hw/ufs: Zero reserved bytes in REPORT LUNS response header
ufs_emulate_report_luns() writes the 4-byte LUN list length into outbuf[0..3] via stl_be_p() but leaves outbuf[4..7], the reserved field, uninitialized. Those bytes are then DMA'd to guest memory, leaking uninitialized QEMU stack data. Fixes: 7708e298180 ("hw/ufs/lu: skip automatic zero-init of large array") Cc: qemu-stable@nongnu.org Signed-off-by: Jeuk Kim <jeuk20.kim@samsung.com>
Jeuk Kim committed
May 11, 2026 at 13:59 UTC
042dbcff8382393b20b716294a6c4b1a4af6b3f1
1 file changed
+4
hw/ufs/lu.c
+4
@@ -101,6 +101,10 @@ static int ufs_emulate_report_luns(UfsRequest *req, uint8_t *outbuf,
101
return SCSI_COMMAND_FAIL;
102
}
103
104
+ if (outbuf_len < 8) {
105
+ return SCSI_COMMAND_FAIL;
106
+ }
107
+ memset(outbuf, 0, 8);
108
len += 8;
109
110
for (uint8_t lun = 0; lun < UFS_MAX_LUS; ++lun) {