@samitouri / QOSamiQemu / commits / 1332990194

hw/ide: reject an out-of-range PIO transfer window on load

ide_drive_pio_post_load() validates end_transfer_fn_idx but takes cur_io_buffer_offset and cur_io_buffer_len straight from the migration stream, so data_ptr and data_end can be placed anywhere within +-2GB of the 131076-byte io_buffer allocation. Both fields are signed 32-bit. The subsection loader consumes every subsection present in the stream without consulting needed(), so a crafted stream can inject ide_drive/pio_state for a drive that was never in a DRQ state. Once data_end is out of bounds, ide_data_writew() only compares the guest's pointer against that same bogus data_end, and the resumed guest turns a repeated outw to the data port into a controlled 16-bit heap write. end_transfer_fn_idx picks the direction, so the read side of the same code path leaks host heap instead. Validate the window against io_buffer_total_len and fail the load. The subtraction form avoids overflowing the addition. Reported-by: XlabAI Team of Tencent Xuanwu Lab <xlabai@tencent.com> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/4179 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3738 Cc: John Snow <jsnow@redhat.com> Cc: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Signed-off-by: Denis V. Lunev <den@openvz.org>

Denis V. Lunev committed Aug 17, 2026 at 23:44 UTC 1332990194b53f5ca6a4fe7ac93cf4ad6eecfa9c

1 file changed +6

hw/ide/core.c

@@ -2898,6 +2898,12 @@ static int ide_drive_pio_post_load(void *opaque, int version_id)

2898 if (s->end_transfer_fn_idx >= ARRAY_SIZE(transfer_end_table)) {

2899 return -EINVAL;

2900 }

2901 + if (s->cur_io_buffer_offset < 0 || s->cur_io_buffer_len < 0 ||

2902 + s->cur_io_buffer_offset > s->io_buffer_total_len ||

2903 + s->cur_io_buffer_len >

2904 + s->io_buffer_total_len - s->cur_io_buffer_offset) {

2905 + return -EINVAL;

2906 + }

2907 s->end_transfer_func = transfer_end_table[s->end_transfer_fn_idx];

2908 s->data_ptr = s->io_buffer + s->cur_io_buffer_offset;

2909 s->data_end = s->data_ptr + s->cur_io_buffer_len;