cluster_size - 1 is often used in bitwise mask operations in qed.h, so
this bug is probably a copy-paste error. qed_bytes_to_clusters() uses a
division and the denominator should be the full cluster_size value.
This bug can be used to leak heap memory to the guest with a QED file
where cluster_size <= 32 KB (the default is 64 KB) and table_size = 8 or
16 (the default is 4).
Fixes: CVE-2026-118594
Fixes: 298800cae72e ("qed: Table, L2 cache, and cluster functions")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4737
Reported-by: oxsignal <[email protected]>
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>
---
block/qed.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/block/qed.h b/block/qed.h
index 26d4bf038c7..04bcd7ac4fa 100644
--- a/block/qed.h
+++ b/block/qed.h
@@ -253,7 +253,7 @@ static inline uint64_t qed_offset_into_cluster(BDRVQEDState
*s, uint64_t offset)
static inline uint64_t qed_bytes_to_clusters(BDRVQEDState *s, uint64_t bytes)
{
return qed_start_of_cluster(s, bytes + (s->header.cluster_size - 1)) /
- (s->header.cluster_size - 1);
+ s->header.cluster_size;
}
static inline unsigned int qed_l1_index(BDRVQEDState *s, uint64_t pos)
--
2.56.0
