Re: [PULL v2 01/30] virtio: use masked features with set_features_ex

n 7/27/26 9:19 PM, Michael S. Tsirkin wrote:
> virtio_set_features_nocheck() calls set_features_ex
> with guest-supplied feature bits, without masking the value
> with host features (unlike set_features which gets the
> correct val & host_features).
> 
> This does not matter if the driver matches spec, but drivers
> can be malicious or buggy and set bit outside the host mask.
> 
> Devices don't expect this, so unsupported guest feature bits getting set
> can break the host. In virtio-net, this can enable RSC without vnet
> header support and cause out-of-bounds reads from short packets.
> 
> Pass the masked features to set_features_ex, consistent with set_features.
> 
> Fixes: CVE-2026-63321
> Fixes: 64a6a336f4 ("virtio: add support for negotiating extended features")
> Cc: Jason Wang <[email protected]>
> Cc: Yuri Benditovich <[email protected]>
> Cc: Paolo Abeni <[email protected]>
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3623
> Reported-by: huntr bubble <[email protected]>
> Signed-off-by: Michael S. Tsirkin <[email protected]>
> Message-ID: <dfd27c9b26e442a2076f6ddc9bb3d38363d9b2da.1784891251.git.mst@redhat.com>
> ---
>  hw/virtio/virtio.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
> index f4d86a3655..7c19080db5 100644
> --- a/hw/virtio/virtio.c
> +++ b/hw/virtio/virtio.c
> @@ -3320,7 +3320,7 @@ static int virtio_set_features_nocheck(VirtIODevice *vdev, const uint64_t *val)
>      virtio_features_and(tmp, val, vdev->host_features_ex);
>  
>      if (k->set_features_ex) {
> -        k->set_features_ex(vdev, val);
> +        k->set_features_ex(vdev, tmp);
>      } else if (k->set_features) {
>          bad = bad || virtio_features_use_ex(tmp);
>          k->set_features(vdev, tmp[0]);

I fear this comes too late, but FWIW the fix LGTM, thanks Michael!

Acked-by: Paolo Abeni <[email protected]>