[PULL 0/5] Block patches
The following changes since commit 7f36b1fbeb1f6f070cd5f8eddb3edbcafac15440: Merge tag 'pull-tcg-20261030' of https://gitlab.com/rth7680/qemu into staging (2026-10-30 08:16:19 -0500) are available in the Git repository at: https://gitlab.com/stefanha/qemu.git tags/block-pull-request for you to fetch changes up to 0a7dca50fd1d11e901c37aaac6b2a952b4919fc0: virtio-blk-test: Test truncated serial (2026-10-30 15:31:33 -0400) ---------------------------------------------------------------- Pull request virtio-blk serial truncation deprecation by Kevin Wolf and a qed block driver fix for CVE-2026-118594. ---------------------------------------------------------------- Kevin Wolf (4): virtio-blk: Implement full NUL padding for GET_ID virtio-blk-test: Add a basic GET_ID test case virtio-blk: Deprecate silent truncation of serial virtio-blk-test: Test truncated serial Stefan Hajnoczi (1): qed: fix incorrect denominator in qed_bytes_to_clusters() (CVE-2026-118594) docs/about/deprecated.rst | 13 ++++ block/qed.h | 2 +- hw/block/virtio-blk.c | 18 +++-- tests/qtest/virtio-blk-test.c | 119 ++++++++++++++++++++++++++++++++++ 4 files changed, 147 insertions(+), 5 deletions(-) -- 2.56.0
cluster_size - 1 is often used in bitwise mask operations in qed.h, so this bug is probably a copy-paste error. qed_bytes_to_clusters() uses a division and the denominator should be the full cluster_size value. This bug can be used to leak heap memory to the guest with a QED file where cluster_size <= 32 KB (the default is 64 KB) and table_size = 8 or 16 (the default is 4). Fixes: CVE-2026-118594 Fixes: 298800cae72e ("qed: Table, L2 cache, and cluster functions") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4737 Reported-by: oxsignal <awo@kakao.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- block/qed.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/block/qed.h b/block/qed.h index 26d4bf038c7..04bcd7ac4fa 100644 --- a/block/qed.h +++ b/block/qed.h @@ -253,7 +253,7 @@ static inline uint64_t qed_offset_into_cluster(BDRVQEDState *s, uint64_t offset) static inline uint64_t qed_bytes_to_clusters(BDRVQEDState *s, uint64_t bytes) { return qed_start_of_cluster(s, bytes + (s->header.cluster_size - 1)) / - (s->header.cluster_size - 1); + s->header.cluster_size; } static inline unsigned int qed_l1_index(BDRVQEDState *s, uint64_t pos) -- 2.56.0
From: Kevin Wolf <kwolf@redhat.com> The spec requires not only NUL termination of the device ID string, but NUL padding: VIRTIO_BLK_T_GET_ID requests fetch the device ID string from the device into data. The device ID string is a NUL-padded ASCII string up to 20 bytes long. If the string is 20 bytes long then there is no NUL terminator. Zero out all of the remaining bytes in the request buffer. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-ID: <20261029231001.194240-2-kwolf@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- hw/block/virtio-blk.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c index 536d71a91ad..3f236f22d57 100644 --- a/hw/block/virtio-blk.c +++ b/hw/block/virtio-blk.c @@ -1011,14 +1011,18 @@ static int virtio_blk_handle_request(VirtIOBlockReq *req, MultiReqBuffer *mrb) case VIRTIO_BLK_T_GET_ID: { /* - * NB: per existing s/n string convention the string is + * The spec requires NUL-padding for the output. The string is * terminated by '\0' only when shorter than buffer. */ const char *serial = s->conf.serial ? s->conf.serial : ""; - size_t size = MIN(strlen(serial) + 1, - MIN(iov_size(in_iov, in_num), - VIRTIO_BLK_ID_BYTES)); + size_t req_size = MIN(iov_size(in_iov, in_num), VIRTIO_BLK_ID_BYTES); + size_t size = MIN(strlen(serial), req_size); + size_t padding = req_size - size; + iov_from_buf(in_iov, in_num, 0, serial, size); + if (padding) { + iov_memset(in_iov, in_num, size, 0, padding); + } virtio_blk_req_complete(req, VIRTIO_BLK_S_OK); g_free(req); break; -- 2.56.0
From: Kevin Wolf <kwolf@redhat.com> This covers the simple common case with no surprises: A serial that is shorter than 20 characters and can fit in the request buffer. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Message-ID: <20261029231001.194240-3-kwolf@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- tests/qtest/virtio-blk-test.c | 96 +++++++++++++++++++++++++++++++++++ 1 file changed, 96 insertions(+) diff --git a/tests/qtest/virtio-blk-test.c b/tests/qtest/virtio-blk-test.c index 98c906ebb4a..825ea261bed 100644 --- a/tests/qtest/virtio-blk-test.c +++ b/tests/qtest/virtio-blk-test.c @@ -95,6 +95,8 @@ static uint64_t virtio_blk_request(QGuestAllocator *alloc, QVirtioDevice *d, g_assert_cmpuint(data_size % sizeof(struct virtio_blk_discard_write_zeroes), ==, 0); break; + case VIRTIO_BLK_T_GET_ID: + break; default: g_assert_cmpuint(data_size, ==, 0); } @@ -771,6 +773,91 @@ static void resize(void *obj, void *data, QGuestAllocator *t_alloc) } +static QVirtQueue *get_id_setup(QVirtioDevice *dev, QGuestAllocator *t_alloc) +{ + QVirtQueue *vq; + uint64_t features = qvirtio_get_features(dev); + + features = features & (1ull << VIRTIO_F_VERSION_1); + qvirtio_set_features(dev, features); + + vq = qvirtqueue_setup(dev, t_alloc, 0); + qvirtio_set_driver_ok(dev); + return vq; +} + +static uint8_t get_id_request(QVirtioDevice *dev, QVirtQueue *vq, + char *buf, size_t buf_len, + char pattern_byte, + QGuestAllocator *t_alloc) +{ + QTestState *qts = global_qtest; + uint64_t req_addr; + uint32_t free_head; + uint8_t status; + + QVirtioBlkReq req = { + .type = VIRTIO_BLK_T_GET_ID, + .data = buf, + }; + + req_addr = virtio_blk_request(t_alloc, dev, &req, buf_len); + + memset(req.data, pattern_byte, buf_len); + memwrite(req_addr + 16, req.data, buf_len); + + free_head = qvirtqueue_add(qts, vq, req_addr, 16, false, true); + qvirtqueue_add(qts, vq, req_addr + 16, buf_len, true, true); + qvirtqueue_add(qts, vq, req_addr + 16 + buf_len, 1, true, false); + + qvirtqueue_kick(qts, dev, vq, free_head); + + qvirtio_wait_used_elem(qts, dev, vq, free_head, NULL, + QVIRTIO_BLK_TIMEOUT_US); + status = readb(req_addr + 16 + buf_len); + memread(req_addr + 16, buf, buf_len); + + guest_free(t_alloc, req_addr); + + return status; +} + +static void get_id_serial_short(void *obj, void *data, QGuestAllocator *t_alloc) +{ + QVirtioBlk *blk_if = obj; + QVirtioDevice *dev = blk_if->vdev; + QVirtQueue *vq; + uint8_t status; + const char expected[20] = "abc"; + char buf[20]; + + vq = get_id_setup(dev, t_alloc); + status = get_id_request(dev, vq, buf, 20, 0xa5, t_alloc); + g_assert_cmpint(status, ==, 0); + g_assert_cmpmem(buf, 20, expected, sizeof(expected)); + + qvirtqueue_cleanup(blk_if->vdev->bus, vq, t_alloc); +} + +static void get_id_serial_short_20_characters(void *obj, void *data, + QGuestAllocator *t_alloc) +{ + QVirtioBlk *blk_if = obj; + QVirtioDevice *dev = blk_if->vdev; + QVirtQueue *vq; + uint8_t status; + /* Edge case of a serial with exactly 20 characters: No NUL termination */ + const char expected[25] = "01234567890123456789\xa5\xa5\xa5\xa5\xa5"; + char buf[25]; + + vq = get_id_setup(dev, t_alloc); + status = get_id_request(dev, vq, buf, 25, 0xa5, t_alloc); + g_assert_cmpint(status, ==, 0); + g_assert_cmpmem(buf, 25, expected, sizeof(expected)); + + qvirtqueue_cleanup(blk_if->vdev->bus, vq, t_alloc); +} + static void *virtio_blk_test_setup(GString *cmd_line, void *arg) { char *tmp_path = drive_create(); @@ -802,6 +889,15 @@ static void register_virtio_blk_test(void) qos_add_test("nxvirtq", "virtio-blk-pci", test_nonexistent_virtqueue, &opts); qos_add_test("hotplug", "virtio-blk-pci", pci_hotplug, &opts); + + /* serial number tests */ + opts.edge.extra_device_opts = "serial=abc"; + qos_add_test("get_id/serial_short", "virtio-blk", + get_id_serial_short, &opts); + + opts.edge.extra_device_opts = "serial=01234567890123456789"; + qos_add_test("get_id/serial_short_20_characters", "virtio-blk", + get_id_serial_short_20_characters, &opts); } libqos_init(register_virtio_blk_test); -- 2.56.0
From: Kevin Wolf <kwolf@redhat.com> Commit a8686a9b, which made serial a qdev property instead of relying on -drive options, accidentally allowed specifying serial strings of arbitraty length while the virtio-blk protocol can only communicate 20 characters to the guest. This means that a longer serial number on the command line is silently truncated to 20 characters from the guest perspective. This is obviously bad behaviour. People are specifying longer serials in practice and guests will see something different than what was configured. Instead of silent truncation, this should be an error. Deprecate the silent truncation for now as a first step towards making it an error later. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-ID: <20261029231001.194240-4-kwolf@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- docs/about/deprecated.rst | 13 +++++++++++++ hw/block/virtio-blk.c | 6 ++++++ 2 files changed, 19 insertions(+) diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst index dab47b6ca38..0891bbc44de 100644 --- a/docs/about/deprecated.rst +++ b/docs/about/deprecated.rst @@ -362,6 +362,19 @@ the addition of volatile memory support, it is now necessary to distinguish between persistent and volatile memory backends. As such, memdev is deprecated in favor of persistent-memdev. +``-device virtio-blk,serial=more_than_20_characters`` (since 11.2) +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +The ``virtio-blk`` device has a limitation of 20 characters for the serial +string. Accidentally, QEMU started accepting longer strings on the command line +in version 0.15.0, but it was still silently truncated to 20 characters for +guests. + +Specifying a longer serial than can be exposed to the guest is a configuration +error and deprecated; it will become a hard error in later versions. If the +truncation is intentional, explicitly specify the serial already in truncated +form on the command line instead. + Block device options '''''''''''''''''''' diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c index 3f236f22d57..eeeb405127c 100644 --- a/hw/block/virtio-blk.c +++ b/hw/block/virtio-blk.c @@ -1849,6 +1849,12 @@ static void virtio_blk_device_realize(DeviceState *dev, Error **errp) return; } + if (conf->serial && strlen(conf->serial) > VIRTIO_BLK_ID_BYTES) { + warn_report("serial is longer than %d characters and will be truncated " + "for the guest. This configuration is deprecated.", + VIRTIO_BLK_ID_BYTES); + } + if (!blkconf_apply_backend_options(&conf->conf, !blk_supports_write_perm(conf->conf.blk), true, errp)) { -- 2.56.0
From: Kevin Wolf <kwolf@redhat.com> Only 20 bytes are written to the passed buffer and the returned string doesn't have a NUL terminator. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Message-ID: <20261029231001.194240-5-kwolf@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- tests/qtest/virtio-blk-test.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/tests/qtest/virtio-blk-test.c b/tests/qtest/virtio-blk-test.c index 825ea261bed..722bd0711fa 100644 --- a/tests/qtest/virtio-blk-test.c +++ b/tests/qtest/virtio-blk-test.c @@ -858,6 +858,25 @@ static void get_id_serial_short_20_characters(void *obj, void *data, qvirtqueue_cleanup(blk_if->vdev->bus, vq, t_alloc); } +static void get_id_serial_short_trunc(void *obj, void *data, + QGuestAllocator *t_alloc) +{ + QVirtioBlk *blk_if = obj; + QVirtioDevice *dev = blk_if->vdev; + QVirtQueue *vq; + uint8_t status; + /* Everything after the 20 character maximum is untouched, no '\0' */ + const char expected[25] = "01234567890123456789\xa5\xa5\xa5\xa5\xa5"; + char buf[25]; + + vq = get_id_setup(dev, t_alloc); + status = get_id_request(dev, vq, buf, 25, 0xa5, t_alloc); + g_assert_cmpint(status, ==, 0); + g_assert_cmpmem(buf, 25, expected, sizeof(expected)); + + qvirtqueue_cleanup(blk_if->vdev->bus, vq, t_alloc); +} + static void *virtio_blk_test_setup(GString *cmd_line, void *arg) { char *tmp_path = drive_create(); @@ -898,6 +917,10 @@ static void register_virtio_blk_test(void) opts.edge.extra_device_opts = "serial=01234567890123456789"; qos_add_test("get_id/serial_short_20_characters", "virtio-blk", get_id_serial_short_20_characters, &opts); + + opts.edge.extra_device_opts = "serial=012345678901234567890123456789"; + qos_add_test("get_id/serial_short_trunc", "virtio-blk", + get_id_serial_short_trunc, &opts); } libqos_init(register_virtio_blk_test); -- 2.56.0
On 10/30/26 14:34, Stefan Hajnoczi wrote:
The following changes since commit 7f36b1fbeb1f6f070cd5f8eddb3edbcafac15440:
Merge tag 'pull-tcg-20261030' ofhttps://gitlab.com/rth7680/qemu into staging (2026-10-30 08:16:19 -0500)
are available in the Git repository at:
https://gitlab.com/stefanha/qemu.git tags/block-pull-request
for you to fetch changes up to 0a7dca50fd1d11e901c37aaac6b2a952b4919fc0:
virtio-blk-test: Test truncated serial (2026-10-30 15:31:33 -0400)
---------------------------------------------------------------- Pull request
virtio-blk serial truncation deprecation by Kevin Wolf and a qed block driver fix for CVE-2026-118594.
Applied, thanks. r~
participants (2)
-
Richard Henderson -
Stefan Hajnoczi