## Host environment - Operating system: Linux (Debian/gLinux) - Architecture: x86_64 - QEMU flavor: `qemu-system-x86_64` - QEMU version: `master` (`v11.0.0-rc0`) ## Description of problem In `cmd_features_set_feature()` (`hw/cxl/cxl-mailbox-utils.c`), multi-part feature transfers (`CXL_SET_FEATURE_FLAG_INITIATE_DATA_TRANSFER` followed by `CXL_SET_FEATURE_FLAG_CONTINUE_DATA_TRANSFER`) accumulate `set_feat_info->data_size += bytes_to_copy` on each chunk without bounding `set_feat_info->data_size` to the size of the destination `*_wr_attrs` struct on `CXLType3Dev` (which are 1 to 3 bytes). When the transfer finishes (`CXL_SET_FEATURE_FLAG_FINISH_DATA_TRANSFER`) or aborts (`CXL_SET_FEATURE_FLAG_ABORT_DATA_TRANSFER`), `memset(&ct3d->..._wr_attrs, 0, set_feat_info->data_size)` clears `set_feat_info->data_size` bytes past the 1-3 byte `*_wr_attrs` field inside `CXLType3Dev` on the heap. ## Proposed Patch ```diff From 67ea28c5744818a3a638d52a5722b66dfbcdc552 Mon Sep 17 00:00:00 2001 From: Hui Peng <benquike@gmail.com> Date: Fri, 18 Sep 2026 10:44:27 +0000 Subject: [PATCH] hw/cxl/cxl-mailbox-utils: prevent heap buffer overflow in cmd_features_set_feature In cmd_features_set_feature(), set_feat_info->data_size is incremented by bytes_to_copy on every transfer chunk without checking the total accumulated size against the target write attributes struct size. If a guest sends repeated CONTINUE_DATA_TRANSFER commands at offset 0 followed by FINISH_DATA_TRANSFER or ABORT_DATA_TRANSFER, memset(..., set_feat_info->data_size) zeroes memory past the end of the write attributes struct in CXLType3Dev on the heap. Use sizeof(ct3d->..._wr_attrs) when clearing the temporary write attributes buffers. Signed-off-by: Hui Peng <benquike@gmail.com> diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c index a2751636b3..be2322d3ca 100644 --- a/hw/cxl/cxl-mailbox-utils.c +++ b/hw/cxl/cxl-mailbox-utils.c @@ -1947,22 +1947,28 @@ static CXLRetCode cmd_features_set_feature(const struct cxl_cmd *cmd, data_transfer_flag == CXL_SET_FEATURE_FLAG_ABORT_DATA_TRANSFER) { memset(&set_feat_info->uuid, 0, sizeof(QemuUUID)); if (qemu_uuid_is_equal(&hdr->uuid, &patrol_scrub_uuid)) { - memset(&ct3d->patrol_scrub_wr_attrs, 0, set_feat_info->data_size); + memset(&ct3d->patrol_scrub_wr_attrs, 0, + sizeof(ct3d->patrol_scrub_wr_attrs)); } else if (qemu_uuid_is_equal(&hdr->uuid, &ecs_uuid)) { - memset(&ct3d->ecs_wr_attrs, 0, set_feat_info->data_size); + memset(&ct3d->ecs_wr_attrs, 0, sizeof(ct3d->ecs_wr_attrs)); } else if (qemu_uuid_is_equal(&hdr->uuid, &soft_ppr_uuid)) { - memset(&ct3d->soft_ppr_wr_attrs, 0, set_feat_info->data_size); + memset(&ct3d->soft_ppr_wr_attrs, 0, + sizeof(ct3d->soft_ppr_wr_attrs)); } else if (qemu_uuid_is_equal(&hdr->uuid, &hard_ppr_uuid)) { - memset(&ct3d->hard_ppr_wr_attrs, 0, set_feat_info->data_size); + memset(&ct3d->hard_ppr_wr_attrs, 0, + sizeof(ct3d->hard_ppr_wr_attrs)); } else if (qemu_uuid_is_equal(&hdr->uuid, &cacheline_sparing_uuid)) { memset(&ct3d->cacheline_sparing_wr_attrs, 0, - set_feat_info->data_size); + sizeof(ct3d->cacheline_sparing_wr_attrs)); } else if (qemu_uuid_is_equal(&hdr->uuid, &row_sparing_uuid)) { - memset(&ct3d->row_sparing_wr_attrs, 0, set_feat_info->data_size); + memset(&ct3d->row_sparing_wr_attrs, 0, + sizeof(ct3d->row_sparing_wr_attrs)); } else if (qemu_uuid_is_equal(&hdr->uuid, &bank_sparing_uuid)) { - memset(&ct3d->bank_sparing_wr_attrs, 0, set_feat_info->data_size); + memset(&ct3d->bank_sparing_wr_attrs, 0, + sizeof(ct3d->bank_sparing_wr_attrs)); } else if (qemu_uuid_is_equal(&hdr->uuid, &rank_sparing_uuid)) { - memset(&ct3d->rank_sparing_wr_attrs, 0, set_feat_info->data_size); + memset(&ct3d->rank_sparing_wr_attrs, 0, + sizeof(ct3d->rank_sparing_wr_attrs)); } set_feat_info->data_transfer_flag = 0; set_feat_info->data_saved_across_reset = false; ```