On Tue, Sep 15, 2026 at 06:45:00AM -0400, Michael S. Tsirkin wrote:
> SET_MEM_TABLE handler uses nregions from the message as a loop
> bound without checking that it is below VHOST_MEMORY_BASELINE_NREGIONS,
> so a malformed message causes an out-of-bounds access to the
> regions[] and fds[] arrays.
>
> Frontend is trusted so not a security problem, but
> an OOB access is not a nice way to handle errors.
> Check, and panic.
>
> Fixes: 7b2e5c65f4 ("contrib: add libvhost-user")
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4403
> Cc: Stefano Garzarella <sgarzare@redhat.com>
> Reported-by: Omer Can Vural <can.omer.5306@outlook.com>
> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Sorry pls disregard.
> ---
> subprojects/libvhost-user/libvhost-user.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
> diff --git a/subprojects/libvhost-user/libvhost-user.c b/subprojects/libvhost-user/libvhost-user.c
> index 2fed792e85..c17765110c 100644
> --- a/subprojects/libvhost-user/libvhost-user.c
> +++ b/subprojects/libvhost-user/libvhost-user.c
> @@ -1105,6 +1105,12 @@ vu_set_mem_table_exec(VuDev *dev, VhostUserMsg *vmsg)
> vu_remove_all_mem_regs(dev);
>
> DPRINT("Nregions: %u\n", memory->nregions);
> +
> + if (memory->nregions > VHOST_MEMORY_BASELINE_NREGIONS) {
> + vu_panic(dev, "Invalid nregions: %u", memory->nregions);
> + return false;
> + }
> +
> for (i = 0; i < memory->nregions; i++) {
> _vu_add_mem_reg(dev, &memory->regions[i], vmsg->fds[i]);
> close(vmsg->fds[i]);
> --
> MST