## Host environment - Operating system: Linux (Debian/gLinux) - Architecture: x86_64 - QEMU flavor: `qemu-system-x86_64` - QEMU version: `master` (`v11.0.0-rc0`) ## Description of problem Multiple bounds and pointer validation issues exist in Dynamic Capacity Device (DCD) extent handling in `hw/cxl/cxl-mailbox-utils.c`: 1. In `cxl_find_dc_region(ct3d, dpa, len)`, `dpa + len` is computed without checking for 64-bit unsigned addition wraparound (`uadd64_overflow`). A guest supplying a large `len` (e.g., `dpa = 0x10000000`, `len = 0xfffffffff0000000`) wraps `dpa + len` to `0 <= region->base + region->len`, bypassing the region bounds check and causing `bitmap_set()` in `cxl_detect_malformed_extent_list()` to overflow `blk_bitmap` on the heap. 2. When `ct3d->dc.num_regions == 0`, `cxl_detect_malformed_extent_list()` indexes `ct3d->dc.regions[ct3d->dc.num_regions - 1]` (`regions[-1]`) out-of-bounds. 3. In `cmd_dcd_add_dyn_cap_rsp()`, `QTAILQ_FIRST(&ct3d->dc.extents_pending)` is dereferenced without checking `QTAILQ_EMPTY(&ct3d->dc.extents_pending)`. ## Proposed Patch ```diff From a6143773905b2dea779cdc53fdd5583238c42b70 Mon Sep 17 00:00:00 2001 From: Hui Peng <benquike@gmail.com> Date: Fri, 18 Sep 2026 10:38:43 +0000 Subject: [PATCH] hw/cxl/cxl-mailbox-utils: fix integer overflow and null deref in DCD extent handling In cxl_find_dc_region(), dpa + len is evaluated in 64-bit unsigned arithmetic without checking for overflow or zero length. A guest supplying a large len (e.g. UINT64_MAX + 1 - dpa) causes dpa + len to wrap around and pass the region bounds check, after which cxl_detect_malformed_extent_list() calls bitmap_set() with nr = len / min_block_size and overflows blk_bitmap on the heap. Additionally, cxl_detect_malformed_extent_list() indexes ct3d->dc.regions[ct3d->dc.num_regions - 1] without checking ct3d->dc.num_regions > 0, and cmd_dcd_add_dyn_cap_rsp() does not check QTAILQ_EMPTY(&ct3d->dc.extents_pending) before dereferencing the first pending extent group. Check for num_regions == 0, len == 0, and 64-bit unsigned addition overflow in cxl_find_dc_region() and cxl_detect_malformed_extent_list(), and reject cmd_dcd_add_dyn_cap_rsp() when extents_pending is empty. Signed-off-by: Hui Peng <benquike@gmail.com> diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c index 37f7f4418c..a2751636b3 100644 --- a/hw/cxl/cxl-mailbox-utils.c +++ b/hw/cxl/cxl-mailbox-utils.c @@ -3524,8 +3524,10 @@ CXLDCRegion *cxl_find_dc_region(CXLType3Dev *ct3d, uint64_t dpa, uint64_t len) { int i; CXLDCRegion *region = &ct3d->dc.regions[0]; + uint64_t dpa_end; - if (dpa < region->base || + if (!ct3d->dc.num_regions || !len || uadd64_overflow(dpa, len, &dpa_end) || + dpa < region->base || dpa >= region->base + ct3d->dc.total_capacity) { return NULL; } @@ -3541,7 +3543,7 @@ CXLDCRegion *cxl_find_dc_region(CXLType3Dev *ct3d, uint64_t dpa, uint64_t len) for (i = ct3d->dc.num_regions - 1; i >= 0; i--) { region = &ct3d->dc.regions[i]; if (dpa >= region->base) { - if (dpa + len > region->base + region->len) { + if (dpa_end > region->base + region->len) { return NULL; } return region; @@ -3648,11 +3650,16 @@ static CXLRetCode cxl_detect_malformed_extent_list(CXLType3Dev *ct3d, { uint64_t min_block_size = UINT64_MAX; CXLDCRegion *region; - CXLDCRegion *lastregion = &ct3d->dc.regions[ct3d->dc.num_regions - 1]; + CXLDCRegion *lastregion; g_autofree unsigned long *blk_bitmap = NULL; uint64_t dpa, len; uint32_t i; + if (!ct3d->dc.num_regions) { + return CXL_MBOX_UNSUPPORTED; + } + lastregion = &ct3d->dc.regions[ct3d->dc.num_regions - 1]; + for (i = 0; i < ct3d->dc.num_regions; i++) { region = &ct3d->dc.regions[i]; min_block_size = MIN(min_block_size, region->block_size); @@ -3743,6 +3750,10 @@ static CXLRetCode cmd_dcd_add_dyn_cap_rsp(const struct cxl_cmd *cmd, return CXL_MBOX_INVALID_PAYLOAD_LENGTH; } + if (QTAILQ_EMPTY(&ct3d->dc.extents_pending)) { + return CXL_MBOX_INVALID_INPUT; + } + if (in->num_entries_updated == 0) { num = cxl_extent_group_list_delete_front(&ct3d->dc.extents_pending); ct3d->dc.total_extent_count -= num; ```