## Host environment - Operating system: Linux (Debian/gLinux) - Architecture: x86_64 - QEMU flavor: `qemu-system-x86_64` - QEMU version: `master` (`v11.0.0-rc0`) - QEMU command line: ```sh ./qemu-system-x86_64 -machine q35,cxl=on -m 4G,maxmem=8G,slots=8 \ -object memory-backend-ram,id=vmem0,share=on,size=256M \ -object memory-backend-file,id=cxl-lsa0,share=on,mem-path=/tmp/lsa0.raw,size=256M \ -device pxb-cxl,bus_nr=12,bus=pcie.0,id=cxl.1 \ -device cxl-rp,port=0,bus=cxl.1,id=root_port0,chassis=0,slot=0 \ -device cxl-type3,bus=root_port0,volatile-memdev=vmem0,lsa=cxl-lsa0,id=cxl-vmem0 \ -M cxl-fmw.0.targets.0=cxl.1,cxl-fmw.0.size=4G ``` ## Description of problem Several guest-triggerable bounds, overflow, and leak bugs exist across the CXL HDM decoder, mailbox, and device register paths. ### 1. `cxl_hdm_find_target()` unvalidated IG/IW encodings (`hw/cxl/cxl-host.c`) `ig_enc` (Interleave Granularity) and `iw_enc` (Interleave Ways) are read from the guest-writable `CXL_HDM_DECODER0_CTRL` register and used directly in shift arithmetic without validating the architectural maximums (`IG <= 6`, `IW <= 3` for this path). Out-of-range encodings produce shift counts larger than the operand width (undefined behaviour) and out-of-bounds target list indices. A committed decoder with `size == 0` or a wrapping `base + size` is also not rejected, so `addr >= base + size` can pass for arbitrary addresses. ### 2. `cxl_type3_dpa()` unvalidated IG/IW encodings (`hw/mem/cxl_type3.c`) Same issue on the Type 3 device DPA translation path: a committed decoder with `ig > 6`, or `iw` outside the valid `{0..4, 8..10}` set, is accepted and used in shift arithmetic. ### 3. `cxl_fmws_direct_passthrough_setup()` unvalidated decoder window (`hw/cxl/cxl-host.c`) `state->decoder_base` / `state->decoder_size` are used to create a direct passthrough `MemoryRegion` alias without checking that the decoder window is non-zero, non-wrapping, and fully contained inside the Fixed Memory Window (`fw->base .. fw->base + fw->size`). A guest-programmed decoder can therefore alias memory outside the FMW. ### 4. `cmd_media_get_scan_media_capabilities()` / `cmd_media_scan_media()` 64-bit multiplication and addition overflow (`hw/cxl/cxl-mailbox-utils.c`) `query_length = ldq_le_p(&in->length) * CXL_CACHE_LINE_SIZE` multiplies a fully guest-controlled 64-bit value by 64 without an overflow check, and `query_start + query_length` is not checked for wraparound. A guest supplying `length = 0x0400000000000000` wraps `query_length` to `0`, and a large `query_start` wraps the sum, bypassing the `query_start + query_length > cxl_dstate->static_mem_size` bounds check. ### 5. `cmd_features_get_supported()` / `cmd_fm_get_dc_region_extent_list()` output payload overrun (`hw/cxl/cxl-mailbox-utils.c`) The number of output records is bounded by the hard-coded `CXL_MAILBOX_MAX_PAYLOAD_SIZE` rather than by the actual mailbox size `cci->payload_max` of the CCI the command arrived on. On a CCI with a smaller `payload_max` (e.g. a switch mailbox CCI), the computed `out_pl_len` exceeds the allocated payload buffer. `cci->payload_max < sizeof(header)` also underflows the subtraction used to derive the record capacity. ### 6. `cmd_fm_initiate_dc_release()` extent list leak (`hw/cxl/cxl-mailbox-utils.c`) The locally built `updated_list` of `CXLDCExtent` entries is never drained, so every prescriptive FM DC release command leaks one heap allocation per extent. ## Proposed Patch ```diff From 9c5489b4f3ad4819cc42775fabdb21953f8ad647 Mon Sep 17 00:00:00 2001 From: Hui Peng <benquike@gmail.com> Date: Fri, 18 Sep 2026 23:22:59 +0000 Subject: [PATCH] hw/cxl, hw/mem: fix HDM IG/IW bounds, media status check, and scan_media overflow - In include/hw/cxl/cxl_device.h and hw/cxl/cxl-device-utils.c, read cxl_dstate->memdev_status instead of mbox_reg_state64[0] in cxl_dev_media_disabled(), and ignore writes to the read-only A_CXL_DEV_MAILBOX_CAP register in mailbox_mem_writel(). - In hw/cxl/cxl-host.c and hw/mem/cxl_type3.c, validate IG and IW fields and check base + size overflow in cxl_hdm_find_target(), cxl_fmws_direct_passthrough_setup(), and cxl_type3_dpa(). - In hw/cxl/cxl-mailbox-utils.c, check uint64_t multiplication and addition overflow in cmd_media_get_scan_media_capabilities() and cmd_media_scan_media(), clamp output records to cci->payload_max in cmd_features_get_supported() and cmd_fm_get_dc_region_extent_list(), and free updated_list in cmd_fm_initiate_dc_release(). Signed-off-by: Hui Peng <benquike@gmail.com> diff --git a/hw/cxl/cxl-device-utils.c b/hw/cxl/cxl-device-utils.c index cfd6b27977..e857d29be7 100644 --- a/hw/cxl/cxl-device-utils.c +++ b/hw/cxl/cxl-device-utils.c @@ -116,10 +116,10 @@ static void mailbox_mem_writel(uint32_t *reg_state, hwaddr offset, { switch (offset) { case A_CXL_DEV_MAILBOX_CTRL: - /* fallthrough */ + break; case A_CXL_DEV_MAILBOX_CAP: /* RO register */ - break; + return; default: qemu_log_mask(LOG_UNIMP, "%s Unexpected 32-bit access to 0x%" PRIx64 " (WI)\n", diff --git a/hw/cxl/cxl-host.c b/hw/cxl/cxl-host.c index 199eff7328..b968c6fcb2 100644 --- a/hw/cxl/cxl-host.c +++ b/hw/cxl/cxl-host.c @@ -173,7 +173,8 @@ static bool cxl_hdm_find_target(uint32_t *cache_mem, hwaddr addr, low = ldl_le_p(cache_mem + R_CXL_HDM_DECODER0_SIZE_LO + i * hdm_inc); high = ldl_le_p(cache_mem + R_CXL_HDM_DECODER0_SIZE_HI + i * hdm_inc); size = (low & 0xf0000000) | ((uint64_t)high << 32); - if (addr < base || addr >= base + size) { + if (size == 0 || base + size < base || addr < base || + addr >= base + size) { continue; } @@ -184,6 +185,9 @@ static bool cxl_hdm_find_target(uint32_t *cache_mem, hwaddr addr, found = true; ig_enc = FIELD_EX32(ctrl, CXL_HDM_DECODER0_CTRL, IG); iw_enc = FIELD_EX32(ctrl, CXL_HDM_DECODER0_CTRL, IW); + if (ig_enc > 6 || iw_enc > 3) { + return false; + } if (interleaved) { *interleaved = iw_enc != 0; @@ -353,6 +357,13 @@ static void cxl_fmws_direct_passthrough_setup(CXLDirectPTState *state, return; } + if (state->decoder_base < fw->base || + state->decoder_size == 0 || + state->decoder_base + state->decoder_size < state->decoder_base || + state->decoder_base + state->decoder_size > fw->base + fw->size) { + return; + } + if (ct3d->direct_mr_fw[idx]) { return; } diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c index d3056d947b..f137612179 100644 --- a/hw/cxl/cxl-mailbox-utils.c +++ b/hw/cxl/cxl-mailbox-utils.c @@ -1445,9 +1445,15 @@ static CXLRetCode cmd_features_get_supported(const struct cxl_cmd *cmd, return CXL_MBOX_INVALID_INPUT; } + if (cci->payload_max < sizeof(CXLSupportedFeatureHeader)) { + return CXL_MBOX_INVALID_PAYLOAD_LENGTH; + } req_entries = (get_feats_in->count - sizeof(CXLSupportedFeatureHeader)) / sizeof(CXLSupportedFeatureEntry); + req_entries = MIN(req_entries, + (cci->payload_max - sizeof(CXLSupportedFeatureHeader)) / + sizeof(CXLSupportedFeatureEntry)); req_entries = MIN(req_entries, (CXL_FEATURE_MAX - get_feats_in->start_index)); @@ -3212,7 +3218,13 @@ cmd_media_get_scan_media_capabilities(const struct cxl_cmd *cmd, if (query_start & 0x3f) { return CXL_MBOX_INVALID_INPUT; } + if (ldq_le_p(&in->length) > UINT64_MAX / CXL_CACHE_LINE_SIZE) { + return CXL_MBOX_INVALID_PA; + } query_length = ldq_le_p(&in->length) * CXL_CACHE_LINE_SIZE; + if (query_start + query_length < query_start) { + return CXL_MBOX_INVALID_PA; + } if (query_start + query_length > cxl_dstate->static_mem_size) { return CXL_MBOX_INVALID_PA; @@ -3276,7 +3288,13 @@ static CXLRetCode cmd_media_scan_media(const struct cxl_cmd *cmd, if (query_start & 0x3f) { return CXL_MBOX_INVALID_INPUT; } + if (ldq_le_p(&in->length) > UINT64_MAX / CXL_CACHE_LINE_SIZE) { + return CXL_MBOX_INVALID_PA; + } query_length = ldq_le_p(&in->length) * CXL_CACHE_LINE_SIZE; + if (query_start + query_length < query_start) { + return CXL_MBOX_INVALID_PA; + } if (query_start + query_length > cxl_dstate->static_mem_size) { return CXL_MBOX_INVALID_PA; @@ -4307,9 +4325,12 @@ static CXLRetCode cmd_fm_get_dc_region_extent_list(const struct cxl_cmd *cmd, return CXL_MBOX_INVALID_INPUT; } + if (cci->payload_max < sizeof(*out)) { + return CXL_MBOX_INVALID_PAYLOAD_LENGTH; + } record_count = MIN(in->extent_cnt, ct3d->dc.nr_extents_accepted - in->start_extent_id); - max_size = CXL_MAILBOX_MAX_PAYLOAD_SIZE - sizeof(*out); + max_size = cci->payload_max - sizeof(*out); record_count = MIN(record_count, max_size / sizeof(out->records[0])); out_pl_len = sizeof(*out) + record_count * sizeof(out->records[0]); @@ -4479,6 +4500,7 @@ static CXLRetCode cmd_fm_initiate_dc_release(const struct cxl_cmd *cmd, switch (in->flags & CXL_EXTENT_REMOVAL_POLICY_MASK) { case CXL_EXTENT_REMOVAL_POLICY_PRESCRIPTIVE: { CXLDCExtentList updated_list; + CXLDCExtent *ent, *ent_next; uint32_t updated_list_size; g_autofree CXLUpdateDCExtentListInPl *list = g_malloc0(sizeof(*list) + @@ -4517,6 +4539,9 @@ static CXLRetCode cmd_fm_initiate_dc_release(const struct cxl_cmd *cmd, if (rc) { return rc; } + QTAILQ_FOREACH_SAFE(ent, &updated_list, node, ent_next) { + cxl_remove_extent_from_extent_list(&updated_list, ent); + } cxl_create_dc_event_records_for_extents(ct3d, DC_EVENT_RELEASE_CAPACITY, in->extents, diff --git a/hw/mem/cxl_type3.c b/hw/mem/cxl_type3.c index aa4b481422..c68522099e 100644 --- a/hw/mem/cxl_type3.c +++ b/hw/mem/cxl_type3.c @@ -1195,7 +1195,8 @@ static bool cxl_type3_dpa(CXLType3Dev *ct3d, hwaddr host_addr, uint64_t *dpa) hdm_ctrl = ldl_le_p(cache_mem + R_CXL_HDM_DECODER0_CTRL + i * hdm_inc); iw = FIELD_EX32(hdm_ctrl, CXL_HDM_DECODER0_CTRL, IW); ig = FIELD_EX32(hdm_ctrl, CXL_HDM_DECODER0_CTRL, IG); - if (!FIELD_EX32(hdm_ctrl, CXL_HDM_DECODER0_CTRL, COMMITTED)) { + if (!FIELD_EX32(hdm_ctrl, CXL_HDM_DECODER0_CTRL, COMMITTED) || + ig > 6 || (iw > 4 && (iw < 8 || iw > 10))) { return false; } if (((uint64_t)host_addr < decoder_base) || diff --git a/include/hw/cxl/cxl_device.h b/include/hw/cxl/cxl_device.h index ba551fa5f9..63e3fc22fb 100644 --- a/include/hw/cxl/cxl_device.h +++ b/include/hw/cxl/cxl_device.h @@ -427,7 +427,7 @@ static inline void __toggle_media(CXLDeviceState *cxl_dstate, int val) static inline bool cxl_dev_media_disabled(CXLDeviceState *cxl_dstate) { - uint64_t dev_status_reg = cxl_dstate->mbox_reg_state64[R_CXL_MEM_DEV_STS]; + uint64_t dev_status_reg = cxl_dstate->memdev_status; return FIELD_EX64(dev_status_reg, CXL_MEM_DEV_STS, MEDIA_STATUS) == 0x3; } ```