aspeed/hace: Fix out-of-bounds read in has_padding()
The has_padding() function reads the last 8 bytes of a DMA buffer without validating req_len. req_len is guest-controlled (via R_HASH_SRC_LEN register or scatter-gather entries) and values less than 8 cause integer underflow. This can result in an out-of-bounds read of QEMU process memory. Add a check to ensure req_len >= 8 before accessing the buffer. Reported-by: Katherine Leaver <katherine.j.leaver@gmail.com> Cc: qemu-stable@nongnu.org Fixes: 5cd7d8564a8b ("aspeed/hace: Support AST2600 HACE") Link: https://lore.kernel.org/qemu-devel/20260504213421.710035-2-clg@redhat.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
Cédric Le Goater committed
May 4, 2026 at 23:34 UTC
534a52755befa7b8d49c921f8dc964185903efae
1 file changed
+8
hw/misc/aspeed_hace.c
+8
@@ -154,6 +154,14 @@ static bool has_padding(AspeedHACEState *s, struct iovec *iov,
154
hwaddr req_len, uint32_t *total_msg_len,
155
uint32_t *pad_offset)
156
{
157
+ /* Need at least 8 bytes to read the total message length field */
158
+ if (req_len < 8) {
159
+ qemu_log_mask(LOG_GUEST_ERROR,
160
+ "%s: invalid request length=0x%" HWADDR_PRIx "\n",
161
+ __func__, req_len);
162
+ return false;
163
+ }
164
+
165
*total_msg_len = (uint32_t)(ldq_be_p(iov->iov_base + req_len - 8) / 8);
166
/*
167
* SG_LIST_LEN_LAST asserted in the request length doesn't mean it is the