnoczi <stefanha@redhat.com>
* tag 'hw-misc-20260728' of https://github.com/philmd/qemu:
tests/functional/ppc: skip remote interrupts test if -net user not built
target/sparc: set reg window data structures currently after vmstate load
hw/net/igb: recalculate rx_desc_len on migration load
hw/net/e1000e: recalculate rx_desc_len on migration load
hw/sd/sdhci: Extract uSDHC-specific quirk
hw/net/xilinx_axienet: Don't write checksums off end of packet
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Stefan Hajnoczi [Tue, 28 Jul 2026 14:03:54 +0000 (10:03 -0400)]
Merge tag 'linux-user-pull-request' of https://github.com/hdeller/qemu-hppa into staging
linux-user patches
Enable fsmount() syscalls, fix build with Linux 7.2 kernel headers and
allow full 32-bit address space on sh4.
# -----BEGIN PGP SIGNATURE-----
#
# iHUEABYKAB0WIQS86RI+GtKfB8BJu973ErUQojoPXwUCamhzJgAKCRD3ErUQojoP
# X2WUAP9UOBDozOx0rqpDRDM1ktMQdp3zaUT+wJIyLojcNZcj8QD/aaImcmjuU4h9
# Slgtdh5qtIUJynvOemumwW442Ftd3AQ=
# =RFH+
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 28 Jul 2026 05:15:18 EDT
# gpg: using EDDSA key BCE9123E1AD29F07C049BBDEF712B510A23A0F5F
# gpg: Good signature from "Helge Deller <deller@gmx.de>" [unknown]
# gpg: aka "Helge Deller <deller@kernel.org>" [unknown]
# gpg: aka "Helge Deller <deller@debian.org>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 4544 8228 2CD9 10DB EF3D 25F8 3E5F 3D04 A7A2 4603
# Subkey fingerprint: BCE9 123E 1AD2 9F07 C049 BBDE F712 B510 A23A 0F5F
* tag 'linux-user-pull-request' of https://github.com/hdeller/qemu-hppa:
linux-user/sh4: allow full 32-bit address space
linux-user: fix guards for the fsmount(2) syscall series
linux-user: Guard local FUTEX_CMD_MASK definition
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Peter Maydell [Mon, 6 Jul 2026 17:33:24 +0000 (18:33 +0100)]
hw/display/exynos4210_fimd: Clamp windows to screen size
In exynos4210_fimd_update(), we iterate through the enabled windows,
blitting them to the screen. We assume here that the guest has not
programmed the window's coordinates to be outside the overall LCD
screen resulation, but we never check this. This can result in the
guest being able to cause us to access outside our allocated
framebuffer backing memory.
Since all the coordinates here are unsigned, they can't be off
the left/top side of the screen, only the bottom/right. If
the top left corner of the window is out of bounds, the whole
window is invisible and we can skip it. If the bottom right
corner is out of bounds, we clamp it to the screen size so that
we only draw the visible part.
Peter Maydell [Mon, 6 Jul 2026 17:33:23 +0000 (18:33 +0100)]
hw/display/exynos4210_fimd: Pass width to draw_line functions
The draw_line functions currently assume the width of the line they
need to draw is w->rightbot_x - w->lefttop_x + 1, i.e. the full
width of the guest-programmed window. We want to be able to clamp
this to the overall screen size, which we can calculate in the
calling function.
Refactor to do this calculation in the caller and pass the
width as an argument to the draw_line functions.
Stable CC because this is a prerequisite for an upcoming bugfix
commit.
Peter Maydell [Mon, 6 Jul 2026 17:33:22 +0000 (18:33 +0100)]
hw/display/exynos4210_fimd: Factor out finding screen width/height
Currently we hard-code the expressions for getting the global screen
width and height out of the VIDTCON2 register where we need them.
Use functions instead. Make the global_width variable in
exynos4210_fimd_update() uint32_t for consistency. (The values are
clamped to well below INT_MAX, so there is no overflow risk here.)
Stable CC because this is a prerequisite for an upcoming bugfix
commit.
The Clock Stretch Timeout (CLKT) register for the BCM2835 I2C
controller is actually located at offset 0x1c, not 0x20.
Update the BCM2835_I2C_CLKT macro to match the hardware
specification.
Since QEMU's implementation ignores whatever value the guest
writes to this register, and Linux only writes to CLKT and
doesn't read it back, the main effect of this fix is to
avoid an incorrect GUEST_ERROR log.
Cc: qemu-stable@nongnu.org Fixes: 9cf3bc65afdb63 ("hw/i2c: Implement Broadcom Serial Controller (BSC)") Signed-off-by: botszhuang <botszhuang@gmail.com> Tested-by: Nick Huang <sef1548@gmail.com>
Message-id: 20260724124220.24152-1-22925483+botszhuang@users.noreply.github.com
[PMM: removed commit message paragraph about effects which I think
is incorrect, substituted a different one] Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Simon Xu [Fri, 24 Jul 2026 16:09:43 +0000 (11:09 -0500)]
hw/misc/mps2-scc.c: fix scc_partno field width
Increase the extract32 length from 8 to 12. The Primary part number is
defined as bits[15:4] by the "SSE-310 with M85 and U55 FPGA"
documentation. For example for the mps3-an547, 0x547 is 12 bits but we
only return 8 bits right now.
Signed-off-by: Simon Xu <simonxhy0404@gmail.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260724160943.52509-3-simonxhy0404@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Simon Xu [Fri, 24 Jul 2026 16:09:42 +0000 (11:09 -0500)]
hw/misc/mps2-scc.c: fix cfg7 write
Change the CFG7 write function to modify the correct variable. This only
affects the an536 machine currently as only it uses cfg7 to store the
core 1 vector table base address.
Signed-off-by: Simon Xu <simonxhy0404@gmail.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260724160943.52509-2-simonxhy0404@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Describe the current OpenBMC target naming and release status for
Nuvoton machines. The latest 2.18.0 release no longer includes GSJ,
so point users at older 2.14.0 sources and explain how to find
Jenkins MTD artifacts.
Signed-off-by: Bin Meng <bin.meng@processmission.com>
Message-id: 20260627063208.33642-1-bin.meng@processmission.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Bernhard Beschow [Mon, 27 Jul 2026 09:28:47 +0000 (10:28 +0100)]
hw/net/can/flexcan: Remove RX SMB raw view
Use the existing `rx_smb0` message buffer view for register masks instead
of the raw register array. Since all accesses now use the structured view,
remove the redundant `rx_smb0_raw` union member.
Signed-off-by: Bernhard Beschow <shentey@gmail.com> Tested-by: Pavel Pisa <pisa@fel.cvut.cz> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-id: 20260723070059.6332-10-shentey@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Bernhard Beschow [Mon, 27 Jul 2026 09:28:47 +0000 (10:28 +0100)]
hw/net/can/flexcan: Fix RXIMR reset mask
The RXIMR registers are not affected by soft reset, so their reset mask
must preserve all entries. Set the mask for the entire array instead of
only the first register.
Signed-off-by: Bernhard Beschow <shentey@gmail.com> Tested-by: Pavel Pisa <pisa@fel.cvut.cz> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-id: 20260723070059.6332-9-shentey@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Bernhard Beschow [Mon, 27 Jul 2026 09:28:46 +0000 (10:28 +0100)]
hw/net/flexcan: Drop oversized 'mb[]' mailbox view
As indicated in the comments, the `mb[]` a.k.a. `mbs []` views should
cover 0x400 (1024) bytes. However, the `mb[]` array covers four times
the size since `sizeof(FlexcanRegsMessageBuffer)` returns the size in
bytes instead of counting the number of uint32_t fields. This shifts the
subsequent register offsets by 0xc00 which is not intended. Fix the size
and thus the offsets by dropping the now unused `mb[]` view.
Note that the different size changes the migration layout. Since the device
model is new, no change in the version fields is needed.
Signed-off-by: Bernhard Beschow <shentey@gmail.com> Tested-by: Pavel Pisa <pisa@fel.cvut.cz> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-id: 20260723070059.6332-8-shentey@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
The mailbox reset mask initialized only the first word of the raw `mb[]`
array. Fix the initialization to cover the whole mailbox, as indicated
in the field description in the header. While at it, use the `mbs[]`
view instead in order to drop the redundant and oversized `mb[]` view in
the next commit.
Signed-off-by: Bernhard Beschow <shentey@gmail.com> Tested-by: Pavel Pisa <pisa@fel.cvut.cz> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-id: 20260723070059.6332-7-shentey@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Bernhard Beschow [Mon, 27 Jul 2026 09:28:46 +0000 (10:28 +0100)]
hw/net/can/flexcan: Fix mailbox index calculation in flexcan_mem_read()
Calculate mailbox indices from the `mbs[]` array layout instead of the
oversized raw `mb[]` view. This prevents accessing mailbox entries beyond
the valid array range and fixes Coverity CID 1662974.
Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Bernhard Beschow <shentey@gmail.com> Tested-by: Pavel Pisa <pisa@fel.cvut.cz> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260723070059.6332-6-shentey@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Bernhard Beschow [Mon, 27 Jul 2026 09:28:46 +0000 (10:28 +0100)]
hw/net/can/flexcan: Fix mailbox index calculation in flexcan_mem_write()
Calculate mailbox indices from the `mbs[]` array layout instead of the
oversized raw `mb[]` view. This prevents accessing mailbox entries beyond
the valid array range and fixes Coverity CID 1662974.
Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Bernhard Beschow <shentey@gmail.com> Tested-by: Pavel Pisa <pisa@fel.cvut.cz> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260723070059.6332-5-shentey@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Bernhard Beschow [Mon, 27 Jul 2026 09:28:46 +0000 (10:28 +0100)]
hw/net/can/flexcan: Fix out-of-bounds access in flexcan_mx_rx()
Require `last_not_free_to_receive_mbid >= 0` before indexing `mbs[]`.
This prevents a possible `-1` array index and fixes Coverity CID 1662790.
Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Bernhard Beschow <shentey@gmail.com> Tested-by: Pavel Pisa <pisa@fel.cvut.cz> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260723070059.6332-4-shentey@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Bernhard Beschow [Mon, 27 Jul 2026 09:28:46 +0000 (10:28 +0100)]
hw/net/flexcan: Drop unused RX FIFO register overlay
Remove the unused `FlexcanRegsRXFifo` union view now that FIFO accesses
use the underlying `mbs[]` array directly.
Signed-off-by: Bernhard Beschow <shentey@gmail.com> Tested-by: Pavel Pisa <pisa@fel.cvut.cz> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-id: 20260723070059.6332-3-shentey@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Bernhard Beschow [Mon, 27 Jul 2026 09:28:46 +0000 (10:28 +0100)]
hw/net/can/flexcan: Use mbs[] array for FIFO pop
Implement FIFO entry shifting using the underlying `mbs[]` array instead
of the overlapping `fifo` union view. This makes it explicit that the
operation copies within a contiguous mailbox array and avoids Coverity
CID 1662971.
Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Bernhard Beschow <shentey@gmail.com> Tested-by: Pavel Pisa <pisa@fel.cvut.cz> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-id: 20260723070059.6332-2-shentey@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Use the stub library introduced in commit 0da978cdbc6 ("target/arm:
define stub library") to prevent symbol conflicts.
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260721122135.6288-5-philmd@oss.qualcomm.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
hw/intc/arm_gicv3: Fix ARM_GICV3 dependency for KVM / WHPX
KVM and WHPX GICv3 implementations call gicv3_init_irqs_and_mmio()
which is defined in arm_gicv3_common.c, itself build when ARM_GIC
is selected. Both KVM and WHPX are conditional on ARM_GICV3,
itself selecting ARM_GIC. Only build the ARM_GICV3 accelerator
variants when ARM_GICV3 is selected.
On real SH4 hardware, the address space is split between user mode
(U0, 0x00000000-0x7fffffff) and kernel mode (P1-P4, 0x80000000-0xffffffff),
so TARGET_VIRT_ADDR_SPACE_BITS was set to 31 for CONFIG_USER_ONLY.
However, qemu-user does not emulate the MMU, so this limit is not needed.
The only effect is to restrict reserved_va to 2 GB, causing OOM failures
for memory-intensive builds (e.g. webkit2gtk on Debian sh4 buildds).
Set TARGET_VIRT_ADDR_SPACE_BITS to 32 unconditionally, like most other
32-bit targets. Also fix the TASK_UNMAPPED_BASE macro to use 1ull instead
of 1u to avoid undefined behavior when shifting by 32.
Reported-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> Signed-off-by: Laurent Vivier <laurent@vivier.eu> Reviewed-by: Helge Deller <deller@gmx.de> Signed-off-by: Helge Deller <deller@gmx.de>
tests/functional/ppc: skip remote interrupts test if -net user not built
While running remote interrupts test, without libslirp-devel installed,
facing the following panic logs.
File
...
raise VMLaunchFailure(
...<3 lines>...
) from exc
...
Output: qemu-system-ppc64: -netdev user,id=net0: network backend
'user' is not compiled into this binary
Adding netdev user requirement for this test.
Suggested-by: Amit Machhiwal <amachhiw@linux.ibm.com> Reviewed-by: Amit Machhiwal <amachhiw@linux.ibm.com> Suggested-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Fixes: 63f5ba80921 ("tests/functional: Add remote interrupts test for PowerNV") Signed-off-by: Shivang Upadhyay <shivangu@linux.ibm.com> Tested-by: Amit Machhiwal <amachhiw@linux.ibm.com>
Message-ID: <20260728074612.42397-1-shivangu@linux.ibm.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Mark Cave-Ayland [Sat, 25 Jul 2026 12:33:22 +0000 (13:33 +0100)]
target/sparc: set reg window data structures currently after vmstate load
In the SPARC CPU state, env->regwptr points into the env->regbase
array at wherever the architectural CWP (current window pointer) says
we are in the register windows. We don't migrate this directly,
since it's a host pointer, so we must ensure it is set up again
after migration load.
We also have to deal with a special case when CWP is (nwindows - 1).
In this case, while running we keep the "in" register data for this
window in a temporary location at the end of the regbase[] array, so
that generated code doesn't have to special case this "wrap around"
case. In cpu_pre_save() we call cpu_set_cwp() to force a copy of the
wrapped data from its temporary location into the architectural
location in window 0's "out" registers. We then migrate only
(nwindows * 16) entries in the regbase[] array. So on the
destination we need to copy the "in" register data back to its
temporary location again.
For 32-bit SPARC we get this right, because the CWP is in the PSR.
The get_psr() function does:
env->cwp = 0;
cpu_put_psr_raw(env, val);
which causes cpu_put_psr_raw() to call cpu_set_cwp() in a way that
sets up both regwptr and the wrapped-register data.
However, for 64-bit SPARC the CWP is not in the PSR, and
cpu_put_psr_raw() will not call cpu_set_cwp(). This leaves the guest
register state in a corrupted state, and the guest will likely crash
on the destination if it didn't happen to be executing with CWP == 0.
Fix this by adding a custom vmstate_cwp VMStateInfo with corresponding
get_cwp() and put_cwp() helpers which does the same for the 64-bit
case.
Cc: qemu-stable@nongnu.org Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-ID: <20260725123411.993099-1-mark.cave-ayland@ilande.co.uk> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
hw/net/igb: recalculate rx_desc_len on migration load
rx_desc_len is migrated as a raw uint8_t from the stream but is a
derived value. Currently igb_rx_use_legacy_descriptor() is a stub
that always returns false, so rx_desc_len is always set to
sizeof(union e1000_adv_rx_desc). Recalculate it in post_load to
prevent a crafted migration stream from setting an invalid value.
Cc: qemu-stable@nongnu.org Signed-off-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Message-ID: <20260722112449.1386162-3-lvivier@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
hw/net/e1000e: recalculate rx_desc_len on migration load
rx_desc_len is migrated as a raw uint8_t from the stream, but it
is a derived value that can be computed from the register state
in core.mac[RFCTL] and core.mac[RCTL]. A crafted migration stream
can set rx_desc_len to an invalid value (e.g. 64), causing a stack
buffer overflow in e1000e_write_packet_to_guest() which copies
rx_desc_len bytes into a 32-byte stack union.
Recalculate rx_desc_len and other derived values from the register
state in post_load, ignoring the untrusted values from the stream.
Bernhard Beschow [Mon, 20 Jul 2026 20:11:33 +0000 (22:11 +0200)]
hw/sd/sdhci: Extract uSDHC-specific quirk
In Linux, the ESDHC_MIX_CTRL quirk is guarded by esdhc_is_usdhc() while
the eSDHC code path uses the standard SDHC interface. Extract the quirk
into a new `usdhc_write()` function.
Fixes file system corruption on emulated i.MX53 where Linux'
esdhc_is_usdhc() returns false. The same likely happens on e500 and
imx25-pdk machines.
Cc: qemu-stable@nongnu.org Fixes: 75e98bc4f859 ("hw/sd/sdhci: Add TYPE_FSL_ESDHC_BE") Reviewed-by: Bin Meng <bin.meng@processmission.com> Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Message-ID: <20260720201133.24796-3-shentey@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Matt Turner [Sun, 26 Jul 2026 00:55:27 +0000 (20:55 -0400)]
linux-user: fix guards for the fsmount(2) syscall series
The fsopen(), fsconfig(), fsmount() and fspick() implementations are
guarded by defined(NR_fsopen) rather than defined(__NR_fsopen). No such
macro exists, so the guard is never true and the entire series compiles
out. Guests calling any of the four get -ENOSYS, which for example makes
systemd's credential setup fail with EXIT_CREDENTIALS for most units.
The strace bits for fsconfig() have the same typo.
Check if FSCONFIG_SET_FLAG is defined to avoid build errors in the strace
code on some older distributions (Helge).
Fixes: 767c32fe6983 ("linux-user: implement fsmount(2) series of syscalls") Fixes: 6e0aa9f6c731 ("linux-user/strace: add fsmount series of syscalls") Signed-off-by: Matt Turner <mattst88@gmail.com> Reviewed-by: Helge Deller <deller@gmx.de> Signed-off-by: Helge Deller <deller@gmx.de>
Peter Maydell [Mon, 6 Jul 2026 16:27:04 +0000 (17:27 +0100)]
hw/net/xilinx_axienet: Don't write checksums off end of packet
The xilinx_axienet device has ethernet checksum offloading, with a
mode where the guest provides the offsets within the packet where
the data to be checksummed starts, and where the final checksum
should be written into the packet.
We don't sanity check the TX_CSINSERT offset before writing the
checksum data into it, which means the guest can pass us a value that
is larger than the packet itself and cause us to write the checksum
off the end of the buffer. We also don't explicitly check the
TX_CSBEGIN offset; this doesn't currently cause any problems because
we will pass a negative length to net_checksum_add() which does
nothing, but it's a potential trap for the future if the type
used for the length gets changed to be unsigned.
Explicitly check the offsets. The datasheet doesn't say what happens
if the guest misprograms this, so we choose to log an error and send
the packet as-is.
Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3599 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260706162704.787495-1-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
* tag 'for_upstream' of https://git.kernel.org/pub/scm/virt/kvm/mst/qemu: (30 commits)
virtio: avoid packed vring virtio_queue_empty() infinite loops (CVE-2026-16457)
backends/rng: cap request size to avoid oversized allocation
hw/virtio-rng: Fix host use-after-free (CVE-2026-50624)
hw/net/virtio-net: Protect from DMA re-entrancy bugs
intel_iommu: Check address mask before using it in pasid-based iotlb invalidation
hw/cxl: fix OOB access in cxl_doe_cdat_rsp via entry_handle
hw/virtio/vdpa-dev: pass set_config buffer to vhost backend
hw/pci-host/q35.c: Avoid early return in mch_write_config()
hw/pci-host/q35.c: Factor out creation of SMRAM MRs
hw/pci-host/q35.c: Always initialize smram-region even if SMM disabled
virtio-snd: check for overflow before g_malloc0
virtio-snd: check rx buffer descriptor size
virtio-iommu: fix OOM due to unbounded call_rcu
libvduse: validate vq size
libvhost-user: fix heap overflow in vu_check_queue_inflights
libvhost-user: validate last_batch_head in vu_check_queue_inflights
virtio-pmem: wait for flush requests on unrealize
vhost-user: assert nregions within limit
virtio: fail early on bad config_len in migration
virtio: stop migrating num_default, validate vring.num on load
...
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Stefan Hajnoczi [Mon, 27 Jul 2026 20:51:16 +0000 (16:51 -0400)]
Merge tag 'pull-request-2026-07-27' of https://gitlab.com/thuth/qemu into staging
* Validate bounds in CXL "Set Feature" payloads
* Fix guest-triggerable heap OOB access in "usb-uas" device
* Fix possible crash via NULL pointer in ide_cancel_dma_sync()
* Avoid possible assert() usb_packet_copy()
* Check return value of xhci_xfer_create_sgl() for errors
* tag 'pull-request-2026-07-27' of https://gitlab.com/thuth/qemu:
hw/usb/hcd-xhci: Check return value of xhci_xfer_create_sgl() for errors
hw/usb/core: Avoid possible assert() in do_parameter() --> usb_packet_copy()
hw/ide/core: Fix possible crash via NULL pointer in ide_cancel_dma_sync()
hw/usb/dev-uas: Fix guest-triggerable heap OOB access
hw/cxl: Validate Set Feature payload bounds
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Virtqueue handler functions in device emulation code often look
something like this:
while (!virtio_queue_empty(vq)) {
...pop and process virtqueue element...
}
virtio-blk, virtio-scsi, virtio-crypto, and vhost-shadow-virtqueue use
this pattern.
The device may break (i.e. hit an error that requires device reset)
during the loop. virtio_queue_empty() returns 1 for broken split vrings
but not for broken packed vrings, leading to an infinite loop.
Adjust the packed vring behavior to match split vrings and avoid
infinite loops.
Fixes: CVE-2026-16457
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3968 Reported-by: Anatol Belski <anbelski@linux.microsoft.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260721134424.196337-1-stefanha@redhat.com>
backends/rng: cap request size to avoid oversized allocation
rng_backend_request_entropy() uses the requested size to allocate
a buffer with g_malloc(). With virtio-rng, this size comes from
guest-supplied descriptor lengths. A malicious guest can set a very
large descriptor length, causing QEMU to attempt a multi-gigabyte
allocation and abort.
Cap the allocation to 64 KiB. The virtio-rng queue size is
hardcoded to 8 entries, the EGD backend protocol limits requests
to 255 bytes, the Linux kernel hwrng framework requests at most
SMP_CACHE_BYTES per call (64 bytes on x86_64), and the Windows
viorng driver uses a 4 KiB buffer. The worst legitimate case is
8 x 4 KiB = 32 KiB, so 64 KiB is well above any legitimate use.
Fixes: 14417039653d ("virtio-rng: use virtqueue_get_avail_bytes, fix migration") Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3983 Reported-by: dong ling <dongling226655@outlook.com> Signed-off-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260715141300.2295392-1-lvivier@redhat.com>
Fix a heap-use-after-free in the virtio-rng frontend when a delayed
rng-random backend completion arrives after the virtio-rng device has been
hot-unplugged.
Fixes: CVE-2026-50624
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3917 Reported-by: Jia Jia <physicalmtea@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Signed-off-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260724094931.3005968-1-lvivier@redhat.com>
hw/net/virtio-net: Protect from DMA re-entrancy bugs
Replace qemu_bh_new_guarded() by virtio_bh_new_guarded()
so the bus and device use the same guard. Otherwise the
DMA-reentrancy protection can be bypassed.
This update was missing in CVE-2024-3446 fix.
Fixes: CVE-2026-66022 Cc: qemu-stable@nongnu.org Cc: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Cc: alxndr@bu.edu
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4073 Reported-by: Giovanni Vignone <gio@octane.security> Signed-off-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260723233555.2970619-1-lvivier@redhat.com>
hw/cxl: fix OOB access in cxl_doe_cdat_rsp via entry_handle
cxl_doe_cdat_rsp() takes ent = req->entry_handle (uint16_t, fully
guest-controlled, 0..0xFFFF) and directly indexes cdat->entry[ent]
without checking ent < cdat->entry_len. For a default cxl-type3 with
one volatile memory region, entry_len = 1 + CT3_CDAT_NUM_ENTRIES = 7,
so any entry_handle >= 7 reads past the CDATEntry array into host heap.
The OOB-read base/length are then used in
memcpy(read_mbox + offset, base, len) at cxl_type3.c:298-299, leaking
host heap memory to the guest via PCI_EXP_DOE_RD_DATA_MBOX, and
potentially overflowing the 1 MiB read_mbox heap buffer when the OOB
length field is large.
The same bug exists in the cxl-upstream implementation.
Existing checks do not bound ent: assert(cdat->entry_len) only ensures
the table is loaded; the minimum-length check only guards against a
truncated CDATReq; the entry_handle ternary at line 293 only decides
the next-handle echo, not the current access; pcie_doe_get_obj_len
reads header.length, not entry_handle.
Reproduce: build QEMU with CONFIG_CXL, boot
-M q35,cxl=on -device pxb-cxl,bus_nr=52 ... -device cxl-type3,...
then send a CDATReq with entry_handle=0xFFFF via the DOE mailbox at
config offset 0x190. Under ASAN this reports SEGV in cxl_doe_cdat_rsp
at cxl_type3.c:281.
Fixes: f5ee7413d5 ("hw/mem/cxl-type3: Add CXL CDAT Data Object Exchange") Fixes: 882877fc35 ("hw/pci-bridge/cxl-upstream: Add a CDAT table access DOE") Signed-off-by: Haotian Jiang <jianghaotian.sunday@gmail.com> Cc: qemu-stable@nongnu.org Reviewed-by: Jonathan Cameron <jic23@kernel.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260713072336.623604-2-jianghaotian.sunday@gmail.com>
hw/virtio/vdpa-dev: pass set_config buffer to vhost backend
vhost_vdpa_device_set_config() receives the updated config buffer, but
forwards s->config to the vhost backend. Since s->config is refreshed by
get_config(), it may contain stale backend state.
Pass the supplied config buffer to vhost_dev_set_config() instead.
Fixes: b430a2bd2303 ("vdpa: add vdpa-dev support") Signed-off-by: GuoHan Zhao <zhaoguohan@kylinos.cn> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260709073225.2341642-1-zhaoguohan@kylinos.cn>
Peter Maydell [Wed, 8 Jul 2026 12:10:11 +0000 (13:10 +0100)]
hw/pci-host/q35.c: Avoid early return in mch_write_config()
In mch_write_config() we return early if has_smm_ranges is false.
This is slightly bug-prone because it leaves the door open to somebody
later adding non-SMM-specific code at the bottom of the function.
This case isn't as bad as the one in realize, because the function is
a lot shorter. But putting the handling of the three SMM specific
ranges into an if() rather than having an early return seems better.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260708121011.1653365-4-peter.maydell@linaro.org>
Peter Maydell [Wed, 8 Jul 2026 12:10:10 +0000 (13:10 +0100)]
hw/pci-host/q35.c: Factor out creation of SMRAM MRs
mch_realize has a large section that deals with initializing the
SMRAM-specific MemoryRegions. Currently we do an early return from
the realize function if mch->has_smm_ranges is false, but this has
the potential for bugs if somebody adds new code at the end of the
function that isn't SMM-specific. Pull the MR init code out into its
own function, so we can do the smm-ranges specific handling in the
realize function in a more obvious way.
This commit shouldn't change behaviour at all.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260708121011.1653365-3-peter.maydell@linaro.org>
Peter Maydell [Wed, 8 Jul 2026 12:10:09 +0000 (13:10 +0100)]
hw/pci-host/q35.c: Always initialize smram-region even if SMM disabled
The MCHPCIState::smram_region looks like it ought to be SMM-specific,
but it isn't, because its behaviour is "alias the PCI address space
into system memory at the SMRAM_C_BASE offset", and it must be
enabled for "hide SMRAM", and disabled for "show SMRAM". If the
SMRAM regions are disabled, we want "hide SMRAM", so we need to
initialize and place this MR. Do this in the minimal way, by moving
the "bail out of realize if has_smm_ranges is false" check down below
the initialization code.
This fixes a bug where disabling SMM causes the VGA screen to be
blank during seabios output, until the OS graphics driver is
initialized. This is most obvious for accelerators which have no SMM
support (e.g. NVMM, HVF, WHPX) as there smm=off is the default, but
you can also see it on KVM and TCG if you explicitly pass smm=off:
qemu-system-x86_64 -machine q35,accel=kvm,smm=off
The early return is bug-prone, so we can refactor the code to clean
it up, but this is the minimal bug fix for backports, and is what
Debian used to work around this:
https://salsa.debian.org/qemu-team/qemu/-/commit/6e0766f0f897dc2b75ab87dd59da0d4639bb37ee
Another proposed fix for this:
https://patchew.org/QEMU/20260413170407.57574-1-mohamed@unpredictable.fr/
also moves an early return in mch_update-smram() and tweaks
mch_update_smram() accordingly. This shouldn't be necessary, because
in the no-SMM case smram_region should always be enabled and we don't
want to allow the guest to make it disabled.
NetBSD bug: https://gnats.NetBSD.org/59721
Cc: qemu-stable@nongnu.org Fixes: b07bf7b7 ("q35: Introduce smm_ranges property for q35-pci-host")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/2608 Reported-by: Kroese (gitlab @kroese) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260708121011.1653365-2-peter.maydell@linaro.org>
Coverity points out one g_malloc0 overflow, but it seems to be a false
positive. Add a check to it regardless to fortify the code, and also add
checks for every other g_malloc0 use.
Resolves: Coverity CID 1547527 Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260420-virtio-fixups-v3-2-07aef1eff9d2@linaro.org>
It must be at least sizeof(virtio_snd_pcm_status).
I haven't verified if it's possible to get an underflow, but coverity
points it out in CID 1547527 so add a check.
Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260420-virtio-fixups-v3-1-07aef1eff9d2@linaro.org>
Currently, within virtio-iommu, handle_command processes the command vq
without any limits on the number of entries processed.
This can easily and repeatedly enable/disable multiple memory regions.
Within the memory code, this causes an accumulation of an
unbounded number of RCU-deferred FlatViews - each of these
is supposed to be freed with call_rcu, but that never happens
because the main thread never returns to the main loop.
Given FlatView is big, it's easy to have this balloon out to multiple
Gigabytes of memory.
Limit the loop defer any remaining work to a timer.
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3930 Cc: Eric Auger <eric.auger@redhat.com> Cc: Jean-Philippe Brucker <jean-philippe@linaro.org> Reviewed-by: Eric Auger <eric.auger@redhat.com> Tested-by: Eric Auger <eric.auger@redhat.com> Reported-by: Jia Jia <physicalmtea@gmail.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <eb46ab360dbe28c29cfa78812a7440dcb7444d59.1784807826.git.mst@redhat.com>
libvduse assumes that vq size (aka vq num) is below VIRTQUEUE_MAX_SIZE
and maps logs large enough based on this assumption.
However, vduse_queue_enable() accepts the vq size returned through
VDUSE_VQ_GET_INFO without validation, so a value above
VIRTQUEUE_MAX_SIZE (1024) overruns the inflight log and causes
out-of-bounds writes in vduse_queue_inflight_get().
According to the virtio spec, vq size can only be reduced, not
increased, so vq size must not exceed the previously configured
max_size, but the kernel vduse module does not validate this for us, and
we should not trust another process to follow the spec.
Validate and reject vq size values above VIRTQUEUE_MAX_SIZE.
Fixes: CVE-2026-61402
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3652 Reported-by: Jia Jia <physicalmtea@gmail.com>
Message-ID: <bf7e71b3139875e5e00fd53970c772d6c90dc2a1.1784888961.git.mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
libvhost-user: fix heap overflow in vu_check_queue_inflights
vu_check_queue_inflights counts inflight descriptors using inflight == 1
but copies entries using inflight != 0. If the inflight field contains
an unexpected non-0/1 value, the function copies more entries than it
allocates and overflows the heap buffer.
Stop the copy pass once resubmit_num reaches the counted inuse value.
Note: the value is not guest-accessible so not a security vulnerability.
Fixes: CVE-2026-63110 Fixes: 5f9ff1eff3 ("libvhost-user: Support tracking inflight I/O in shared memory") Cc: Xie Yongji <xieyongji@bytedance.com> Cc: Stefano Garzarella <sgarzare@redhat.com>
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3974 Reported-by: BB CC <wywwzjj@gmail.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <e2315efc526c0ee918485df4be69e2b26e8b7a73.1784892981.git.mst@redhat.com>
libvhost-user: validate last_batch_head in vu_check_queue_inflights
vu_check_queue_inflights uses last_batch_head from the frontend-controlled
inflight shared memory as an index into desc[] without bounds checking.
A malicious or buggy frontend can set last_batch_head >= desc_num,
causing an out-of-bounds write.
Validate last_batch_head before using it.
Note: the value is not guest-accessible so not a security vulnerability.
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3974 Fixes: 5f9ff1eff3 ("libvhost-user: Support tracking inflight I/O in shared memory") Cc: Xie Yongji <xieyongji@bytedance.com> Cc: Stefano Garzarella <sgarzare@redhat.com> Reported-by: BB CC <wywwzjj@gmail.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <8133770c75c9907578dd551f4d468140a0a75cd2.1784892981.git.mst@redhat.com>
virtio_pmem_flush submits fsync requests to the thread pool and stores a
VirtIOPMEM pointer in each request. If device is deleted e.g. by
hot-unplug, once these complete, done_cb can run after
virtio_pmem_unrealize frees the device, causing a use-after-free.
Track in-flight requests and wait in virtio_pmem_unrealize until
their completions finish before tearing the device down.
Fixes: CVE-2026-63323 Fixes: 5f503cd9f3 ("virtio-pmem: add virtio device") Cc: David Hildenbrand <david@kernel.org> Cc: Pankaj Gupta <pagupta@redhat.com>
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3938 Reported-by: Jia Jia <physicalmtea@gmail.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <417b6685f37ce818c660ca3c84945992f5c30dcf.1784894206.git.mst@redhat.com>
scrub_shadow_regions() and vhost_user_add_remove_regions() use
fixed-size stack arrays sized to VHOST_USER_MAX_RAM_SLOTS and index them
with dev->mem->nregions.
nregions is calculated to never overrun these, but let's add an assert
to make sure we don't get a stack overflow if there's a bug.
Fixes: f1aeb14b08 ("Transmit vhost-user memory regions individually")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3910 Cc: Stefano Garzarella <sgarzare@redhat.com> Cc: Raphael Norwitz <raphael.norwitz@nutanix.com> Reported-by: Feifan Qian <bea1e@proton.me> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <48fb8411f67e525872fb19618a886e52b670ab7f.1784896199.git.mst@redhat.com>
virtio_load() attempts to load config_len bytes from the migration
stream. If that's huge (e.g. 4g) this will uselessly spin
beyond the end of the stream for seconds. Not nice.
Check qemu_file_get_error() and bail out early, instead.
Also note that config_len is int32_t but is coerced to unsigned when
used. Switch it to uint32_t to make this clearer.
Fixes: 2f5732e964 ("Allow mismatched virtio config-len") Cc: Dr. David Alan Gilbert <dave@treblig.org>
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3891 Reported-by: Feifan Qian <bea1e@proton.me> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <cfbefa358af5885eb386637216552bfeba5e7bbc.1784898922.git.mst@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dave@treblig.org>
virtio: stop migrating num_default, validate vring.num on load
num_default tracks the allocation size of used_elems, set by
virtio_add_queue(). Migrating it via the ringsize subsection is
wrong: a migration stream (malicious or simply from a different
configuration) can inflate num_default so that
virtio_queue_set_num() accepts oversized values, leading to OOB
access on the used_elems array.
It is not even migrated consistently: a configuration with a
smaller num_default could thinkably migrate and work but in the
common case of num == num_default the value is not actually sent.
Stop migrating num_default: make virtio_ringsize_needed() return
false so the subsection is never sent, and use VMSTATE_UNUSED to
consume the field from old streams without applying it. The
destination keeps its local num_default from virtio_add_queue(),
which matches the actual allocation.
Also validate vring.num against num_default when loading the core
virtio state, rejecting streams that supply a queue size larger
than the locally allocated maximum.
Fixes: 46c5d0823d ("virtio: ring sizes vs. reset") Fixes: 50e5ae4dc3 ("migration/virtio: Remove simple .get/.put use") Cc: Cornelia Huck <cohuck@redhat.com> Cc: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <3e6a7c403f93acc37af6a6332fdc65049ae218fb.1784894327.git.mst@redhat.com>
virtio: fix queue size validation against allocated maximum
virtio_add_queue() allocates used_elems for num_default entries, but
virtio_queue_set_num() accepts larger guest-supplied queue sizes up to
VIRTQUEUE_MAX_SIZE. With VIRTIO_F_IN_ORDER, this lets the guest drive
used_elems accesses past the allocation and cause out-of-bounds reads
and writes.
Reject queue sizes larger than num_default in virtio_queue_set_num()
and mark the device broken.
Fixes: e63c0ba1bc ("virtio: Add support for guest setting of queue size") Fixes: CVE-2026-50626 Cc: Peter Maydell <peter.maydell@linaro.org>
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3882
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3921
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3923
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3613 Reported-by: huntr bubble <bubblehuntr@gmail.com> Reported-by: Jia Jia <physicalmtea@gmail.com> Reported-by: Miku Hatsune <anznu1l@gmail.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <eb7cc3672a20db392f577edbece2300aa6754dd3.1784898967.git.mst@redhat.com>
virtio-mmio reports VIRTQUEUE_MAX_SIZE (1024) as QUEUE_NUM_MAX for every
queue, regardless of the size the device passes to virtio_add_queue().
This works by accident because QEMU mostly does not care about the ring
size - the guest is the one allocating memory here. But this changes
with in-order vqs where qemu is the one allocating resources.
Now, specifying a larger vq than allocated causes an OOB memory access.
To fix:
- for new machine types, report the actual max queue size to guest
- for old machine types, use a compat property to allocate 1k sized
queues
Fixes: 525d82e323 ("virtio: fix queue size validation against allocated maximum") Fixes: CVE-2026-50626
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3882 Cc: Peter Maydell <peter.maydell@linaro.org>
Message-ID: <8715acbb9516e67e2a776cda6f9edf105343f788.1784930765.git.mst@redhat.com> Acked-by: Yonggang Luo <luoyonggang@gmail.com> Reported-by: Miku Hatsune <anznu1l@gmail.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
virtio-scsi: fix SCSIRequest leak on a bad request
When virtio_scsi_handle_cmd_vq() cleans up prepared requests after a
malformed element in the same batch, it drops only one reference even
though virtio_scsi_handle_cmd_req_prepare() leaves each unsubmitted
SCSIRequest with two references. This leaks the request and allows
repeated bad batches to cause unbounded host memory growth.
Add a second scsi_req_unref() and clear hba_private first.
Fixes: CVE-2026-61476 Fixes: 661e32fb3c ("virtio-scsi: convert virtio_scsi_bad_req() to use virtio_error()")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3875 Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Fam Zheng <fam@euphon.net> Cc: Greg Kurz <groug@kaod.org> Reported-by: Feifan Qian <bea1e@proton.me> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <5092cd4716e08d29731bfe85eea82a732b837ff4.1784895264.git.mst@redhat.com>
When vhost_commit() rebuilds the memory region table after a flatview
change, it revalidates cached host virtual addresses for active vring
parts. If a mapping is stale, QEMU abort().
This is not a security problem - only the priviledged guest
can control make it invalid - but not nice e.g. for driver debugging.
Let's call virtio_error() instead, marking the device as broken.
Fixes: 0ca1fd2d68 ("vhost: Simplify ring verification checks")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3783 Cc: Stefano Garzarella <sgarzare@redhat.com> Cc: Dr. David Alan Gilbert <dave@treblig.org> Reported-by: Feifan Qian <bea1e@proton.me> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <71961a7dc157f552303aeea8c99a75c5e1ce904e.1784898432.git.mst@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dave@treblig.org>
The split-ring path already rejects a zero-length indirect descriptor
table since commit 7423192912af ("virtio: add checks for the size of
the indirect table"). The packed-ring path is missing the same check,
allowing a guest to trigger an assertion in address_space_cache_init()
with a packed indirect descriptor that has len=0.
Add the same !desc.len check to the packed-ring indirect validation
in both virtqueue_packed_get_avail_bytes() and virtqueue_packed_pop().
Fixes: 86044b24e865 ("virtio: basic packed virtqueue support") Cc: jasowangio@gmail.com Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3984 Reported-by: dong ling <dongling226655@outlook.com> Signed-off-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260715115040.2186274-1-lvivier@redhat.com>
libvhost-user: protect against OOB vring queue access
SET_VRING_NUM, SET_VRING_ADDR, SET_VRING_BASE, and GET_VRING_BASE
handlers all use the queue index from the message to access dev->vq[]
without checking that it is below dev->max_queues, so a malformed
message causes an out-of-bounds heap access.
Frontend is trusted so not a security problem, but
an OOB access is not a nice way to handle errors.
Check, and panic.
libvhost-user: protect against OOB writes in vu_set_inflight_fd
vu_set_inflight_fd() trusts the num_queues value from the
VHOST_USER_SET_INFLIGHT_FD message without checking it against
dev->max_queues, so an oversized value causes out-of-bounds writes to
dev->vq.
Front end is generally trusted so not a security problem, but OOB isn't
a nice way to handle frontend bugs. Let's harden this a bit:
check num_queues and panic if it's invalid.
Fixes: 5f9ff1eff3 ("libvhost-user: Support tracking inflight I/O in shared memory")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3740 Cc: Stefano Garzarella <sgarzare@redhat.com> Reported-by: xlabai <xlabai@tencent.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <23b3f12388c1035f208550df9de9944c22d8d534.1784899127.git.mst@redhat.com>
virtio-net: fix short frame OOB read in receive_filter()
Within virtio-net, receive_filter() reads Ethernet header fields without
any length checks.
But virtio-net sets do_not_pad in NetClientState, so backends such as
socket forward frames at the size supplied by the peer without padding
to the Ethernet minimum. A short frame thus causes an out-of-bounds
read.
Add size checks in receive_filter() and drop the truncated frames.
Fixes: CVE-2026-63320 Fixes: 3831ab2094 ("qemu:virtio-net: Enable filtering based on MAC, promisc, broadcast and allmulti (Alex Williamson)") Cc: Jason Wang <jasowangio@gmail.com> Cc: Alex Williamson <alex@shazbot.org>
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3626 Reported-by: huntr bubble <bubblehuntr@gmail.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <ee5c77b96ab66b2dd518f146def8727216a5c495.1784895727.git.mst@redhat.com>
The RSC receive path parses incoming frames at guest_hdr_len byte
offsets, but the backend buffer contains only host_hdr_len bytes of vnet
header. If the lengths differ, RSC would read at the wrong offset and
cause an OOB read.
This is no longer possible after the previous patch, but the assumption
seem fragile. Along the defense in depth lines, let's validate. To
ensure we are not breaking any valid setups by mistake, warn and fall
back to the normal receive path when host_hdr_len != guest_hdr_len.
Fixes: CVE-2026-63321 Fixes: 2974e916df ("virtio-net: support RSC v4/v6 tcp traffic for Windows HCK") Cc: Jason Wang <jasowangio@gmail.com> Cc: Yuri Benditovich <ybendito@redhat.com> Cc: Wei Xu <wexu@redhat.com>
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3623 Reported-by: huntr bubble <bubblehuntr@gmail.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <f261dcd535edc890f8636d8ae5ac1007bc32b8b4.1784891251.git.mst@redhat.com>
virtio_set_features_nocheck() calls set_features_ex
with guest-supplied feature bits, without masking the value
with host features (unlike set_features which gets the
correct val & host_features).
This does not matter if the driver matches spec, but drivers
can be malicious or buggy and set bit outside the host mask.
Devices don't expect this, so unsupported guest feature bits getting set
can break the host. In virtio-net, this can enable RSC without vnet
header support and cause out-of-bounds reads from short packets.
Pass the masked features to set_features_ex, consistent with set_features.
Fixes: CVE-2026-63321 Fixes: 64a6a336f4 ("virtio: add support for negotiating extended features") Cc: Jason Wang <jasowangio@gmail.com> Cc: Yuri Benditovich <ybendito@redhat.com> Cc: Paolo Abeni <pabeni@redhat.com>
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3623 Reported-by: huntr bubble <bubblehuntr@gmail.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <dfd27c9b26e442a2076f6ddc9bb3d38363d9b2da.1784891251.git.mst@redhat.com>
parallels: fix integer overflow in header size calculation
parallels_open() caches bat_entry_off(s->bat_size) - a uint32_t -
in a plain int before it feeds into s->header_size. Near the
"Catalog too large" bound the value exceeds INT_MAX and overflows
on assignment.
Match the cached value's type to bat_entry_off()'s return type.
Signed-off-by: Denis V. Lunev <den@openvz.org> CC: Thomas Huth <thuth@redhat.com> CC: Stefan Hajnoczi <stefanha@redhat.com>
hw/9pfs: annotate V9fsTransport callbacks as coroutine_fn
All V9fsTransport callbacks are invoked exclusively from coroutine
context (the v9fs_* PDU handlers). Annotate the function pointer
types in V9fsTransport and all implementations (virtio and xen
backends), as well as intermediate callers in 9p.c (pdu_marshal,
pdu_unmarshal, v9fs_init_qiov_from_pdu, etc.).
Acked-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Those DEBUG_ALLOC-guarded are dead code incorrectly calling coroutine fn
from non-coroutine. Remove it.
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Fixes: 70bacc44532 ("qcow2: mark more functions as coroutine_fns and GRAPH_RDLOCK") Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
The function was extracted without carrying the annotation.
Fixes: 23743ab282af ("block: move commit_run loop to separate function") Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Fixes: 394b9407e4c ("migration: mark mixed functions that can suspend") Reviewed-by: Peter Xu <peterx@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
monitor: annotate monitor_qmp_dispatcher_pop_any() as coroutine
The function calls qemu_coroutine_yield(), and is called from
monitor_qmp_dispatcher_co().
Fixes: 60f4f62efeb ("monitor: extract request dequeuing to a new function") Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Under some optimization, gcc produces a false-positive:
../block/blkio.c: In function ‘blkio_co_getlength’:
../block/blkio.c:943:8: error: ‘ret’ may be used uninitialized [-Werror=maybe-uninitialized]
943 | if (ret < 0) {
| ^
Replace WITH_QEMU_LOCK_GUARD with the simpler QEMU_LOCK_GUARD.
virt_instance_init() built the FDT unconditionally at QOM
instance-init time, so simply instantiating the object (e.g. via
qom-test's introspection, without ever realizing the machine) leaked
the 1MB FDT blob: machine_finalize() does not free machine->fdt.
Other boards (arm/virt, riscv/virt, ...) build the FDT lazily from
their MachineClass::init callback, which only runs when the machine
is actually selected to boot. Do the same here by moving create_fdt()
into virt_init().
hw/display/virtio-gpu-rutabaga: zero-init capset info response
rutabaga_cmd_get_capset_info() only fills in capset_id,
capset_max_version and capset_max_size before sending the response to
the guest. The remaining fields of struct virtio_gpu_resp_capset_info,
including hdr.fence_id, hdr.ctx_id and hdr.ring_idx, are left with
stack garbage and leaked to the guest, including host pointers useful
for an ASLR bypass.
Zero the response first, matching virgl_cmd_get_capset_info().
Not a real risk thanks to -ftrivial-auto-var-init=zero, but only with
gcc >= 12 or clang >= 16.
virtio_gpu_base_device_realize() leaks a migration blocker if a
check of the output list fails after adding one. Perform the check
before adding a migration blocker to avoid the leak. This also
simplifies the code by merging two loops.
The documentation stated that writing to HV_X64_MSR_CRASH_CTL
unconditionally causes the guest to shutdown. In reality, it triggers
qemu_system_guest_panicked() via KVM_SYSTEM_EVENT_CRASH and the
resulting action depends on the generic panic action policy
(-action panic=...), which defaults to shutdown.
virtio-gpu: fix NULL deref in rutabaga set_scanout
rutabaga_cmd_set_scanout() checks scanout_id < VIRTIO_GPU_MAX_SCANOUTS
(16), but does not check scanout_id < conf.max_outputs like the base
class (virtio-gpu.c) and virgl backend (virtio-gpu-virgl.c) do.
With the default max_outputs=1, virtio_gpu_base_device_realize only
initializes scanout[0].con. A guest submitting SET_SCANOUT with
scanout_id >= 1 takes the con=NULL path, and
qemu_console_set_surface(NULL, NULL) dereferences con->ds, crashing
QEMU.
Replace VIRTIO_GPU_MAX_SCANOUTS with vb->conf.max_outputs in the
CHECK, since realization already ensures max_outputs <=
VIRTIO_GPU_MAX_SCANOUTS.
target/i386/sev: fix MemoryRegion reference leaks in gpa2hva callers
gpa2hva() returns a referenced MemoryRegion via its p_mr out-parameter
(inherited from memory_region_find()), but both SEV callers were failing
to release it.
Fixes: c7f7e6970d3b ("sev: add sev-inject-launch-secret") Reviewed-by: Peter Xu <peterx@redhat.com> Reviewed-by: Zhao Liu <zhao1.liu@intel.com> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20260521145451.1831984-1-marcandre.lureau@redhat.com>
net/colo: fix g_hash_table_destroy assertion on uninitialized filter
colo_rewriter_cleanup() unconditionally destroys connection_track_table,
but the table is only allocated in colo_rewriter_setup(). When the
filter-rewriter object is finalized without having been set up (e.g.
during qom-test property enumeration), the pointer is NULL and
g_hash_table_destroy() fires an assertion.
Use g_clear_pointer() to skip the destroy when the table was never
initialized.
projects / thirdparty / qemu.git / log
