From nobody Sat Jul 25 11:03:31 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass(p=none dis=none) header.from=nutanix.com ARC-Seal: i=2; a=rsa-sha256; t=1784555990; cv=pass; d=zohomail.com; s=zohoarc; b=CqbzZe3bVvqIJHTv6EkLtmhmB95YqBfyjrz6wizy/aa6LR8qIxwAuEBAiDFm56t48Em9kXIKI1IkYtrQdzjxN3yNsJg8QBmfpV36268QiOqFDNBz4Kwi6IBGohmMxXEbZ6mESDtNuysPHpt+c5Ga2SlKEa5wrZHaFKHZYf8n1zg= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1784555990; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=LzcEiILVrbmsZkMUlQYjET4mH54ypEOEtl1+esP4K3I=; b=oDXAJ32W/Nq16u8LS3xzPiJAdyUpf9CB8+5Lf9OwabBTSX2oBPMEm9r0BZYIB6QBx8wMhZatc0YlJoco3LaPwKUlJvftiztJuFSvXpFzT6gfG+WkjUw4UgT7GbErPPNBmGxXhILQAe9fqUDDRmEaV//gZJHAWwzVJvHf7EhJHKc= ARC-Authentication-Results: i=2; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1784555990172345.54992684811873; Mon, 20 Jul 2026 06:59:50 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wloWS-000524-Iq; Mon, 20 Jul 2026 09:59:08 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wloW6-0004n7-BC for qemu-devel@nongnu.org; Mon, 20 Jul 2026 09:58:46 -0400 Received: from mx0a-002c1b01.pphosted.com ([148.163.151.68]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wloW2-0006Z1-Kv for qemu-devel@nongnu.org; Mon, 20 Jul 2026 09:58:45 -0400 Received: from pps.filterd (m0127838.ppops.net [127.0.0.1]) by mx0a-002c1b01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66KDuNkN603929; Mon, 20 Jul 2026 06:58:40 -0700 Received: from ph7pr06cu001.outbound.protection.outlook.com (mail-westus3azon11020082.outbound.protection.outlook.com [52.101.201.82]) by mx0a-002c1b01.pphosted.com (PPS) with ESMTPS id 4fg91uudqm-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Mon, 20 Jul 2026 06:58:40 -0700 (PDT) Received: from IA0PR02MB9462.namprd02.prod.outlook.com (2603:10b6:208:406::6) by PH7PR02MB8883.namprd02.prod.outlook.com (2603:10b6:510:1fd::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.18; Mon, 20 Jul 2026 13:58:38 +0000 Received: from IA0PR02MB9462.namprd02.prod.outlook.com ([fe80::c493:aabb:b834:f53d]) by IA0PR02MB9462.namprd02.prod.outlook.com ([fe80::c493:aabb:b834:f53d%7]) with mapi id 15.21.0223.017; Mon, 20 Jul 2026 13:58:38 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s= proofpoint20171006; bh=LzcEiILVrbmsZkMUlQYjET4mH54ypEOEtl1+esP4K 3I=; b=kZf2ukN3k1z/hayKQJ/yXDI6BBiKUJJF1cORUyGrAQINQXhP2bU/XmG61 /lEnIwSRQqTjTU2o7RryOEdqT0szhvOTltdEw27Ty5MsAegFPbzxNtQyhEz5Dj88 pAVIFDF24iYbGOZNa0vO7EDonexrPnwXxMAiz/07fv9Gy+se5lUyBmrMQ/qE3+on ePgWQy8FDwPOc5Km7o3AXBgOjlME3WMEcQWp1+rZkGS3O/CSwMZxs5xjP23tYVaF uZkrCCF/PHc3jAd68qV7v00cUyKtyK66D7ujH1bCWKvGmEVM2XWKxQVoSDNbE5dM 4oXelGwrtKDD4CmZhBHI2WUQGh8rA== ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=k8FmvymtfwCg9/o3QTO1GZuXfa925qD5WFBbS3q5PIKiKGjNF1zhymV2Jr+J28Qd4dBWXO+JavkHGp/cyrUg6bi0tSST8R737UZjg28N/VbzsCnAA2BAoJTe5jzI6u2+PbofP12uU4h+lAH96lzO2F0ygNLq1yAmMHITpNNVvixUr7qeFAmVCsBI1cvu8WkOBvZNmdH0nGBKt0a8MpdYDgxIolQ8yg5QfXDxpa8fkYOa1J1JWwFjZpZNcl3bFQIVB1rvc2CKWMh8P61baecmfGeEOffY6YmZAkdlaW7ohvi5S9RvouXkMj3g7bgDM9MHkPnSqjkzOYGXDiFP7irdOA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=LzcEiILVrbmsZkMUlQYjET4mH54ypEOEtl1+esP4K3I=; b=Lwqm52yivzmGAqRrlhOcpNR0stjVOD6uI5KUAGGh8z/Yj5VGR1R8hBWHQ5buOXB/osyE5lFGjxQDr+0CajshTey3W3iy8i8HQj/taT5ySV4hDyDAU/bssuZ/YMlbWhjyBt9mqZdOEsEnFA4JVbtDoYjAsVXeeRYLglcg6sgZdOmBvGSOyPBTbBM2cFmGU26Hx8NIFn4T2NRV0TlihNhQNEhCX718DK28ak4rkmBlXyBIP5XOcKUPD2eR6zTIJpjf6fdIyvkGyYjoOrwEaBl3FCkGA/MsMmLp6U9+5T4vZ0Jzo299y0rcSjYEQUSJETTNvYaBaWrDQ2RFAMQm3BsfZA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nutanix.com; dmarc=pass action=none header.from=nutanix.com; dkim=pass header.d=nutanix.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=LzcEiILVrbmsZkMUlQYjET4mH54ypEOEtl1+esP4K3I=; b=NyTLPGjMFv6HifZ1Jcm9z80yPzx2LRil3bUGHgjy4fKBRy7AJhl3Mk0Bjoo2ycPvcRBJM/tvh62jFUllKJIqlzXwvq4c4PP2+Zr6fOGdfedfHZE4p1CVfrw5Iy8JYCq4RWIBm4rxz3M2J/3OxPI9QWNSolhuZjQG2uOJZHkafRmDWWGKYowuXfTLyGEKFxas+X7+QHBhMCw8Ul143+MHWDSg6dO5bzpxYY3Nhxzv3K9QOOSOYUoCOqZ0zqHVSxjpk8t4RPbE8kAj32elFBbbKWt7yySnuBUlOyXmsDCfFsOp7Va5goPk3IXBCds0uPWK4OMOY+gf1lh0XGp4kfydjQ== From: Thanos Makatos To: "qemu-devel@nongnu.org" CC: John Levon , "clg@redhat.com" , Thanos Makatos Subject: [PATCH v2 1/6] vfio-user: vfio_user_get_region_info: prevent buffer overflow Thread-Topic: [PATCH v2 1/6] vfio-user: vfio_user_get_region_info: prevent buffer overflow Thread-Index: AQHdGE/dc0LS0ijbPUWcjqNXc0gU8Q== Date: Mon, 20 Jul 2026 13:58:38 +0000 Message-ID: <20260720135823.21070-2-thanos.makatos@nutanix.com> References: <20260720091718.2642-1-thanos.makatos@nutanix.com> <20260720135823.21070-1-thanos.makatos@nutanix.com> In-Reply-To: <20260720135823.21070-1-thanos.makatos@nutanix.com> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-publictraffictype: Email x-ms-traffictypediagnostic: IA0PR02MB9462:EE_|PH7PR02MB8883:EE_ x-ms-office365-filtering-correlation-id: 75a9b6fb-f623-40ab-6a6b-08dee666ffc0 x-proofpoint-crosstenant: true x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; ARA:13230040|366016|23010399003|1800799024|376014|10067099003|56012099006|4143699003|18002099003|22082099003|38070700021; x-microsoft-antispam-message-info: tiPG5duhKSQwcag1tRP5Jrby4XcmkUFQ28kLtzHSrQYjcG6c9SVboPN0iLVTLrvhppaddO3pdWmbaIkFoE9NMMxf3gWNwk3x1pPaDmRD4yeGDINNsTH5E84sopaMCHGzLdiIa1WWFhsuatDFLSY3ZzusC+XSpIiZVvtOtVBkDFK2y2M3OL4m9UIm+Dg+J+fYLi6pDh5xOdgLP8iHpY2FbkewcxZBmHzmemKIsgyp4ltbv9vbd1i19ZxpTmEDftd1u0NopxpsjRoHysf8oS7vVLxSKo9uH0WwkLUsnNdhdxmepD9+bTpp2LsyAgdMBDEL0Jjcpp1ZJelrH/fvGBe4qdKlT24SmY2cWDY0OKH9HbyXhpmnBbSPfhrRm0OegF2IHbU2nTmd8nCRxhMf24uM4Bc5onrLr+j22GpBF+/ux4A9wCC4OMoemfyWNtfReMDt0vhoIvm7tPfdSvG0p4CIRkAkzdyN0D8xLHkpKVmBzAN3T6UP3UxrL8i3SjNuC2dIPB0Pm/vhKJ9hYB4zdli22QRdZjOE3lDgFh8qpTIiUijdoaKYHNvtzoxeZYWKCNkrD3ZqDoqO9+4l96JS+lDxuwrsV1dUHopuhB/Rj28s2EZINwmqiPgdHQPBMJU/e5Zw45vR0Viuxt/Xzly5LY3Ec+P80b5X2m0ZS0W/JmRPd4L/WJKQt0N5Q9WmzrPcY+6XjPBOQcxRK/RCh7ywNZrGXhgBr0DuYTWBcCeneiLq6/c= x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:IA0PR02MB9462.namprd02.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230040)(366016)(23010399003)(1800799024)(376014)(10067099003)(56012099006)(4143699003)(18002099003)(22082099003)(38070700021); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?iso-8859-1?Q?6ZM4nvWZGW6hZ3O8ZXys4SS/DOjsNIhOnpyqfgWo0Le0APNO+qzZxFaObc?= =?iso-8859-1?Q?1LpbLKXUFOrXTHF8p2Ieq7R+FEdIb2aV3vKSjfa9WBpyHkbxLPBoS3Cas1?= =?iso-8859-1?Q?OJmYngipP0uMqPkgy9Bo/QnRdQ3v2nPsZeSjv+JBEjsmlhxsXkUsGeVFxJ?= =?iso-8859-1?Q?Lu5xBUCQXKKiH7VnEFJlRkgubEAEJWEXd5kL4vlYDDyg7psSMLW16A09PJ?= =?iso-8859-1?Q?tu9EdacmHkSFjwYcvwvQr6puSQiSSDbKgm2poiAhPST7BcUItEPSPllr/F?= =?iso-8859-1?Q?Vc4ZGKZ2qwQoWz+Jf6AbVFTR8Eo0PcNHOuGQY9GtuQPcqDBrOZfvbjPIMS?= =?iso-8859-1?Q?B9iZFm0oGv0Z1Mt1o+P0T7p+5Jwt1XrZUEMFlQeqsUh2M5S4s93yAeFzne?= =?iso-8859-1?Q?6AoPpMmcADg24K/cqa3jbjGtsKFY6W9B375BJGDnkBWjECw7OH5vKqu51i?= =?iso-8859-1?Q?PncV7JlSYCS427ZsNOlJvBnQndA45zYidygC/DD6y0IOZODSOB/PFatFK6?= =?iso-8859-1?Q?DKFjUdda8wHLOJylTCqrdbVKgLo579Nup0QHzZHF5wh16t7WQR3hb5lEDT?= =?iso-8859-1?Q?xHQbEfofjKbePSG40d+zTjotODziLYoK2pVjKxfOk4NtR8lfyq8eNcHq1w?= =?iso-8859-1?Q?qE70vPf3Wcq566ZUiLmNZFLx79kzt+RtBeVNbBEqTVaJN0gKKsgePu95wv?= =?iso-8859-1?Q?5+Oj2NB8tA3VI+nmD/pjzREaUiQuf5QF424xDMY680i38ofeXZBUtClaD4?= =?iso-8859-1?Q?/JWWpuWvE/wmK/SUta7mlEGt2NfbIiaYk26fp0lP5QrnehWgxCNh02Tqc7?= =?iso-8859-1?Q?XCbSiuZKd5iDJTp5UXWYB3EbUe8AN8k5uDca3JdO1oYWQc0HV3LFBtI2Za?= =?iso-8859-1?Q?hSRQV6sWDMPmxWrsxLKZMEgz7M0KADiq2/nznTlv97fam0DfF9GzlppfYS?= =?iso-8859-1?Q?QtIK946m8tffnDQoHsuEWqD5sIqe30eAEaxyIuiKu+R4bx1NYvFOpFqxE/?= =?iso-8859-1?Q?fUUpe2SdgUmLPM4WLlTS+x4kBppneTOSGC0K3rYnkY8Y7/Cl8l9Q5yPShR?= =?iso-8859-1?Q?N4/73pezwLFcwLtHQw0Z/728L847zX3ZepkjvszdIsqhcGY1aG9J2PKbo3?= =?iso-8859-1?Q?NnvvaYNWSj0f8omvrBDlLHq9bZnUcfpPVxETMqiX7YwqaFFCqz3EFCPyCl?= =?iso-8859-1?Q?TVdeVGXyYgdMkd+Q1ItSPGr0F/fe9rdal9Gh66V95mZIH9st45fpLy/55F?= =?iso-8859-1?Q?CP4TGl4+7tt9tnUrboEAQ6KCFQSGGT1BKTgo/80wAQ9L2JkiDkn5lqTWL1?= =?iso-8859-1?Q?glbxi00pK+IpLdFm1pvmzELaioK//i07qXYBNVJd+eXgCYKYFuCmklAjYS?= =?iso-8859-1?Q?+MYyza2F3oBpsFQwxh9Z8wuQtontPfDatUfL9DaP8vQgyqoVF5Id3y8/sE?= =?iso-8859-1?Q?in83lPMc76irrxck1pqaGe/Pk9iBUULsgAooxSjqvblOabatGVjERuIjzq?= =?iso-8859-1?Q?w8VEWg8Chi98zoCpeWRKcWVKAmOJL3TEZdPr4LKVRMNIDitCHeCSZjL7Ui?= =?iso-8859-1?Q?0FT2GVI8cH7xgZGbBJ8xjPYSqMgpWR99p02FJITdV2LAfgtcTqlLuCr+h3?= =?iso-8859-1?Q?S2sYMFKPmG9rn7GbN8zi7/PJSvsDIMWOZMjOnlGr/i5CtFA30AU1SGTOGY?= =?iso-8859-1?Q?fadVFRA6XZWByR66N6T/yZroXg/CFdcW+wcjVYgnl5MePzZu5iWk6vyIMq?= =?iso-8859-1?Q?u1JAdaNuQZErNUArcmpvSQtEHlx/TudmJPZEILwVMSAZC/12ZW22wDPona?= =?iso-8859-1?Q?xnTGt603a4Zyc5UQlCY574sUN4Ek0ko=3D?= Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Exchange-RoutingPolicyChecked: m57G1EMvH4j7jDRO39ZjLIxewk/3Ol/zkoP0QimyVhm5qm/9Gr/sy3aO0t/YPRCrOszcZHBJdj2xtOtsNvL+jH21dzOalHnhorskK5S6Bs0v/b8td1yXB6x+g/InXrRLe2tpLr0A+/3fIwo9oDpN/5aIy1rkxO/2yCqNIjR4tbzTe7BFmbaih3fS3qOg2M6XSg6YAIFH53VDcToCgybzHpIVrF8w4+xGm13vLnBqRa14Z3Zr7uO/uWDoLmZXkknFQGoAdXTMs8gfK2le+nz33p96/n4EWhiy09qFm+eV1MYECLVcfvqArUznA8MPL1E7qYgDTChfnB85L4ms95ZLmw== X-OriginatorOrg: nutanix.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: IA0PR02MB9462.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 75a9b6fb-f623-40ab-6a6b-08dee666ffc0 X-MS-Exchange-CrossTenant-originalarrivaltime: 20 Jul 2026 13:58:38.4414 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: bb047546-786f-4de1-bd75-24e5b6f79043 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: UBG+0ZclopvMOS+G24ijUMQvs1KoNM4/s2tM7ja8Lx5XWtQv8sNSyZeEuZRjSajwq8xFTskxqVFF1RRC8vUABxqS35AUhwuTB4rErWTBpZI= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH7PR02MB8883 X-Proofpoint-GUID: rM3AWohgIhVXTPer2FNKQ3ZgVdsctnQF X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIwMDE1NCBTYWx0ZWRfXxQOykznGigLw mKQNF7ZLopJ/WtPPH4EnTM2v0Szg/mzLpfvfWLV8swon+HiQCVKW+JzsOOUt9EY6KsAa8ILtLii 7fWU6w0LsWsm5Gj0aj7vWk44y+Ae3N0= X-Proofpoint-ORIG-GUID: rM3AWohgIhVXTPer2FNKQ3ZgVdsctnQF X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIwMDE1NCBTYWx0ZWRfX2nww0q2+DbXP fSSCsxUqWVN74Hz6cVZ6p2+7bui4j1q50/f/GT1g+N+JAMDy5zlynG2C33Q+0wwlPYxEzNWXOIm pzA60/6lq7zuQq//IJDVnuHmV/3ALewAz5ZenSsCEFaXMlzkewz775lnxoGvyXyHORzXSx1HfZJ OXJENIITwi/kj6QGCW5VMjpjU+ydlLw7QZCh9Rv68FCBoM0JsrfHcalOhQIZqYxB1T5fE3E6B4Q NIkpeFRbyND8awxf1u4k2dqWbUj1hcvnLLXXqZ7jegb4jBKSX1PNoARK4IV8eWLif+6m6NycJaY v+Xd3wSDdPRfpr5Ig7tPvI9JWdKQ/2wjEUAv/CJugSnSRfhj72AX3O0o+wtK7OoeIy4ug/x1OL0 XjkRwJFiCvs+OTS1DzcV5K9WJr0uuX0Z2DShKJnLR+Mn+qR+WQrGblfsU/yK/WRKAbJAix2TqYT 6jk6y1p5YzC6EwR/i3g== X-Authority-Analysis: v=2.4 cv=T4a8ifKQ c=1 sm=1 tr=0 ts=6a5e2990 cx=c_pps a=UUrofF6GnltCzEOzQKub5w==:117 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=8nJEP1OIZ-IA:10 a=RAioF0-LDSMA:10 a=0kUYKlekyDsA:10 a=VkNPw1HP01LnGYTKEx00:22 a=VofLwUrZ8Iiv6rRUPXIb:22 a=1L6crL_YRTbalZ11mEUO:22 a=p0WdMEafAAAA:8 a=64Cc0HZtAAAA:8 a=RAxQ1p1dZfU1kADbkrQA:9 a=wPNLvfGTeEIA:10 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-20_03,2026-07-20_02,2025-10-01_01 X-Proofpoint-Spam-Reason: safe Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.151.68; envelope-from=thanos.makatos@nutanix.com; helo=mx0a-002c1b01.pphosted.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @nutanix.com) X-ZM-MESSAGEID: 1784555991534158501 Content-Type: text/plain; charset="utf-8" If the vfio-user responds with a value large enough such that adding the header size to it overflows, a smaller buffer would be inadvertently allocated, leading to buffer overflow. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3867 Signed-off-by: Thanos Makatos Reviewed-by: C=C3=A9dric Le Goater --- hw/vfio-user/device.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/hw/vfio-user/device.c b/hw/vfio-user/device.c index b8d2b7c1a8..e58167a818 100644 --- a/hw/vfio-user/device.c +++ b/hw/vfio-user/device.c @@ -128,12 +128,21 @@ static int vfio_user_get_region_info(VFIOUserProxy *p= roxy, error_printf("vfio_user_get_region_info argsz too small\n"); return -E2BIG; } + + /* + * Ensure that size doesn't overflow, otherwise we'll allocate a much + * smaller buffer than we need. + */ + if (__builtin_add_overflow(info->argsz, sizeof(VFIOUserHdr), &size)) { + error_printf("vfio_user_get_region_info argsz too large\n"); + return -E2BIG; + } + if (fds !=3D NULL && fds->send_fds !=3D 0) { error_printf("vfio_user_get_region_info can't send FDs\n"); return -EINVAL; } =20 - size =3D info->argsz + sizeof(VFIOUserHdr); msgp =3D g_malloc0(size); =20 vfio_user_request_msg(&msgp->hdr, VFIO_USER_DEVICE_GET_REGION_INFO, --=20 2.34.1 From nobody Sat Jul 25 11:03:31 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass(p=none dis=none) header.from=nutanix.com ARC-Seal: i=2; a=rsa-sha256; t=1784556142; cv=pass; d=zohomail.com; s=zohoarc; b=DDuo5/8mITItqBkspfKOjMu/jJeLtTxxozhjVnXHubqFgwzXrbpPIwKYGU9J2S/EA7E9k0QmkQ6bg2v7gR+PRWOtF9jD1bAp8D8b74laQ9809QchAuhlYk5giGzfdFdW8EDXmxChgUNHCL38mLMXKmOugEkzd7iVRuEvoWc+rfI= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1784556142; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=lqOQwCiojI+rrhu8R6jMCsZ1ayQF/rTfMn+IWYJDWBA=; b=RER9F6H7NvKLUEFqhznI81oTfeLwsnR7siLj6oovHLrWrHn0SeJVTMAnfCCiutm6+w/gogZQ/O5dChpOr0v1yhavk2EhuhHHNbsIMFZOUJRDXFQKah3q5u/E42QI+dr7+OBu5jww5O6rMG6yr5ryOZYOObnY5XLkMjf1qNrEii0= ARC-Authentication-Results: i=2; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 178455614278773.8442272174218; Mon, 20 Jul 2026 07:02:22 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wloYu-0006LC-Qi; Mon, 20 Jul 2026 10:01:40 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wloW6-0004n1-98 for qemu-devel@nongnu.org; Mon, 20 Jul 2026 09:58:46 -0400 Received: from mx0b-002c1b01.pphosted.com ([148.163.155.12]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wloW3-0006ZC-6p for qemu-devel@nongnu.org; Mon, 20 Jul 2026 09:58:45 -0400 Received: from pps.filterd (m0127842.ppops.net [127.0.0.1]) by mx0b-002c1b01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66KDqFpq588123; Mon, 20 Jul 2026 06:58:42 -0700 Received: from ph7pr06cu001.outbound.protection.outlook.com (mail-westus3azon11020100.outbound.protection.outlook.com [52.101.201.100]) by mx0b-002c1b01.pphosted.com (PPS) with ESMTPS id 4fg8tbkdrm-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Mon, 20 Jul 2026 06:58:41 -0700 (PDT) Received: from IA0PR02MB9462.namprd02.prod.outlook.com (2603:10b6:208:406::6) by PH7PR02MB8883.namprd02.prod.outlook.com (2603:10b6:510:1fd::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.18; Mon, 20 Jul 2026 13:58:40 +0000 Received: from IA0PR02MB9462.namprd02.prod.outlook.com ([fe80::c493:aabb:b834:f53d]) by IA0PR02MB9462.namprd02.prod.outlook.com ([fe80::c493:aabb:b834:f53d%7]) with mapi id 15.21.0223.017; Mon, 20 Jul 2026 13:58:39 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s= proofpoint20171006; bh=lqOQwCiojI+rrhu8R6jMCsZ1ayQF/rTfMn+IWYJDW BA=; b=BK4335OENUisBeYwqumXHTzkP/uhetz2a5Ut2HWzs3n2ptEYXlnJUxSu2 ov1pHgygaM6X4adJvJhduDgpGoHA6TIXZscZu20oUs6cObv/Zm2G0X2TiKoeyafh kUQMn+tPHZGXD+5y6iAhOfl6JzT/emaic9nGxfEbUQn79hrDljuBnAn96qsmiYrr mLZX5r/gFZG2Rfj+2DnkPkcdMX2tuucO+EmpRWapmbLjAza/kZx3dpTd0mcUk4tS A3exKJoD7jbBfl6KAmPnkHlkvyCILLMq7PN6XqMHidU5ua5dJ8eXJBcJWMXiCVXa u+ATqirZBdRqiX/abEIvvmoc1HALg== ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=bJqu3M1GBMRySdqVSu7ZYrWAiDas2zxB6nVugMT0TJ05UNouTONDWhlLTdsLcu/YDBUTp5ty611yTa9QO9yfmv5vLTl6/aifMJJUznpvAEeflNOWuVpiiQV1kNZCyG2ZI+eijEth23BuqQvETmnSVoDtUgeNOVp5rf9uUekL+wsvxTMXyVpA4eisT2yyzog7HVMBHhoXagU26eDWBvbAZaeL/3NWn06gTgweCfVf46Dkmkmde9kOpDNAAJghzhkUgG3eyC8AJtFfv/heE6Xd8W3btCvmeWufkJoU8ibjYf7sizpL5fVixb4atLafzwTgchDNT9BRZFhZF/Ef0sgQ9w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=lqOQwCiojI+rrhu8R6jMCsZ1ayQF/rTfMn+IWYJDWBA=; b=w9PzI/UDYyu4uhGdfP6c/qFMr2KEjoNHywOh65PiZB/GklnMgmM6XxhaAL6JLzlRXDdmfr1Tpx23meYQ6YC2ILctC1BwdWjCnUankbniRYnNMsnD4uGD1r3TBoBBwDV9s/jU0L3nGUSwwfY2qtZhKgXB82Fq4W9wbgnLajt7zolBL9Qg/AuDa7jMtG6xMycNfwxJE7A/h/HC49+4Sml8d+5QCgghVBTzXgvt01w/i5Y5IfRYj08x+gLtxb7M9xo3v1w4K73oRrOC71Awt+TGbuk+CqJBDb7nL7hfR+NmDlAIbiMSMxTr6VOthB80qaloOBO6dTGHULkToqFolrMBXA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nutanix.com; dmarc=pass action=none header.from=nutanix.com; dkim=pass header.d=nutanix.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=lqOQwCiojI+rrhu8R6jMCsZ1ayQF/rTfMn+IWYJDWBA=; b=nGyrJsmB95oiXVHW49glgcRd+yKZpouA9rerJuC2NRmF+OFVbQlanmoLpKxUutoN6tImA/qioPX5uOZvtRAqBfnA2Qp7liFaGniiCzTy3LlslVgMB41fiNCHbBxmUINlZhCNI29wFMsQXIwFQdo4ob5J9IfuhPvOOC7uBIKi4ZbyrM/MPMGz2eLOYCZHwsYaWb3Ox5t1uJ840bxKE/d5LPqEeQKo3iICfqFBIIlgqBeGkIG3viC8UDO8Y9HAlMwOZxsIvBMhZY6aQbrasAF9meOkt564QEPN/vDTfzAeChYHS0193b2UyYA5nBspbR7DB8yGm9H4SNVWojTlStxYpA== From: Thanos Makatos To: "qemu-devel@nongnu.org" CC: John Levon , "clg@redhat.com" , Thanos Makatos Subject: [PATCH v2 2/6] vfio-user: vfio_user_get_region_info: respect max_xfer_size Thread-Topic: [PATCH v2 2/6] vfio-user: vfio_user_get_region_info: respect max_xfer_size Thread-Index: AQHdGE/eLr8FDIqv80WqsFBTA7io7Q== Date: Mon, 20 Jul 2026 13:58:39 +0000 Message-ID: <20260720135823.21070-3-thanos.makatos@nutanix.com> References: <20260720091718.2642-1-thanos.makatos@nutanix.com> <20260720135823.21070-1-thanos.makatos@nutanix.com> In-Reply-To: <20260720135823.21070-1-thanos.makatos@nutanix.com> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-publictraffictype: Email x-ms-traffictypediagnostic: IA0PR02MB9462:EE_|PH7PR02MB8883:EE_ x-ms-office365-filtering-correlation-id: 4990d684-bda5-479f-fad5-08dee6670096 x-proofpoint-crosstenant: true x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; ARA:13230040|366016|23010399003|1800799024|376014|10067099003|56012099006|4143699003|18002099003|22082099003|38070700021; x-microsoft-antispam-message-info: +KB+UMrERadqr1OC/wq+00bwB6c2Nh3HnOSKd/Xe1bKQO9D253/I6GFYgECSYHfJn+PxJ7NNi0JcE38VDJEjw8gqaPIVHTnaqQTpYv4c9VcFQo4GKM9CbBLz0RDP76pGIoq/4csmrvNSjv5QJXZJ+X1cRwRwx1YQp9o1VWui4mZtSzjcwa2DRqCHBbSc5Ee6cMX4uMKcW7GcB8yGUdV5eRP5TIAnt/Yzot7VdTgvdcil+URj5RXU7fskFk0q0SHED89oQc053jl4rmI32apkf9iHuKIwwSelAqS4HuJfP+gvGoVlAlQyMld8N5UtBt9iBndb7qRfiuqd5LLXSScBDNSH/OJvl18ScUgYmU+r1Ums9gHzUdqjnegbAx99ywj/R+HFhahE34SUkNu+yL2RSyBz+kwciQYXklRcl2WVXC4t8zdVklWt+PoNB0Tj8BEgTUXKltQXPlAz/5drwje+uenwo17bRVkuj7EvwvqdsrQaQPg3czU4imk0wHtZ89HA78GF2gzQB1le0gd0Xs2apNVEILSYht1QObcy4XaxD6GtxXJNkzHmKhC2qkEy03cRHS+Pi4/+uDZ0MO5//wrA5CzhxxGSkGbMgVi4FM/ZEWIv3sbRpn03RvpdNQZ//6KvQxw1RDGHJ4aEvQzAmn9hO/I0/z3n4Lo1cWuEk3aZYsbtDjJ83LRSS3j6TYEJr7csvQZMlSUkDshAhhbCfdsVwEThUkkDeHuc246gbqhZXe8= x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:IA0PR02MB9462.namprd02.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230040)(366016)(23010399003)(1800799024)(376014)(10067099003)(56012099006)(4143699003)(18002099003)(22082099003)(38070700021); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?iso-8859-1?Q?YxfgbohLsT901wUNH3PL0ZWVdfyVCTaVXbO2+WsVdFHZzOgeNpna6/atWF?= =?iso-8859-1?Q?f5/gvKUvFKMwiQHzbgjLsxrsa0Zh+oLdO/OCB2LpoEVY4EzhHc8uihO/re?= =?iso-8859-1?Q?g0K9iKbZQ8Q0p59RMv2xUrrcGriZlHYFxw6R8YMujq4v4dmOd6x0MSK6He?= =?iso-8859-1?Q?b2D973WwM81cS2spioWg0S+Bff74tNN9fkR5AznZ9/W5x7LImNbGQqHXHf?= =?iso-8859-1?Q?mpLdi+t2IBar4DQwgRQZGNsuT507WXx+cXceVuzLfz/+REPf71Nd8dRKaE?= =?iso-8859-1?Q?G78zPmgqLMTboAXRRMCWO7xeK3WTuGPrFc9J9XceErjx8axC2ghj+j5j+t?= =?iso-8859-1?Q?LG2Pn6iQ/hIsosR3o8ntXl+yXxM+e70k7TQHWRsYAwzm6rcbI3+Fn7rs9k?= =?iso-8859-1?Q?wIC0IvrfnAoQOtqauvOn3ox9a82jJHCTJK47xG+8Psw4OW1PnE0Q+6BFMc?= =?iso-8859-1?Q?57DyWiPuIQiMo9kTew0euPkaz9bXygZaRO1l6qt+JcJ3SCZlvzvnZCbs0q?= =?iso-8859-1?Q?6xpjJNIosgL2FPvVlC4aWYFtmQ9M1FVY3gN3d+k63dCvUI6h2wEwmiHDEZ?= =?iso-8859-1?Q?uAWKuAoaTmDWrjejsjBiktlkQROjVhCgr6mW8SEvafg6WkMqCrtYtRV9Hd?= =?iso-8859-1?Q?y1RpUaNX5ap/KKSKMeVIi/zJsGWkNwiZqH2exCg9Yagj+Psw6/l9BkhEaJ?= =?iso-8859-1?Q?2TN/chAuHVQK2el6Hne1kXTYC3558rZ9yPC3nw6Ew5HPhatFQkccr1a2ZG?= =?iso-8859-1?Q?12UoVBtVBhmpD7/dXEmhhoUN4fVsjGGju9mA50x9nw/UVdOmDrVxKKPw2O?= =?iso-8859-1?Q?mWw11i86bh2dA9OR/LiznuAtpzJTmFivu1qeeI5qF6XmmW2BhhmOUFmYf4?= =?iso-8859-1?Q?M3LZsxt9lEHU7FW0xs3r7xewwDvTlRi2GNNOimCrfCMQqf9sdTesrrKFtV?= =?iso-8859-1?Q?VI9xYFYEX9oVx1BWFepI+Hc3Vq1rg4/q3Oh6Kxe1ZOuGA5a2ITodA6kI+2?= =?iso-8859-1?Q?vbdb4bosGhQVGd/Ek1hglImqG6h2rQ91MFbPJm08L0XsTeWtd++86axo4i?= =?iso-8859-1?Q?RhSl9Q6oSnwil+ThlsOdz5jOVUdkGQetooDGcVA6T9KVkLdlhPv3hIdXd8?= =?iso-8859-1?Q?gTX3s+AG8cpo6qvFQmgpmFwC+eT+iVEferBo++3SloZoUBCe/TfdD4YpzZ?= =?iso-8859-1?Q?RTgjiSDMn1UflP1uLa5pFEohhu7S2MEYBryN1v4QaQwOgRlAUWKHptDjiQ?= =?iso-8859-1?Q?PYS8lG6Pbyj4dkKnUSP61tNkqQ0FEcugCpNUD6nGWzEeJVvxcgqAOyeZwE?= =?iso-8859-1?Q?f99xVq7oNT9JPTXOGdTiFExZWcqTaBCGzAQuHH5WnBFqCE4raHsFyTZ3+E?= =?iso-8859-1?Q?0NK+ZTrtAOoDX9nntMX10d+ppCJPd5jv0x+w4c9+tz2leilu2TNzh5hk2V?= =?iso-8859-1?Q?UqyXRdTsbikkUOArTa2hVtlx3zMUX/NXyy74Ew7N3mRTk9eXxMJo11yJQx?= =?iso-8859-1?Q?4jzeO2cMER91Fo+13D2L3SVPtokFPlkUNxeqvg9fLNb4SUC9qzLMVzAelr?= =?iso-8859-1?Q?ixMyjZcNTEhjFwF4TOH7DW5uFpgmdMxb0qmdOLSPq+44E61HK+dPHVJ8Ln?= =?iso-8859-1?Q?UzYkY9a5lVWedKRxw54KMx/8Q25MkdL2+py5jXaHXdX9TcUBAo8DBEnVBf?= =?iso-8859-1?Q?F5EFxqVVxmfA4QA6OO2QKCyvPIy9XxWVgINy1xqJUuootPicdRHqY6lpgH?= =?iso-8859-1?Q?E+48faikzFMwXXebGVvo3gewgizngvAZHOwbIJJEePYz0knMTdWV3OVrcE?= =?iso-8859-1?Q?jpLlrh8Bb+ADEjbTRKP4v+xe5lvrAGA=3D?= Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Exchange-RoutingPolicyChecked: D2b3KBDtNzuln7lw0UJOCEU5hJxfLhi9tub/zBSc2PDSpM5AJtFGP/h44IQmSNTxdLNa2zU/tkmbjShSVVsBrIX8r++pTJnuhlzVzyKjmkrTtQ0DQoQLNMScnbrKjf7Kwgw6Qi0K1gbf+bVyFKqZ7VMHcE2nZQVzJt0eqffyPzlJ7uksMOzVnVMCFNYklxOBshrVvVvF7rJF2cVXPRPUJwD9VkS9O6Yhy9R/1hJVHF1rZoSsVvtAvVQAVBcWnMoD5ANrJw9y5kfHWNj0lhFNlJGOSzJqHP9/tpU22FiNvHs7OyiJybyeK9+l4+7YaDjI5kH0w6w5hLOImsVrYetX3g== X-OriginatorOrg: nutanix.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: IA0PR02MB9462.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 4990d684-bda5-479f-fad5-08dee6670096 X-MS-Exchange-CrossTenant-originalarrivaltime: 20 Jul 2026 13:58:39.9041 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: bb047546-786f-4de1-bd75-24e5b6f79043 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: nEFLf/3J/m20HUrFzKKbFb8PxoR3ot/QVuaCCXVaxAl6iGoCGuqwk/di+yI8JnQO957PdXtHVxJPSw2H9xk7eW4YNVMgMYKUP9lEBXgpqr0= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH7PR02MB8883 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIwMDE1NSBTYWx0ZWRfXykcpgzrMS230 NrxomqjlN7C06q8uLSKeD2YzUZHNubggpdGP1RdheVguk58QnFEX0nWQkvAMz928L2pLEhpPBt8 KqDeiwqLVqqkjgZ/S42oAJvymRCcXAv46nmm05n7F2WZk5423nmC0Md01IH8Pp4IjMimRzEd0P1 l41y99Z72079Se35A+HcwDooas5LHVqRJh/r/7YZ2/4ADYCUy8Y+Yr0zYGUqj9FMNvblSFPhxef GjB2FoosO5Oiiulx1nHR8IrbGSTBORtQMdfckrKRHEkmh/CE4/+p/Tkid2l+4N86XC7ZTCMwTMK ULUe201/px2/Nwark4BNAIy7iyNNdXTqyK1KUZjQwm2w+KpTUdkTcxUhyhhS1nyti0+IK5uzjqQ YjR940R4V19lEEERlkK7okdtB1gO7vQ/r/Bj4chRiwishB5QE9/URnPm5jRavpYiK3iv9jZtwdT E0bunKPoIG5/R8cFIhA== X-Proofpoint-ORIG-GUID: dN8mYpaw_iyj-7B7s6LZ8cEfMV9aBWOV X-Proofpoint-GUID: dN8mYpaw_iyj-7B7s6LZ8cEfMV9aBWOV X-Authority-Analysis: v=2.4 cv=ZJ3nX37b c=1 sm=1 tr=0 ts=6a5e2991 cx=c_pps a=jBnIPXBCpefHP6rz4AJLnw==:117 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=8nJEP1OIZ-IA:10 a=RAioF0-LDSMA:10 a=0kUYKlekyDsA:10 a=VkNPw1HP01LnGYTKEx00:22 a=VofLwUrZ8Iiv6rRUPXIb:22 a=VUi8bpU7OL1Oj2-RSIOF:22 a=64Cc0HZtAAAA:8 a=H0gwBzo8t0bp_Z0icpIA:9 a=wPNLvfGTeEIA:10 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIwMDE1NSBTYWx0ZWRfX1S+QjeEzcu2/ tR3i2Lqhodywpy/eLbcuU4nBPa/ia2oVkTfRPverQPKAqzbEkgZtwGzed876BS+M94NEQs5j7cK gOm45/fRjq3FM3C8Tp/YW0GkH5I3r58= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-20_03,2026-07-20_02,2025-10-01_01 X-Proofpoint-Spam-Reason: safe Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.155.12; envelope-from=thanos.makatos@nutanix.com; helo=mx0b-002c1b01.pphosted.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @nutanix.com) X-ZM-MESSAGEID: 1784556145139158500 Content-Type: text/plain; charset="utf-8" Signed-off-by: Thanos Makatos Reviewed-by: C=C3=A9dric Le Goater --- hw/vfio-user/device.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/hw/vfio-user/device.c b/hw/vfio-user/device.c index e58167a818..8350bb2c01 100644 --- a/hw/vfio-user/device.c +++ b/hw/vfio-user/device.c @@ -137,6 +137,10 @@ static int vfio_user_get_region_info(VFIOUserProxy *pr= oxy, error_printf("vfio_user_get_region_info argsz too large\n"); return -E2BIG; } + if (size > proxy->max_xfer_size) { + error_printf("vfio_user_get_region_info argsz too large\n"); + return -E2BIG; + } =20 if (fds !=3D NULL && fds->send_fds !=3D 0) { error_printf("vfio_user_get_region_info can't send FDs\n"); --=20 2.34.1 From nobody Sat Jul 25 11:03:31 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass(p=none dis=none) header.from=nutanix.com ARC-Seal: i=2; a=rsa-sha256; t=1784556094; cv=pass; d=zohomail.com; s=zohoarc; b=Vv8LcNwekGU9NZuJJLRt27j0SkPvwGaTOH1adheLw/FNjIV0kcKohM03Oa0yuvcuRiBWgqXygPxK5HAHFRTB2rzo8+oLC7BQZl+ctu+e/MPDZD2VGIobeC7laaGigFbsX93wUmI9k8A86zlmFs6JbJm6GTyezoVPVaN2cOzIu+k= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1784556094; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=0oOiYBTxU4+rRjU/EFTPbWFSyUgklSJbgBeq4FGez7c=; b=N7nqKcHKVyehwGVIN8eycXewEtHiGd3+rqrWVySAsNbfIQ3j/V9vwyGiRgdlCltbpge+LP1jdNqKGq4ckSgfq4icP/sIPnf/dPR17bkZzSF/QuUvdjPP2kpGL8NWOJHm0V6sdhZ0qwGWvvClmKG646R/EUre59NPE4ON5WJyJYA= ARC-Authentication-Results: i=2; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1784556094255436.5007798528353; Mon, 20 Jul 2026 07:01:34 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wloWU-000538-K1; Mon, 20 Jul 2026 09:59:10 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wloW7-0004oU-Jr for qemu-devel@nongnu.org; Mon, 20 Jul 2026 09:58:47 -0400 Received: from mx0a-002c1b01.pphosted.com ([148.163.151.68]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wloW6-0006ZI-1I for qemu-devel@nongnu.org; Mon, 20 Jul 2026 09:58:47 -0400 Received: from pps.filterd (m0127839.ppops.net [127.0.0.1]) by mx0a-002c1b01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66KDtNY0516432; Mon, 20 Jul 2026 06:58:43 -0700 Received: from ph7pr06cu001.outbound.protection.outlook.com (mail-westus3azon11020123.outbound.protection.outlook.com [52.101.201.123]) by mx0a-002c1b01.pphosted.com (PPS) with ESMTPS id 4fg8jcue54-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Mon, 20 Jul 2026 06:58:43 -0700 (PDT) Received: from IA0PR02MB9462.namprd02.prod.outlook.com (2603:10b6:208:406::6) by PH7PR02MB8883.namprd02.prod.outlook.com (2603:10b6:510:1fd::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.18; Mon, 20 Jul 2026 13:58:41 +0000 Received: from IA0PR02MB9462.namprd02.prod.outlook.com ([fe80::c493:aabb:b834:f53d]) by IA0PR02MB9462.namprd02.prod.outlook.com ([fe80::c493:aabb:b834:f53d%7]) with mapi id 15.21.0223.017; Mon, 20 Jul 2026 13:58:41 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s= proofpoint20171006; bh=0oOiYBTxU4+rRjU/EFTPbWFSyUgklSJbgBeq4FGez 7c=; b=tr2tT4wbKYYy/6pcxe2baecJO5MwBWFIYihPoPEsYkk2B/ilCsrhRXDPw C3t29a8KmE+9Hwxkasi0bHPSS5etHjFmjdH/0xcyBl9p5IqRoDA8lSW3QXBynCdb 75xFvUj5K0G1/34DC8s7W3QP/OuG7VbPAKP+CPh+MTEXhDxkWt/GW0Lqh83mmpfF Ovo61Q5FakqXIJPaxoL0YEZzOPVFruFdtpCJZMp5GDr6J9Mz9FwbWYSDTlfHz1OZ ECvZfaqdYGZOWUQPbsFtK2J/2XVkZWGuK4mZAKLcawCSmcGS2ZjeneD8KvgOVYGX cylIW63Uuk7jWpF5XGRmjc/Fr5EJQ== ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=gxsMIRLwhg074oiAEn6KILm0AK+RwacG8zPtAm6cc5kGdwIwnVobSqsKl8PXnnYKNqSpYvDUoNXMt1iTo3PfAVyrKsKmpotUrD66jSCHM9vZd/jWNG/cHjleFfAq+FrohukiS8eFgSv1FVwL8UM4UpQSw+UFrNfxtfKET96XX6OzRmiiYkmmBMw/pOT9UgkpdUxkrHVN0f25qUL2aaingxt03BNBpy7+kBd7JzAJSf8/ZLwdOt6mcou7AwvqiUJbvL7rcx1gAkNwDPD/HMbilgpRAaxDUtxFNgcLLpNdd7NDvL41rMgeeJxSaogBgX24bOfJVpyghaSY3iCPhkOh1g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=0oOiYBTxU4+rRjU/EFTPbWFSyUgklSJbgBeq4FGez7c=; b=VbRx8eVHLD3NDdtdzBITu2kx9cg1l0qz1AERA7OM57a7NWg+Fzz401DkPmFBjCM/fIVYdewYvY3aa0JEbxGR4U7YukiEGq9Orl6/NaH3GGYrjvSkbX7aint5m/Xyt4a3X7WpqOxc1OxCBDxLC6PZ8/bLAhK5Sn1xSv1LjWkJ1zUr717qkumqYzxkSqRDirJnUVhYHY9PcEYAeT6PdZT+QP++LUs9kPvYyi0I9yK7V32DkrWAqVlMxBbEql+9iHJfEnCH24gsfQRt+pRRP/cXHlrmasby8Sox50GKtGNVd5fdXjdn0j2ROKzO8F1K2KdCRLLrk9vy6P/RppM646teLg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nutanix.com; dmarc=pass action=none header.from=nutanix.com; dkim=pass header.d=nutanix.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=0oOiYBTxU4+rRjU/EFTPbWFSyUgklSJbgBeq4FGez7c=; b=dNZ+W82jpeXSLxwscyuKf2Ix708ey2zrpaZGibu/q8HJDGk8r8CUauGTd1XQT4FDmKeK9uOB8W9sohkBUyXAdHDgmb8Ti0qyZA9P3kxnX+xRsySCOJmxsDVEJuR+uWYeXAmrUf5rgchzNCh0b1amJt33VQDwBl8nfoiMQcHm9KawvamlWRhQBBjEn7DIFxS1IRYFJ+GmzqMVMSAmAbxeqK+2tbQ24vHjjJuei37Yh4pxj/KJmdsEPQBiE70zQCUd1/in2KNvtXiLNDxvu3t3WsuR92x1UjPfzPPJSuZr7VLhJQ2vh+rBKpqEUjMbVLUJevLRMHUtJw/91HAjNVQxYA== From: Thanos Makatos To: "qemu-devel@nongnu.org" CC: John Levon , "clg@redhat.com" , Thanos Makatos Subject: [PATCH v2 3/6] vfio-user: vfio_user_get_region_info: reject unreasonably short struct Thread-Topic: [PATCH v2 3/6] vfio-user: vfio_user_get_region_info: reject unreasonably short struct Thread-Index: AQHdGE/ef2cCCauaqE+6oT4SgJt7xw== Date: Mon, 20 Jul 2026 13:58:41 +0000 Message-ID: <20260720135823.21070-4-thanos.makatos@nutanix.com> References: <20260720091718.2642-1-thanos.makatos@nutanix.com> <20260720135823.21070-1-thanos.makatos@nutanix.com> In-Reply-To: <20260720135823.21070-1-thanos.makatos@nutanix.com> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-publictraffictype: Email x-ms-traffictypediagnostic: IA0PR02MB9462:EE_|PH7PR02MB8883:EE_ x-ms-office365-filtering-correlation-id: edb5e501-17ba-44a5-c9ea-08dee6670192 x-proofpoint-crosstenant: true x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; ARA:13230040|366016|23010399003|1800799024|376014|10067099003|56012099006|4143699003|18002099003|22082099003|38070700021; x-microsoft-antispam-message-info: RDfe+/SKanZh3lYwOyRUDmfvsdRVRQjQH21i2a5q9QAXe6BpdB9ob8vs9GLUwreIR7DHtHvm2EWEqflSRyv6LHdZm1DrSBO3y9aoDTlKfIbcHlx3ZlpEVcyelZvrJ7XC9ITYW3nsHOKeQLyFBJXNwju04F0QB4aN3IOsVAht30mFXrN8xCNgKrDCY+LlXDsEdkXiV7636pzIbVLUj8phqbE6NVO17mdbqDChKxzhgi5oWE4bdaz5Irz3b78l1MCmpjucV+lLBOR31OBPW1UxrUw8t9dprd0mmQxNqGN6NYkOazW/WqCZU63u4UPUZiZBzMz/TMYZfXh80RuW6Yn0jFLuidtmGansONRYRXsKGiSZf1DpDwUCREMFv4eEHlXVYyBnrE4eQQcFFVc/LZPYNCjqSMB5onMW1LW6N5QtZPe34ylfExAFkJNoXvoDmMjGP6N5BGzsGCsfpADxN7egLyHRtr/v8oMndvC3saGIZDapRZaSz8VlldnRo+Gc87VbQ9UsiV2Fas9F6tXUhUyYm2Bxn9FI0GZOnZK6YaFg+EQqPsvy6Y/tjh/z75030k9xNaV0IYNr+gXvf64Nr1Px2NArGaPnXO+aSiY8RMOJTINDJVRDgMA+HnqX0eKaqauQ3w1P7SzCsvIcUmaVDofGJiNzjuzwnuoYw5iC9RpByT6RSNw4YyXtgEZEkpNccELeXYIeAES2faolDCVMCXXEUg== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:IA0PR02MB9462.namprd02.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230040)(366016)(23010399003)(1800799024)(376014)(10067099003)(56012099006)(4143699003)(18002099003)(22082099003)(38070700021); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?iso-8859-1?Q?OiejzjY7XWzNdJjn7DYKcY2hWD6R1wLsLEFVMouVZMk2RKWwXXu4A0nWB9?= =?iso-8859-1?Q?qD4K0i2LdlcxPS5tYIJar3+6gFH0vfhvrMza5NmnEE5mR6IaUFUAtzriL4?= =?iso-8859-1?Q?SzoD8kvZ7HYEQG3cJ/1bYjZ0eaqQa3lHwR5bR1sIKeFRAuICUjmv2WH2fL?= =?iso-8859-1?Q?XRyl9cTfRNk56a0XOg1uZX2TU3rkCFAvka8ua3Y0bWOtF5XagquKaxkGL+?= =?iso-8859-1?Q?3SRI//Ocq8meHx8mNSLBRMe7s1Wkp/K8YesIDF1XWdbA9oGZTh1ZQO4op4?= =?iso-8859-1?Q?XRBF3NzNj5dxP/uh/6ICS6bAcFh//1xGbGt+9izNxYD+QzLlQj8A5wZy3h?= =?iso-8859-1?Q?1GL6m1UWO9xkJyTgNK0eVQYU2+GWYA32e9h5DDkMknnq7XfgZzcYew6eUF?= =?iso-8859-1?Q?rGMc5lHyADKtK7lk/j50O27KZqrAzV3HdP7rY/Pb5ltKh+JOWG3QXVbgNX?= =?iso-8859-1?Q?Jd7c2MP9F8+ehCeCqfybPGwr6diFziDmx1K2EVs9OHVuicPtZnSBYRGVCK?= =?iso-8859-1?Q?j9UVl7++40U++qniaqg5eyYCCWOkJrXl5FESmBw9FowZy1MBAjyH5oNKfl?= =?iso-8859-1?Q?h81jc0koEHvSvarRC2qs6n+z4W9uBYZ32jD/UrU2JedYAympDeZh+0TaBo?= =?iso-8859-1?Q?PNbvQEChpfbMDKphZmsy/U/c6eTrUPpAsLqgO8NVwCKu+u0QFKJ3svwk3n?= =?iso-8859-1?Q?3XSfLWAU8uY2Vy0Kn6JTaY89ZBx/z9q+OsO/4VQN1+zj2KwDcpIfuKuJsf?= =?iso-8859-1?Q?3Ea1hN26vhPBH9dJhrsenejDaJ+VBZCn4hNspfUf7hrvaRn7EslAaeDTVH?= =?iso-8859-1?Q?dMFR6S2dATi1btw/BTic3B/6kXeZY/Na6dL84Bcx6hHhU5W0+cnRhCdCnq?= =?iso-8859-1?Q?ABJNXJcDzPh6qBxxNcUvgLzdWB0iwDzLJHbhlLdnOOgrENeltpJ+7aXASf?= =?iso-8859-1?Q?7dE4Grn/NKjfO3GZNG4YrqpCXkxfWVNtk0yQAh/9QvU5jGjy4oJpjbpBX3?= =?iso-8859-1?Q?e2UE6rBBnRQl5YANMWVoC3ti2T9ZkdopgwYxvf3R3j7MMHSyf6tA89W/Ku?= =?iso-8859-1?Q?cXX9f8FkTSW/CtYddY4PxuQJTApAfgaq4Q2bleR42Mvli9cA/I7OQWcNJQ?= =?iso-8859-1?Q?muHLR57gIND2NkNRSjAso37svtyCotfzl+TcQZD/rZ5S7SpdiP5hCgWQT+?= =?iso-8859-1?Q?Bax/do4iTci4+6QsyEvCyUc3FdAwTBXcJVkwuYJyB4LPn4MrNLEbjmT/iK?= =?iso-8859-1?Q?aSOr0qjoCnvykzuUZHpPoSVhzBXeB02NBexLWtKyRWswbxGvfmWQFfgjZh?= =?iso-8859-1?Q?pJ08AIg87Gm77TQJzCwJse5AhHFnrO/oPIaFOoXZ9y4XvDlnC0ut38Ao5j?= =?iso-8859-1?Q?Tx6CEcUATpOqR/MDUWyMGkN9d60GyroC/G/UCTh+EZXobE5nXWpYtyQs+x?= =?iso-8859-1?Q?V3FHwPxu9nKplvuWQQlo+V1Fu4/bH6pF4DxW0qtF6In7VcGkFtaNnYIriC?= =?iso-8859-1?Q?McSJUudVVEHlnwFJDOPO8jzZteHvtxssExHWVMhcH4Szl2wXX+/Ib5+kkI?= =?iso-8859-1?Q?h3w/jjpR7LGkApFmajBy+Z9lyO1iVRLNFwwD8lSF+KuwSeEXvTzTeAZqna?= =?iso-8859-1?Q?l9k62q7GU2Sgw3ADGnLjDczVeIuwMx9iSmUlvaxiCCAz16tSmzPS3VORZg?= =?iso-8859-1?Q?N9ORv+2/CSuRM9TUJnrX9u+FHunLndnrrmdyNoK/rfrdSDx5/opx8wTr9Q?= =?iso-8859-1?Q?1CB/g2bf4FZbNMB5C+RH+ohIc488iIfybg4AreluCv8msr2pxXNqbP1lWU?= =?iso-8859-1?Q?IuGyyRZfeH/ag77TCH3jhd/Hsf2m4oU=3D?= Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Exchange-RoutingPolicyChecked: TvZr6Mlj4xAaNopTj/eXvWOV36VtPQajVZ6MCfL1ce3GkXBZwMRPX/Ra6uMJwzdupP1i/q1jwoVXT0wgIHSNMmOVWDoTap+g/fpDf8tSHp7p3WXgLe7SArX2v+7aVDwJMjIQz3ytYQHOK9RXfuP7ufDltt8oiOyc5IsDRNBGDHKJHgPYMIYDuSjmBG3EBb4Gm9zpttpJo2ocqIaWOtscMx20bmd/rMoGZwBL3fBTWobXVHlawtPMrFJVMXFPGAUsIADAdBA/I1UeOsYZYuNcblDLQfXnNvZzuAGsv4JSYME+jGnL0f5JY8ysawVasOI3NqaTYvk/xqics8YHd3NnhA== X-OriginatorOrg: nutanix.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: IA0PR02MB9462.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: edb5e501-17ba-44a5-c9ea-08dee6670192 X-MS-Exchange-CrossTenant-originalarrivaltime: 20 Jul 2026 13:58:41.4193 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: bb047546-786f-4de1-bd75-24e5b6f79043 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: a2zuvY62j3tKtNDse7WFaNGzfXNKmFN8OB/BQzwM2B//iTW1GtEnOk1Ra0atMlHXAJW53XD2a2eF3X3KPfWXPWdY5gdb+uMXH6WXMq9gh7A= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH7PR02MB8883 X-Proofpoint-ORIG-GUID: qJhUEq2jg79U0-xSZmepAgoaH3wbo1Uk X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIwMDE1NCBTYWx0ZWRfXx3YvxIbUet5X UuM/KknkEqo20Bv7H2Lp97ABJd18jiLP+eS+WKX4oCAQtZV0Pp2Hj/eGamOafzf2ZCWOJUoqvLS 2bfnsF7qPAHIXl4Ei+VduzW1FHzYpQk= X-Authority-Analysis: v=2.4 cv=R6Yz39RX c=1 sm=1 tr=0 ts=6a5e2993 cx=c_pps a=/J5H70gqsNCigf7dtRDCFw==:117 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=8nJEP1OIZ-IA:10 a=RAioF0-LDSMA:10 a=0kUYKlekyDsA:10 a=VkNPw1HP01LnGYTKEx00:22 a=VofLwUrZ8Iiv6rRUPXIb:22 a=y4UcunY2MAxhM4LwGdWI:22 a=64Cc0HZtAAAA:8 a=iamFcwByjoOU0uyVQI4A:9 a=wPNLvfGTeEIA:10 X-Proofpoint-GUID: qJhUEq2jg79U0-xSZmepAgoaH3wbo1Uk X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIwMDE1NCBTYWx0ZWRfX4+aJ3jjRTL7c XS3MMWRUbvs+nd63l/hTlO6VOGkSyaoSgmeLYmpsyKfAQ+DmasdfgBCuMcOj8vg7ch3KJkSlOl3 0hHW5QhqAKk7L63Hd/rbAbjbSDXjI+DPj+mvfgUr4sPjg0GZsAouU7/nWd6eJBNi2MVC5Hmor49 lMvhXMPYzs1elwRmMWxLuG0PUXbYoxmKVOCNoxJsOGgYXC4NAihFpo+37TxoIb/xwKDcI9TQtzE 2ZfR0ZdRTYs3teSZfCabEvmWwxEyzQhAAo/yPnqXW308lUU0NlxXt5VgdSMVJ3AISkmBqRegxY2 4NhzoaSFEbDJwgCHe27vuR2c932CVreqzPBOEczsL5lWzlyRTfbdDXHd9tvTqcqnYAWvtT+40ak 9kRAdNNkt4NjIrCW74DzqV/ygBzWmuY/AEka4ACsGBB0BdBrbDuO7W7H8K6klFc2voNELRt0qXl 7YydXA7eLBs7D/VpyYA== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-20_03,2026-07-20_02,2025-10-01_01 X-Proofpoint-Spam-Reason: safe Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.151.68; envelope-from=thanos.makatos@nutanix.com; helo=mx0a-002c1b01.pphosted.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @nutanix.com) X-ZM-MESSAGEID: 1784556096646158500 Content-Type: text/plain; charset="utf-8" While this isn't technically a bug, it's highly unlikely that the server wouldn't be writing an entire struct. Signed-off-by: Thanos Makatos Reviewed-by: C=C3=A9dric Le Goater --- hw/vfio-user/device.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/hw/vfio-user/device.c b/hw/vfio-user/device.c index 8350bb2c01..3d12e8b2a2 100644 --- a/hw/vfio-user/device.c +++ b/hw/vfio-user/device.c @@ -165,6 +165,11 @@ static int vfio_user_get_region_info(VFIOUserProxy *pr= oxy, } trace_vfio_user_get_region_info(msgp->index, msgp->flags, msgp->size); =20 + if (msgp->argsz < sizeof(*info)) { + error_printf("vfio_user_get_region_info reply argsz too small\n"); + return -EINVAL; + } + memcpy(info, &msgp->argsz, info->argsz); =20 /* --=20 2.34.1 From nobody Sat Jul 25 11:03:31 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass(p=none dis=none) header.from=nutanix.com ARC-Seal: i=2; a=rsa-sha256; t=1784556148; cv=pass; d=zohomail.com; s=zohoarc; b=Ytr7buB2BHM4k7256EQz9ZCUCJxFh7Gc9SQCvVeBtwFBwW52k8JD4wjUxMusChwJzejemCMGkz0fslAcUEOouIPAA0bjHdLtfML5AA2Y4IYlm/34bCm9jQ6VmlixWCQmX/gKgW2+jb3ZQIrlqQQNoF2ER4LTMJ8x5QgjbwOvcQ4= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1784556148; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=xzc4N8dvKbD9uXyIYhEfK6UQe18lvcE9RZRcTfQ0cAY=; b=DPlA+NhGiAMJRB49/cnbbQ5Zi4/hiWSottxgAz4/MqX0nfSx0MgWQ27KHldBcunkp7EYwR1i/6aiV2Sr+jgNNY4mYRnDyAAqnCIlK765HgsgX9T0vJUNF4FANSfVd7LMnkFGgzXhODkTfCNDZqQlGEV4jtoOpj3p0pbSF1mbJsE= ARC-Authentication-Results: i=2; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1784556148177186.82464485456376; Mon, 20 Jul 2026 07:02:28 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wloYw-0006Of-MZ; Mon, 20 Jul 2026 10:01:42 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wloW8-0004ow-3C for qemu-devel@nongnu.org; Mon, 20 Jul 2026 09:58:48 -0400 Received: from mx0b-002c1b01.pphosted.com ([148.163.155.12]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wloW6-0006ZV-Hr for qemu-devel@nongnu.org; Mon, 20 Jul 2026 09:58:47 -0400 Received: from pps.filterd (m0127843.ppops.net [127.0.0.1]) by mx0b-002c1b01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66KDqBZ0608272; Mon, 20 Jul 2026 06:58:45 -0700 Received: from ph7pr06cu001.outbound.protection.outlook.com (mail-westus3azon11020109.outbound.protection.outlook.com [52.101.201.109]) by mx0b-002c1b01.pphosted.com (PPS) with ESMTPS id 4fg8fskdj8-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Mon, 20 Jul 2026 06:58:45 -0700 (PDT) Received: from IA0PR02MB9462.namprd02.prod.outlook.com (2603:10b6:208:406::6) by PH7PR02MB8883.namprd02.prod.outlook.com (2603:10b6:510:1fd::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.18; Mon, 20 Jul 2026 13:58:43 +0000 Received: from IA0PR02MB9462.namprd02.prod.outlook.com ([fe80::c493:aabb:b834:f53d]) by IA0PR02MB9462.namprd02.prod.outlook.com ([fe80::c493:aabb:b834:f53d%7]) with mapi id 15.21.0223.017; Mon, 20 Jul 2026 13:58:43 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s= proofpoint20171006; bh=xzc4N8dvKbD9uXyIYhEfK6UQe18lvcE9RZRcTfQ0c AY=; b=YiTksqlvGheGHRWnrSLAHsr0paIeN9wdct37Bb7a6xfKuFsXfxGTgurbV z/IWk+nP7EsGHFOg97wb+v2yGtNIqK98O4VgBeqbDbXE0akp681nWsGHcoI8jR3Z 7QIMiB/d5Z+Hta0SuYUyTpAlcMdpFgRLs92cu9677lyYuQwnXVIPkC/x6I78LDQA Wm7TmhJLvNQU1CiuV3mwgQJYrUm6YhpsGixARFDnps5LoR+tsMGeBktxhjsWG9Rd Wf47dRpMb0zWjiTYaJXeTaJ9l/VQq/c2AxDpRdaSeYKS6E+3W8dWUsiHupw7cO1d 8TMXvuZ4h9cFZuq/AL+NrXPzBXgVg== ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=Ue6AzeY5SmuAMW/nNVqvo3+xHcrWxOL38hd2l8vIC1LV12N1DG0QIieVxzu6nogIPMuDhRQvStbryhPsNyzRGR0r+hoxlyV8ZyXVv28iy9ZTQIsWN3rwjnJ9aC6K49h5IXNYUlGyYq4CAqIT4pTzDJ4ugALiQX7FekGRJmntSbqTU0CXEObrR5h/uQVg/amrDduo2Lp9PmoUbgi5JpMvLM1AP/XbQIDtg6Q79HODHAPpQNEGtRKoi4n97Rvd7Nw5yLLJ8Hyg+LhNcH7sRTxfJJgxof7VEVGegh2JVBK8Nm3o+9IXtkhMTEUUU40VUBYUqJEN7yxUu/H9t+vrqnKP1g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=xzc4N8dvKbD9uXyIYhEfK6UQe18lvcE9RZRcTfQ0cAY=; b=WeyAnTSzv5X4/yW3p6ryJPX07zw7+O5wNLYzl0bndtENpiI5qIzfzPP6+CwoOHYF+r2Assv4VWmKLp5uHa6yQ8vVdxF9TaqV/UR7yjxc9vByuSW5uBl6a/4UncpdZZZS/MABhHAzau3e6Zc6AMkTj682XoDyfNhnd6KDfqhXFN10ENtBSbG0CueEaISdx+bYfoBLEmoQhtDrwwfhssZUIwU8k8A0krd4OXTdffHRSnD1RNkMIEScE5+vVQ2lExRYI4ZGQAe7U135Mz6A1LQsX3Y2+pIzG138mfch/6AGX8shEc+BYqVmZ0GB9ezE7lAhUmnu47YhUAcNxzCmzEbvnQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nutanix.com; dmarc=pass action=none header.from=nutanix.com; dkim=pass header.d=nutanix.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=xzc4N8dvKbD9uXyIYhEfK6UQe18lvcE9RZRcTfQ0cAY=; b=YZ0cG4z2Fd/2gO+3oi2vLvykIIGvVN55Bd0S4qJkZcQElcEcvAD9xX139dpbm1KT1bCDuzG3V8vxecdQtQObwd7RCIGhgizoU9ygnipFW9bRQjXljRG9IE4TJW2RzUB9rcetLKB+wT8Cjcd8fcgt4O6q1+0qqCmuqdb1krIDKCmYRnKBt/BBzDhy4y5uoMQH9fsFllXBYlG0M2zXjFEEJEq63esVMRgsuETrdPQLgNO8DVciS/IArRPFqpNqso7yX441bvVcQsGnvI/tCHr650r/z557qV/iB0iofKr1ysJNrYDw3VJ48CW+20gmZOCfV5HcrAwVY5P9Iz96flS1uQ== From: Thanos Makatos To: "qemu-devel@nongnu.org" CC: John Levon , "clg@redhat.com" , Thanos Makatos Subject: [PATCH v2 4/6] vfio-user: vfio_user_get_region_info: prevent excessive malloc Thread-Topic: [PATCH v2 4/6] vfio-user: vfio_user_get_region_info: prevent excessive malloc Thread-Index: AQHdGE/gQXaeAe8CpkGp6EoaaO2i0Q== Date: Mon, 20 Jul 2026 13:58:43 +0000 Message-ID: <20260720135823.21070-5-thanos.makatos@nutanix.com> References: <20260720091718.2642-1-thanos.makatos@nutanix.com> <20260720135823.21070-1-thanos.makatos@nutanix.com> In-Reply-To: <20260720135823.21070-1-thanos.makatos@nutanix.com> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-publictraffictype: Email x-ms-traffictypediagnostic: IA0PR02MB9462:EE_|PH7PR02MB8883:EE_ x-ms-office365-filtering-correlation-id: 5d8937cf-24b8-4e56-e4c1-08dee667029a x-proofpoint-crosstenant: true x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; ARA:13230040|366016|23010399003|1800799024|376014|6133799003|10067099003|56012099006|4143699003|18002099003|22082099003|38070700021; x-microsoft-antispam-message-info: zX1xNkI8PykuhZ33K6sNllwSKqGMoyg0wAUsPq2O0mJoe4q8xWoudcQ8regOwuLkfKAuCq6A8qFMqBeFJlNHe3HUUY7NCWsH4M+UJgebYXsIhrwG5KdtlnHhB49D2Z0f9rf+CQMQ+NH1loD7rRWeLoa5KFrXnJEvs4bkaee9/bo88tHxgwWTgXFNS4KPdQVGeXDizQv5Lhn5h4yQVz1aNMfdYxBpeXZqvUTLuRzLx+1abwCnpvYr5yQg8FUNDMQfJAGRFrCm8wSdhyh6X8UKdrTRs2KhwJHFPIkUAetCG+5kLGYh835BNygA6Vrk9zGOpYsFxTA5+kpT4MCrh8FvzAk5CYM4F3NQgjoqWv0D54QGhRm43b0Kg2dCBbLajYqWt2WTdAYaBrX6dSLH6lvIpAEjUAlimI3kDim//fTIcASRp96PSqshhVLEopQ9+VqK0qNBExJecKYH7wAKC6ZXokyPe0rXDHahgN5fC1fYUqWO249jnpzSWVprnqCJdJOWc4qKLgVwoyY9+ZrW9tuIcrwdwiwd/J4NmYhBh4XVr9AZXOyOsIw+aVZ8Rddd6bGB0y3dPJwOA7TPZ+AGKCEiFyuEsxK45rG5wZo9wvnovqUPVqlPaj3K/qcNsvAfZ7fyT84b3lTlKNoRg41e4kWySe/wN9ml5KzBWhD6JrgkZMZPKqT0Bw2eaOg7hcOzxErFEvx90szJVh3U5jW4CrNDJg== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:IA0PR02MB9462.namprd02.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230040)(366016)(23010399003)(1800799024)(376014)(6133799003)(10067099003)(56012099006)(4143699003)(18002099003)(22082099003)(38070700021); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?iso-8859-1?Q?awumcNoDIRz81skJTupYMGV+auyh05M97zNtU3ypwAjPGfGlhcCjFxX0da?= =?iso-8859-1?Q?MBLVw6FNkIPWgmXKL6fSOQA9LCn70KEIsSQcHHvJAfliwS4nc44LrOmgFA?= =?iso-8859-1?Q?1ewhmsVjtNG8RYaBtYf6ZqLPsNLJR7MqL7J7xN5hR5MRV1AuUuVAFouUVK?= =?iso-8859-1?Q?Y1LsfVY+Etf+4yWXIXp35vINKtyTt6A3+5OBn9MznEhHQjIf/xJ8KX6eqF?= =?iso-8859-1?Q?rgcbTRFxrQMBBVxwvIifSWgWn5JXli9mAxNxdHllX85Af631oDJxoQlBjI?= =?iso-8859-1?Q?qt/uoBNP/wu8ATXpz4OgAI+tGhNebQeKnYt68iW/wr2tti612CzW4ki0yA?= =?iso-8859-1?Q?lxs7czMFW14guflUu8Bn1x150r2KvGTdAJXgRpkgKIS3zMjAfwUmpsx8x3?= =?iso-8859-1?Q?6gaEnxI3qFPSXUAcZcnA0BqODy2WxjnFQf8sRFIguY58owV/b8w8aZ+/wn?= =?iso-8859-1?Q?gVrzdGJwJfKr9+9jjt1Ri8QDVZG3bkByGszZwFfYHVFTDOiAT5SLGkSZxj?= =?iso-8859-1?Q?3uNbmrTggYdG73XFGCiE9aO8/bzOBzjcKRJyAnSMXwVhXcngH0S0x2Umgi?= =?iso-8859-1?Q?X0+Cvy0PBoWHihtzxFfTcZ+8qCLTHnLl09XsxdbGuwXBUg62hLHYISx5Ef?= =?iso-8859-1?Q?HWcto++n04mYQxPJ4LTXTs61sVUrNk8eIbhGEYn4ZklCET2vO40O28WmD2?= =?iso-8859-1?Q?JZZYP3Fa+S+CqlrAPGvt05bljmmiac79mZFAay1dY5zaedDc7dTdn6XmQA?= =?iso-8859-1?Q?UZYwABAyVd5TF6OkpzXxhK34vaAGSY4U8PfaSf7kcygspaYZop9s+3z8KX?= =?iso-8859-1?Q?gOQKm+4wMFDPqhDlw65P/UFEcXHbPQ7oRKYFO/EXUKCgKEdM+w+qF00pXF?= =?iso-8859-1?Q?r03oiUYTnwMcBGlf1GOc8ti6V2bZn7rmaEC88QG/vPash4PTQ0htoQPkca?= =?iso-8859-1?Q?Gis+9sg4A52rJNFlqVw/A2SiKJSG88kzCQA+zLAWgrmZKRBvK1+c6w4sb8?= =?iso-8859-1?Q?pTimUuGUcfgstT/dGk0ZYEyJ0GqMPB6V7sG+AGtFkvrIIyRr5diMyi8b7u?= =?iso-8859-1?Q?cw3OHbikRbMLqktPqiEt1t6XtDmcsn1rDcW6hJxoqulktTBTTTMjrpeeJj?= =?iso-8859-1?Q?XBUZtDXIW0lIM2jxMDiZUnUGEBDwVRJ14l49pyF0/NJdollkKkUNXGm1S1?= =?iso-8859-1?Q?cPan87t1xthFovSV2l+ocf6E1BWtiTAhGr5zsKkXg6BHrMmqP8qsm8NKTf?= =?iso-8859-1?Q?pvl3vOW5Rm141C5VC1xRuA9jkS8L8SRwBd90CvrZx2bE/ZiWkiJ17qhybJ?= =?iso-8859-1?Q?y0hRBfSPBeuMFMJleRXnqLnp47q1eL98hqPVFtEFYbmpD7nu0K1OVcEVEw?= =?iso-8859-1?Q?5NzbBNYWxCJUAiXYbUvzhYwy4ZvGvowszUAI0rOzWbcn56T4s8U9pXxQTm?= =?iso-8859-1?Q?nweQ2L/4DNYmg3qUIvvK0cvJc/WSFNZH8oYhvgfRx0xRTEaYPXdp9pS6mh?= =?iso-8859-1?Q?s542qY7qEPQ1m4ayqoMJEE4n3t0IknXmYU0uOjvUfdEGleZI6sis5FvjD6?= =?iso-8859-1?Q?hX6Xs1iNd0Dsu4LMU/1mkOgVOtl7B9FSOHJEdlnD3+5Fo0ZVu4PYj/ZA38?= =?iso-8859-1?Q?3EDv+H2pmhCGWVoatcmXjcna/A5XeFTwCkx2vREFxr9CCPjuRq5/z/8XqL?= =?iso-8859-1?Q?UfSBFRwLFGXOCg1cpVZg6NMFgX1jARLTNL5yURxCX3kYj5Fsn4swvbEuhM?= =?iso-8859-1?Q?ANLAWsQ8AKNImtUcRWaP0B97tjf9hZ1eemgy8PBbQPqCpLw9LgoWnjb+Z9?= =?iso-8859-1?Q?Sl22ZZfvEDoa0PQnoSu9DG2RuLMQZvE=3D?= Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Exchange-RoutingPolicyChecked: oNO4dwlKJ+2ItxWvl9gsMXwHouz1ioqVKc9ifxzgSXtuehnf7AJcLiTGQx+JTPjr16j2JjD5VOuYEZE7U2jKiBYWUfulwDikTEYAsODm29zyxPIylTXlqS1JnTKCX7aXog8TEONf9Ac0WqWGG1HCVRw5LvQmDWNiNY+BVSlmkxVPvjtjDv45OxsmpopUMNLhcLFv7B83JQswJjzr7tSmvS4jz7sXXlSQOHh6YDlYHXCNRpeE8gkRYh197QKVM/m+8+KirzPTrO+7oq1a/Rq8A5X1a3fhmE7tReTsJhHOwUJ+SqxcfwW2ibZfVlmAOu1hHJ6Cd48ULOJTn+0cpa2Acw== X-OriginatorOrg: nutanix.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: IA0PR02MB9462.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 5d8937cf-24b8-4e56-e4c1-08dee667029a X-MS-Exchange-CrossTenant-originalarrivaltime: 20 Jul 2026 13:58:43.2219 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: bb047546-786f-4de1-bd75-24e5b6f79043 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 3FiAb+rfD6usuDE8U/VUf9aul3rnbb5LRVSdEr/TIeZP+ultydM20jSYqGqJ5uvdnGvQr8PBiLRRfux4r98R5Zunltsh6K2JnWQDicJzRvs= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH7PR02MB8883 X-Proofpoint-GUID: G81HQDvmROiDm3bJjJGU4CkO-1aF9sNL X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIwMDE1NSBTYWx0ZWRfX2DKZKTvPC8DZ 7Q3SRRy3X1GhTsLCQs2WIDZBDotfIX0cq9s/Tqw69loIerWepIMT487Ew+wUp9vyq6qRLukwbQJ FySbr2ee+FRR8JVgRbhFoEVCNAS1qoo= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIwMDE1NSBTYWx0ZWRfX0ubszajCrMpq a5Yx/INAI+DcKCAd04SMx+p7FRTkue49j8a7Gg4VpgYMxPYTn6pOAU73Q8CIOQgInR8nNSjJAR6 YiO1ddqg85zDYmwUP59Weip+DXuhPuBogNqWQIbgGHIBHjPjBySosMc9wBuxSEhVdwebF1qdAbr IH5lCbzkNI1ePDJiEpKHcfIrBXYLudgIC1OgQGSZC6/BcFtPXBhwgwsn0giqUIsPQOm1UWMM56R Z++xjOsDpKKwdvCqENvVtWpg/frkqNImT2lPGxgfXKasa6wAXPjpQxN+heQf4wAT1FAH+/qlFoJ lFha2/H7N2bvNLFXjmYNwVw7JcwO0ZdEuvTSo8r2/0XQ5QhjiOC+j+Ja068QbTRjSmi77A+vgIq gL35yjxX3vXnBAfLu3W6NwEra/1dcc1IaiTaepvg4JuvNyk6diBE4opD0xI+sjwF+1S2vciNRN3 9GrrVCgIH/RVo0jNGPg== X-Proofpoint-ORIG-GUID: G81HQDvmROiDm3bJjJGU4CkO-1aF9sNL X-Authority-Analysis: v=2.4 cv=Ifm3n2qa c=1 sm=1 tr=0 ts=6a5e2995 cx=c_pps a=9zeqhqFsX+GWigQuve45qQ==:117 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=8nJEP1OIZ-IA:10 a=RAioF0-LDSMA:10 a=0kUYKlekyDsA:10 a=VkNPw1HP01LnGYTKEx00:22 a=VofLwUrZ8Iiv6rRUPXIb:22 a=dEe9Ve2bX-KnNSUMM2s9:22 a=64Cc0HZtAAAA:8 a=Wq__iFXxit1-DUNQLyoA:9 a=wPNLvfGTeEIA:10 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-20_03,2026-07-20_02,2025-10-01_01 X-Proofpoint-Spam-Reason: safe Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.155.12; envelope-from=thanos.makatos@nutanix.com; helo=mx0b-002c1b01.pphosted.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @nutanix.com) X-ZM-MESSAGEID: 1784556148918158500 Content-Type: text/plain; charset="utf-8" If the vfio-user server responds with a value larger than max_xfer_size vfio_device_get_region_info() blindly uses it in the next loop in g_realloc. An value larger than max_xfer_size is anyway rejected by the check at the beginning of vfio_user_get_region_info(), however that only happens _after_ the g_realloc, and if that value is excessively large it can cause g_realloc to fail, so check it here. Signed-off-by: Thanos Makatos Reviewed-by: C=C3=A9dric Le Goater --- hw/vfio-user/device.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/hw/vfio-user/device.c b/hw/vfio-user/device.c index 3d12e8b2a2..008e5cf687 100644 --- a/hw/vfio-user/device.c +++ b/hw/vfio-user/device.c @@ -170,6 +170,16 @@ static int vfio_user_get_region_info(VFIOUserProxy *pr= oxy, return -EINVAL; } =20 + /* + * The server can respond with a larger argsz in the reply to request a + * larger buffer on the next iteration via vfio_device_get_region_info= (). + * Reject values that would trigger an oversized realloc. + */ + if (msgp->argsz > proxy->max_xfer_size) { + error_printf("vfio_user_get_region_info reply argsz too large\n"); + return -E2BIG; + } + memcpy(info, &msgp->argsz, info->argsz); =20 /* --=20 2.34.1 From nobody Sat Jul 25 11:03:31 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass(p=none dis=none) header.from=nutanix.com ARC-Seal: i=2; a=rsa-sha256; t=1784555989; cv=pass; d=zohomail.com; s=zohoarc; b=FyKQh+qTFXTVS2nDNifaULs6p+RcYXZXQqdYcZ5K7nLIVoMi1fl2E9hjEgcqKQpBpkuyRGgMVFp2Apobu82QC3cqZ4sxpAQ2mMxT1c4XRjtMlJpkSaulP4oazbQ1jeA8yz0AkJzj4i0PAX61Q/yWPv0KF2vr2Nw9k/QqDQFC/Co= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1784555989; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=taSwb97PtJK/d7URjCNzflFbiBGWh5zvljg1/I9YdZw=; b=L+efqla/KLttfbictyu7h5zHk2eGFcMGqESRD4Z0dSzf/QwM60XBDaURIJQthbFuIubIJloyphIiwTijdtNS9V5MrdyQ2LaFpKtYNwPo8VUxENKnYzdr5xLEM4Az3J87PpTDU/4W7c47MrofKxLbkbAi6rS2yi8mHwmjk9gaqfY= ARC-Authentication-Results: i=2; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1784555989681911.9598881570488; Mon, 20 Jul 2026 06:59:49 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wloWV-00053v-NG; Mon, 20 Jul 2026 09:59:11 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wloW9-0004pO-8X for qemu-devel@nongnu.org; Mon, 20 Jul 2026 09:58:49 -0400 Received: from mx0b-002c1b01.pphosted.com ([148.163.155.12]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wloW7-0006a4-K3 for qemu-devel@nongnu.org; Mon, 20 Jul 2026 09:58:48 -0400 Received: from pps.filterd (m0127842.ppops.net [127.0.0.1]) by mx0b-002c1b01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66KDq7K7587428; Mon, 20 Jul 2026 06:58:46 -0700 Received: from ph7pr06cu001.outbound.protection.outlook.com (mail-westus3azon11020117.outbound.protection.outlook.com [52.101.201.117]) by mx0b-002c1b01.pphosted.com (PPS) with ESMTPS id 4fg8tbkdru-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Mon, 20 Jul 2026 06:58:46 -0700 (PDT) Received: from IA0PR02MB9462.namprd02.prod.outlook.com (2603:10b6:208:406::6) by PH7PR02MB8883.namprd02.prod.outlook.com (2603:10b6:510:1fd::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.18; Mon, 20 Jul 2026 13:58:45 +0000 Received: from IA0PR02MB9462.namprd02.prod.outlook.com ([fe80::c493:aabb:b834:f53d]) by IA0PR02MB9462.namprd02.prod.outlook.com ([fe80::c493:aabb:b834:f53d%7]) with mapi id 15.21.0223.017; Mon, 20 Jul 2026 13:58:44 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s= proofpoint20171006; bh=taSwb97PtJK/d7URjCNzflFbiBGWh5zvljg1/I9Yd Zw=; b=1pTBePFZpUhnWWGrxGY7J/wVJtAsy3+oWU6ClY4XWxX3LXryXXj80n07H cU+OU+HPONOGdC/s3ebOarVXcRN1JP5j0a0I5rVJVo99lkGCmhhi5O2O2SrRYw6D rgFVcBi+Bb0Uvy20YmFwD1/QUGoulKEuQQ9h/D/8XFmZ/7M+007qHEaH36PN0C9I 4pOQcWc4PGrNKJgAzNFgJpYQe5heLquyQuypIpczSIxEs5ZMnOHmUFYD0zE1UUIE 8iiBQJLlmhiTUpWuJUiHFzRIw6NsBRHEDArAbewHqWmcpqZMjc1PomDvMbzf4+L9 OI4+m7ydQY5SSmuEG9zRBeQbdMnjQ== ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=FmaVLOMVF7cKksutULQNLmHHbaXdjYLwxI3qRcRe1pWl63FMeXpOqwOEkiS95cg74k1J7Lq/A0VrPMCfxTzTY11Yt4N5JaxaMBRjbrDuKclILUbdaI23psPhrtjK0nK+PUaoxaNcMUJjvMmZxtp3/edT0SczKtCKXqvwc9L4fz5T/XbBfMFZy3dcwftrAB2f/rhocvpSTGc6a5/6ErlEz01E5B6cpT94lqjrc7qv4nIe8PIoSDO2gI2W7FSwy7k0Bid3Z17isnq0soOGP3uLzS3PQ+cKCgMO0N+RJC8LxkdQ574xyu5DQrPcn9Ha7lOqk9li7NSF8SLLXQI3fHx0qw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=taSwb97PtJK/d7URjCNzflFbiBGWh5zvljg1/I9YdZw=; b=D3jNyW6tYNtVRmFm/t3FvYqn6FvG6UnRUhgb9xmGwuuLTiJnHEjmcyQr1BEu4ZQ/yykt5CQP6GuPoF25DgqBl6DApiUpad0q5u0UumD42/b/kp6SMdNFrtAeKhVrAWRwVLCxFIoOjh1BHWp54vyn7d5vBSco+cAQnllEIPBrfwg1qp22syuDeEkZ2SAZ5Vur3I0mPzK4cpuVWr0N6RfjTyOTRlkEBHguUWLxEYnWMB8LotJgBH/ZfDiN34uOKHiD1wzMRmfoiW5leJz66DnBOfYX/AqLBaz86XD0IUkw/RXZH3qWfkTU9PJ5Czxl52sYYdZO2uuoG8SV4fVCQUtsTg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nutanix.com; dmarc=pass action=none header.from=nutanix.com; dkim=pass header.d=nutanix.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=taSwb97PtJK/d7URjCNzflFbiBGWh5zvljg1/I9YdZw=; b=pSSSqFJuqM9w645qCDrQqryAhmm9mN0+d9cDqOdbY3nM5hFWUTKBUyV9LS0eANR0pP9pNqMlbO2v/ca0PnL9mF5Io0rJrlGaiNMGjlb3O/FQopBrnVNC38PZVo+Njc6nlXZn4JbSj+no27fEv6Bfs/juESXC5Nl1Cr9eKHETDlj12TmF9M+6kt8AeLszgXWpTGpRZyHaS1c2JbOcbEGdPgu7kf+6gyHQLjjU+tzm4PxvjNoUUxjrxjXNDX5xyed4G3m8Sc0NR+D9oTENmCxO24yWAdJvJuNB/pvgwmURufoc+68R+HaQ1Le8kHGp1zKpjO/uw+B5WUnngRyVeCJzsA== From: Thanos Makatos To: "qemu-devel@nongnu.org" CC: John Levon , "clg@redhat.com" , Thanos Makatos Subject: [PATCH v2 5/6] vfio-user: vfio_user_device_io_get_region_info: fix capability check Thread-Topic: [PATCH v2 5/6] vfio-user: vfio_user_device_io_get_region_info: fix capability check Thread-Index: AQHdGE/h2BHcn+9wLEi6wXUrwFnDcg== Date: Mon, 20 Jul 2026 13:58:44 +0000 Message-ID: <20260720135823.21070-6-thanos.makatos@nutanix.com> References: <20260720091718.2642-1-thanos.makatos@nutanix.com> <20260720135823.21070-1-thanos.makatos@nutanix.com> In-Reply-To: <20260720135823.21070-1-thanos.makatos@nutanix.com> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-publictraffictype: Email x-ms-traffictypediagnostic: IA0PR02MB9462:EE_|PH7PR02MB8883:EE_ x-ms-office365-filtering-correlation-id: c0e5ba22-b9a8-4195-3a10-08dee667038c x-proofpoint-crosstenant: true x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; ARA:13230040|366016|23010399003|1800799024|376014|6133799003|10067099003|56012099006|4143699003|18002099003|22082099003|38070700021; x-microsoft-antispam-message-info: YBQkwfyPzHzQiACbo59WA18TbxGo9WSdtEWCOqEOY/NpuffQwROOoaAIKlEaUond23MhgUxcedauW05KRlSB8XettV8zn0PtCFBrbpYk/qxn6Ldhq087T2cXR1LYCX+o8z9rEffnTaAGrE7w6JU6Pu998oiKgOkEkLLanA0QP+BLdzeKfmBH1mLwWxjLC3oFYm13fTEtSmiBeyL+PnTksq5fI2tvOsBH8W34ysFnfqthRQ7IW/VHyGDZGvMIiTvOcywdtE8pbZfKgl+6jyAsEU+s51cB69rMpPGzLPhVWhu5j3GLwrI/JhXTqdxxFzRHgBu3Ds7l7on4tZGeY+rHeYMpB+cKlKS5uMO3QXakomvO5CfIsbKi0AyDDvXmxwubO5AZQhKMJWu6hgDZqYf5Yc5BJi9b0Fx7NdG4LctFXNv776N6hngLk8jF7VyQhalxF2+9cjgLcnxJieZRJvLvQ3IQVZzC/hK3UtiKqEXRkU+Nc8ze6TZkmwfjHnUD0DZUfY7hl0V1rCBTpsn8HwP87NNbJdGHHWC7LlrMES6AQXpAgce9CZtZWrKasSnJ7SAC9sPOmitPMOxT7z97atSqrj4GZpsyO3w3XWEpnCyG7zyPUL9m3tGP63/0firJdBlXdzFRss+ttfgpfbs3UKIp8vOpE2IMkZBufxeketWp5x/z3zDDqcYF6a1mHPzgFkILEV+7fwEp/p9JLz2mYnF2SC1TyVst/pmkiPzIau1fsuc= x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:IA0PR02MB9462.namprd02.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230040)(366016)(23010399003)(1800799024)(376014)(6133799003)(10067099003)(56012099006)(4143699003)(18002099003)(22082099003)(38070700021); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?iso-8859-1?Q?onQGZHxmPViA8nQx2JG3qG/SEL1GYdS6LBIunG+R0KN4NCWvNpXneVQX9x?= =?iso-8859-1?Q?yHSW3yuhAskJrhbgMu2GamYg5pluIt1WW22YDVKbM4JQtGX3zzVlpvSlFI?= =?iso-8859-1?Q?duCXYCUh49RM2jFHtwNp4jrMPwyHlLYJEmIpbIli+P60sRWhB390ZW8j6q?= =?iso-8859-1?Q?eS10LL44WqO8v9Z1Joc6IJUstZJI6mUK280IwnNv5HYYhYIqwI5ghWYTJB?= =?iso-8859-1?Q?EnbW5FpUJV7TufSEiarEEcEUGFFbXep8aJgoQ/7VXipr4Q4ied2nq53Vxa?= =?iso-8859-1?Q?S3IaSLO5R0mjUStVqzXz0Wzww1A5Vn34iLGo/35Ud3lre1Cpidbq8bz5Gb?= =?iso-8859-1?Q?HVATm0/Bt985c9fCPFXC1U3HBwmnY8MOyGCtTLVw0hQmqJ+AIs0J7/tuHv?= =?iso-8859-1?Q?s15kkWF2Iw+0ts4l1mqOr2clZf4+ypF1/l/5sXLGEWxzeQjn18jGw+/oal?= =?iso-8859-1?Q?6SpWacqfsUgFDtNidRn3DRS8PrH2hwxdkOTboUlvZtcVsVfrSQr2dh2QX/?= =?iso-8859-1?Q?rRPF1Wzb1t4leF7j6OuxhtfF7KkmcPRJS5j598h6leHHsgJ9AwV2qKsvgY?= =?iso-8859-1?Q?HzmlYYTAEGOONitopF0np6aQzJuWmbmuxeRYEYWJ11o33wExW719r86CL7?= =?iso-8859-1?Q?EHa9t59EfyYRrd5GekMlVB68c852+7mSNzoV0jnpDUQgTHKF6+8zmVU7G8?= =?iso-8859-1?Q?Pv1ZZVWvE80Ux+wnJ6oY6VqNumVZ3GHqy/2D8pA06/RI4hoJttE194DHet?= =?iso-8859-1?Q?S8LZf9IC/cypsPXA3cdn1gNo77JuHXjVJVOsdkPSh4Igi4Wp3FLDM078o2?= =?iso-8859-1?Q?M+Ox45Y3iexDcrcsLXGuW28F+4eRASU4Yj3alHe6Dnxr/gR/zrq0ZLe53f?= =?iso-8859-1?Q?ma8pZKYxrzXJSDYqHryQgkXD2NDtwphqHLL0F96lmrElcd00zBo3onkKrf?= =?iso-8859-1?Q?L4yZjRImpEvTnAPknX9hQnrBJjNvdJHd/5NpVhO78nPWS1gxXuAbjrl5Me?= =?iso-8859-1?Q?TFELBbN3bhVPbjT+jAdQBkVuxRaMa5TY2r/FAGvr8YZqHcNref/DM3JNDz?= =?iso-8859-1?Q?ivQi4ChePMiRpAJZBl7tdCMkyLj52FbnSsZ3gGS1RCcSiibAp1jIAKMlQK?= =?iso-8859-1?Q?YmzgQ4b9UQGyOhsN4yBkFO4UR0i+7o74zBFjoRN5dtlILShHQE5TD3yk+/?= =?iso-8859-1?Q?kTEJwgkNbNCqC87JM30+XphaWfTP3PUSQIq2RTH+YYP0EtBjuEy/ZGp5XB?= =?iso-8859-1?Q?OxHFqFmgbC77DJeAURQqK3cgD+dhyNZ9TkcTaaZuj1GgBBBAuBS1qmqsNR?= =?iso-8859-1?Q?UqbPhJgbdvgpv2bEvg6rmkLctECXDGzBJTJ0zSFZrscKgvOQjmJ2fYjeRI?= =?iso-8859-1?Q?wHy45IztD/6tyhbMThwi+QymtMEyRc6tu2ysGCSGZhNvOX0D12ehB+mJnk?= =?iso-8859-1?Q?IMCjvjycKNQtDXdLHORHbZxhKX13gyZBOE+XA5b37uHhplergfQZsmeg7o?= =?iso-8859-1?Q?0lSDL4C47pergh4bcJsTGEQ3HD330pyL0VEI3dCGHVIQ+VVnfU/tA/kZxz?= =?iso-8859-1?Q?KWOIhHkYE0ChvQnLZVZiY10X1BqLneRQp94a/N7kl0RWyytG43S+Ids8Hk?= =?iso-8859-1?Q?VKqJm2WN/T0JpshDj3+xfTwr4c1ZORoB1lct4mVbOrBKFXVwNmG3arKkBM?= =?iso-8859-1?Q?MTCwmc5xWk7zI6kpcMNb9zzRA3PDkXa2vg9hYT0ZyE3oXcQY96DeVMpMa8?= =?iso-8859-1?Q?3BHnSRmD7cR7SIj4VW6Bp1sO13NxMLIDInyVdK0KkF98F+bxFrqGxosivm?= =?iso-8859-1?Q?uixmvI1oIEDNfovHj221wmSOwzlRzg8=3D?= Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Exchange-RoutingPolicyChecked: YcjeGdOg2AziB9PWoxlcl6mVun8I/fdvNX9T+JOVNmbtGfy/F19NLKy+3PlPqPnqOvEWKiP94cuxWOeysnURDtYsrayiqk//o9tKVp2hLoEOvHLhmkpWnlhb91Xt0s9izPy/Jpb5RcaT+fU3N6MDcxbC7x6fM0rFmVZs0s80ynkrJC8J7BQEIbotNEN+u4/IElI4TmLVVm04JPGfc1nyDv7Qz/dLw8+6RJ5n54tLri8UzHuVCh0DpJefIFkPJIx7o1USm0xyYsB9vDFsUfzrZnjDhgkdMXDFN7fxD1u4FDpNSYh4BXzvsTuy88B7XQE3DBLokyBcmCLThLsmIduI0w== X-OriginatorOrg: nutanix.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: IA0PR02MB9462.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: c0e5ba22-b9a8-4195-3a10-08dee667038c X-MS-Exchange-CrossTenant-originalarrivaltime: 20 Jul 2026 13:58:44.8510 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: bb047546-786f-4de1-bd75-24e5b6f79043 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 6Y40cpE9INpFx3QgAEjJvWdYfH6Q/EkywqcIGeu2Uo6W16P6CzJhd9qSwuU0LZuGRJdkd7qElCaGdPvvT7l4jqy3hvMik4H4xIydVW25r+c= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH7PR02MB8883 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIwMDE1NSBTYWx0ZWRfX5wj/KICseHof 47CzBtX3doRZSw8Qchq+xmdV0DJQKZwhJOjVaSiaPkNCtnKXeGvcV8hoGEYDJgQld7CuygioSC2 0/OP4VzWGmnlQsa+bYoz1LhBeP9lZ5+2DG/UOu8cx0peiDAs6WftzkCl2y0zw1WiOi1WGdvDliY r1ZW52YA+IY80p+3B4Mi7DtCeZHQWeAexnn22lzIv/Va+egK56xkfB9nevLRYb9qpGSwE4qIuYB NDK//kWVz3Y/dhyx5/GsV+kBF/LQgpEmQRuAN26f+Lt4ADphPZnGM+0PViEHzOPkWdN6WuctbAO 0uFhUo5oC8jnSSeNbU/8a+qtLlWTgH10LtSUm4R1Pn1e3MGJ1oZFoh3aTbZi62oa9MVDZDDVs3A 5S/Ceb5rFRgvqHS6AKmbe57FQPJvubHqKHAV7HmdKpNxbtu9niQWdOeGLRnRkqybli6ZB0SDHXD t3urZaPyvLSZa2chLig== X-Proofpoint-ORIG-GUID: tVpPTvhxG6BrcwUkT-vGqUKxxU8z5mAG X-Proofpoint-GUID: tVpPTvhxG6BrcwUkT-vGqUKxxU8z5mAG X-Authority-Analysis: v=2.4 cv=ZJ3nX37b c=1 sm=1 tr=0 ts=6a5e2996 cx=c_pps a=DiLq/RQzOYCy0eeu/ZkwIA==:117 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=8nJEP1OIZ-IA:10 a=RAioF0-LDSMA:10 a=0kUYKlekyDsA:10 a=VkNPw1HP01LnGYTKEx00:22 a=VofLwUrZ8Iiv6rRUPXIb:22 a=VUi8bpU7OL1Oj2-RSIOF:22 a=p0WdMEafAAAA:8 a=64Cc0HZtAAAA:8 a=nq76yYeXid8ee0yPedAA:9 a=wPNLvfGTeEIA:10 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIwMDE1NSBTYWx0ZWRfX+Hu3MoP44gEs +8+1t4LKDPRKsCijjSycwnjATOth2cGcAU7vAXc9GBUlh3aMaezU32XUKDUeY7Rt2JN+tqOiz75 TIv6xU+eeoaeEYFctj/bkgAN6Nms5Z0= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-20_03,2026-07-20_02,2025-10-01_01 X-Proofpoint-Spam-Reason: safe Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.155.12; envelope-from=thanos.makatos@nutanix.com; helo=mx0b-002c1b01.pphosted.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @nutanix.com) X-ZM-MESSAGEID: 1784555991531158500 Content-Type: text/plain; charset="utf-8" The existing check for PCI capabilities misses the case where info->cap_offset =3D=3D info->argsz, which results in accessing unallocated memory. Fix the comparison. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3865 Signed-off-by: Thanos Makatos Reviewed-by: C=C3=A9dric Le Goater --- hw/vfio-user/device.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/vfio-user/device.c b/hw/vfio-user/device.c index 008e5cf687..67736383b8 100644 --- a/hw/vfio-user/device.c +++ b/hw/vfio-user/device.c @@ -214,7 +214,7 @@ static int vfio_user_device_io_get_region_info(VFIODevi= ce *vbasedev, =20 /* cap_offset in valid area */ if ((info->flags & VFIO_REGION_INFO_FLAG_CAPS) && - (info->cap_offset < sizeof(*info) || info->cap_offset > info->args= z)) { + (info->cap_offset < sizeof(*info) || info->cap_offset >=3D info->a= rgsz)) { return -EINVAL; } =20 --=20 2.34.1 From nobody Sat Jul 25 11:03:31 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass(p=none dis=none) header.from=nutanix.com ARC-Seal: i=2; a=rsa-sha256; t=1784556198; cv=pass; d=zohomail.com; s=zohoarc; b=Oovr6FUPJ/HA0zEYGGx5rz0p/i4s3/9FM8IHs1pdjjlA+373WAeWdpAdI112V/YFdCKFu+14EsXppZIrDcFJVvHK3v0nAubQi/Ocv3z8KeVp8R7vqnf4TuOZ+q0VIBBI2ZtOT6885dIwv5/TjPv9bNVpMsTGp9R5okoJSFgBTiM= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1784556198; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=JmfE5UZJCVSwDDDKWPb7G3NOCO82E0VcKdcGeenJHBE=; b=SzslFmLihlFqHv+B/nb+UKEIBVdwW5hoFv3m0CVYm0WcjCWgYhOWJs+520JZIGw4+g18SBvMpT7SS4zKo7rsYxmgR9yC/FHOtmYp6n/kgfyI6N0xx8mV8R0fJvdTnrH20ccEY7xI9BJKXykSrWeZT22hk1jtRp3yAshORcAMUms= ARC-Authentication-Results: i=2; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 178455619881125.783111701725147; Mon, 20 Jul 2026 07:03:18 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wloWW-00054F-G9; Mon, 20 Jul 2026 09:59:12 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wloWB-0004qm-2g for qemu-devel@nongnu.org; Mon, 20 Jul 2026 09:58:51 -0400 Received: from mx0b-002c1b01.pphosted.com ([148.163.155.12]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wloW9-0006aM-Gp for qemu-devel@nongnu.org; Mon, 20 Jul 2026 09:58:50 -0400 Received: from pps.filterd (m0127843.ppops.net [127.0.0.1]) by mx0b-002c1b01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66KDqBEJ608275; Mon, 20 Jul 2026 06:58:48 -0700 Received: from ph7pr06cu001.outbound.protection.outlook.com (mail-westus3azon11020090.outbound.protection.outlook.com [52.101.201.90]) by mx0b-002c1b01.pphosted.com (PPS) with ESMTPS id 4fg8fskdjc-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Mon, 20 Jul 2026 06:58:48 -0700 (PDT) Received: from IA0PR02MB9462.namprd02.prod.outlook.com (2603:10b6:208:406::6) by PH7PR02MB8883.namprd02.prod.outlook.com (2603:10b6:510:1fd::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.18; Mon, 20 Jul 2026 13:58:46 +0000 Received: from IA0PR02MB9462.namprd02.prod.outlook.com ([fe80::c493:aabb:b834:f53d]) by IA0PR02MB9462.namprd02.prod.outlook.com ([fe80::c493:aabb:b834:f53d%7]) with mapi id 15.21.0223.017; Mon, 20 Jul 2026 13:58:46 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s= proofpoint20171006; bh=JmfE5UZJCVSwDDDKWPb7G3NOCO82E0VcKdcGeenJH BE=; b=ZRQmhI0mRHxkDm9s7pgyHxxajFaoa/7FFPkkXv1NJIONjwbuMIDe03/m3 X0axDriXjeJGeXz3gnLb/d0bDX8VM7VC8VXpBMskP3w4KLC/1Brtbe0dyze/7yVi uB0QQSI3N3+S+sqSEnB62pQDY4WonLlR79jz7qkGxiIGO1ZpiWq28nNFX9KRoOB7 d6EtJ5JochkIx+AcMFUJb294eeizcsHnyvbpWl26AISzswgKOb1uSWdZ+GCIza7a 8jFo0IaQmLL9l6WT6evO1t+f9zbQOqsd+YZdukT9ONDi0kYKUIuXL4Pm3HaIXGDI Xtb4sNmZCS5f7bgBEO6bhKG4/IWHA== ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=AhxxpAUsZqWvq+12jPyigFK4RxzKWs1Uis0EPbNP0wExa25URwZpX3Cg0JB/kakhuWgNO324/RmpbaJiDcKQHc6fR+iNFX/QWzqY8j3LJZ1ZUt0KLHLsX/Fv0rtHPqTgWJLbvd73VjZuM8LwplZyqQox1PChxLSomN5RarlQvgPsZIDX0pbvmhSGFlXEE9CtjhEbsDcQadEEVg99LLNHJUyKtBvihYhJA1LspFjZigwePL7t5CXZx5rNLgLa1hPuYkN1vaWFpLAATEZWgY1MKLGw1J4z7j1GRxe0WnihB4JUtA/JrK4g942hujag1aYPP2zB6HUVggPQjdCb57BLZA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=JmfE5UZJCVSwDDDKWPb7G3NOCO82E0VcKdcGeenJHBE=; b=Xu/TTlDGufvrJQayJXaU7z2a8DxC7Wq71i37KFR3hEvys+tiJjQ711Q69+M5AcGNnSlI5Ew35imrZdDXREkF1HmBaiGVFCE9UbhgmFEsf+wI8iFZfbIyjxYFk+/xzI9JbfqtUzazS2SgzXHVMe1WbPoMB/rwBtRKHuLPY08wP/qR/aErabtz3KSixBADqqpy6X7NWjNOIt6fLlwfoS7hY9ErNbxDxZjNH/I5OHCibvOCclJNJEadO4IzOO5wXiHiV19ptg9HPTd8LkwC/Gzn9JvCkt25Tiz46dTgyCpMI5eH7fY/ZSUpge0E6DbONHV7MDK2RyaGstUwe6LELa+QHg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nutanix.com; dmarc=pass action=none header.from=nutanix.com; dkim=pass header.d=nutanix.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=JmfE5UZJCVSwDDDKWPb7G3NOCO82E0VcKdcGeenJHBE=; b=uTsVfetcSLnu1D6C+dls67oBrwulhm0d9DH/AE1ReF0TXTWlCeFCP32flPBIuz5SlHf5BEVbk+2NmzBvyk706eeLfrF7RdA9rKmvqa9j3lmhoZcqw2fLZFoJJUnQVAcnUg1L75iVZimNEyD0fZpnaOJJ3KgLVOdkSdd3BZz/PVH2Y1r7hHNJa1G4M0TJLG0wAalwJB2ZzZcM4m5k0pyPQI7TErt62E2C54PciKpeCE/6XksXi3mpNDmQrhrNG41ooOEJVDuIND4ovm+uzu5sHLnkzFEEhOIvDBsAG7Qtqi/iMIJb/8v0+ym8tlBUkKzHZhpnukJTNhUVYEVTiYCgQA== From: Thanos Makatos To: "qemu-devel@nongnu.org" CC: John Levon , "clg@redhat.com" , Thanos Makatos Subject: [PATCH v2 6/6] vfio-user: vfio_user_device_io_device_feature: prevent buffer overflow Thread-Topic: [PATCH v2 6/6] vfio-user: vfio_user_device_io_device_feature: prevent buffer overflow Thread-Index: AQHdGE/h3HueaJd1rkmtksu7R8aSjQ== Date: Mon, 20 Jul 2026 13:58:46 +0000 Message-ID: <20260720135823.21070-7-thanos.makatos@nutanix.com> References: <20260720091718.2642-1-thanos.makatos@nutanix.com> <20260720135823.21070-1-thanos.makatos@nutanix.com> In-Reply-To: <20260720135823.21070-1-thanos.makatos@nutanix.com> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-publictraffictype: Email x-ms-traffictypediagnostic: IA0PR02MB9462:EE_|PH7PR02MB8883:EE_ x-ms-office365-filtering-correlation-id: f17d8365-7188-4e6b-15cd-08dee667046e x-proofpoint-crosstenant: true x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; ARA:13230040|366016|23010399003|1800799024|376014|10067099003|56012099006|4143699003|18002099003|22082099003|38070700021; x-microsoft-antispam-message-info: 3Mx0qULsHa7vkhldCoQ54oS3k+JSkrEa7fJ2lOWeyGxO/C0x1W3XsVw26zIL7vl8kfwH1D6fGeJyMeip680WOEyxNWCSN67794vLB119bgJtq8JuZfkp3/NZ+ZiyzqO9w01EsG5SRuX0SCOKH2kig8q3SN7MZicg/4WALxwaT+x7MJbHnBkL/bcATq2uJT/c9GHzxgsavtGYODZFoumyU/VH17rB5p3lkXuDIYCK0VaqI/UUgzuEbxYQyDuJxebTUr4P1bZJiDINkF1bd2jYToDfeHji6C+LNghbKx++h9G45t9MduxvGLlEH6F8aEEa9Zt9ZH9f/NEshaW2RyOOi1SXL8owI3wK0v/0009sJdN3h0Ei3czowUvBrmtY1vCPBL1laSMzx5HzqpmwvKWT0qG+V3aj5PEYQSBSXgQII7g1C/I8YvvQwmUhakbe3bFth2G+Cdj/uyLkgItCvnD3DxVu39IZtvaGFcdODrzHUlYGO5RRFqh5Wmu5z6cW5TQdZ286S8bZccWrNJMuY7TbBSGh0oIeoZA6PWhNR/bx4tuuncGR1CpvansIhZKuvX0HXlnVaInKlxKrJ9FV+vhTUmpy8gkn9swCmKxAcmnhzXiB1ElFiRIa+9ZM9nEJMAgQeyg9YAgmnYGQTvwRkt+iadxZX0nXQe7prVV7kAqnKaURZx+onXqI/Y3G6zwjeQKAujE4lpitofNHSeg0MLCHs9Nyxh736nIpPLVAtB0OKsA= x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:IA0PR02MB9462.namprd02.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230040)(366016)(23010399003)(1800799024)(376014)(10067099003)(56012099006)(4143699003)(18002099003)(22082099003)(38070700021); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?iso-8859-1?Q?ZU3SPZZbkixe79a4gyQNjJDcbRgkGd02kk+1kQul4flnwMb47p8vHKylZl?= =?iso-8859-1?Q?M9/pbeQeWM/F4+NlYzF1230lQlqaP7pP4ABDZurh14WS+g1ZvWgHvujGZq?= =?iso-8859-1?Q?sgJKXyRZa+cLnGiBYKaOT8tCOl1HqEQSgoIEsoTiZA0Sy8C7rn4m7J2xE4?= =?iso-8859-1?Q?rdapm88zS57PwehEUsLQVxSTDoExMXgSguKdoam2zfI1M4Uw/R3GwMl136?= =?iso-8859-1?Q?pPcwXev2IbAFFgpupWYozlaJQ1PorynOHgJ9Xdib2TQmQGVGGHUIcogAo7?= =?iso-8859-1?Q?6eSJy4WA9XHssMbootIFukSenamJdmZYhbDH88NJUaQ33n9+HxCuoxOW1M?= =?iso-8859-1?Q?kY3cRvdX5+UY7CfZmQEsYfKnvP1GUQOENREa3VGnrMZc/v9s5zfNUz+Y6G?= =?iso-8859-1?Q?S6pAua8WQgpDQ3JH6DOQ2S/EGSbWWy3vNc7Y/y/jahHGMx5q6Z3/TODuu4?= =?iso-8859-1?Q?MRtesgINCrE/YCG9VAH5FKfTGyChtsOi9KRiBkOAB7F+uU+5ghBr4DfjEo?= =?iso-8859-1?Q?QI2cks2g5ZlaClhF6PhGCzK1iCmGLyXpTzhaf/YMcMZHWA5ejrprcaZquD?= =?iso-8859-1?Q?fqOPEm5eGaYxRjyfFa+PBwdEhEpf0mVSqwefAb/XbU9VPyezb72T8V81x2?= =?iso-8859-1?Q?lnk5RfYsxyW8AyA8tH1EXVEO+Re050W+A5D7sLYI5t5qouATmBr8jccNlQ?= =?iso-8859-1?Q?k30+0oAIz8H4RQzdo23vQgH1lTak44qEzOfn79I1gXG2veNsRq+02F8OMI?= =?iso-8859-1?Q?lNNiFpbAFbp2bcfOtH2J8lz24jfyXAkgbdA+USdrqjUlU+iOjTX9gmnbkN?= =?iso-8859-1?Q?S9coVtYGZB6ISyYHqWA8jTVg/kSliAacamfnOiUzLOgiaD+/Ksp5W7v5eT?= =?iso-8859-1?Q?srjlpz0p+MlaZNEShiT0jKfpKZjXoa6YNJcKeVqiiH4s7e0BiIQEzRDEn0?= =?iso-8859-1?Q?GzKZcWB7RnxDwm5K+7BF5OpfD2eg26OYbGe6MQgM/xvdKPKPSj96Gtt/t+?= =?iso-8859-1?Q?f3RNHu9JzcOCyVTsHW8xpk75J+djReZXQNiVL89CP7NgDd+EQcHa8BKQ+H?= =?iso-8859-1?Q?igK2fo2tH596c9hnlvtChHm8Rv8Ndwoo3t2IV67RuhgzgRk2J6Ly5CsoXT?= =?iso-8859-1?Q?zaPnf8xH/Pdp7L/WWL3jvO7kwkQXE2DPOgnWGO+LFyi3tny7Qekdlmyakx?= =?iso-8859-1?Q?AGlzgmSpkoTKe8SHNVUAZdxpkohtKNrtSj2LdDDc4dkpsGHkrS7Vra31Uu?= =?iso-8859-1?Q?m39pRzYnIlErSizAVzIGjyyTgBYsRmLVKkRLGEiDmi1jY3lIl/ASBZV2/N?= =?iso-8859-1?Q?oC6kd+ar6wxwZOSN5NcJgHQp1+kEvEHJsjI2X5zpt1g7TauH3BXD5YOhK7?= =?iso-8859-1?Q?eq4S6VwdIXnOCcGw1bcVc6eh+cwxzHFAyEfRHOXSOB9Ss28cSPL9Fun6Jz?= =?iso-8859-1?Q?gp28MEgy5QBcjOIFJ8KpqWmvJyd7Jj709UhLc9E30ZsnVyRjph2PvXqlhT?= =?iso-8859-1?Q?Xk8tizogXXBIqlvzGLIpXPPrXX5cQs++r5CSuBCrmtbbGj63TD02zcxdKV?= =?iso-8859-1?Q?LRjYf66a0WKFc1Kzd5gPz9v9WoOIiDdEbBt1aZ+OhXWJxxunLjKeQlTfdm?= =?iso-8859-1?Q?F6KqnTwcLYYKz0WIR5NWGJkEqoutGKBl4hxiQMOghm+VCCZPLXr7ANJesD?= =?iso-8859-1?Q?0CbgbwMG8axFFClwPXwNwcuwrB1UJJ4xDyY87bUU+RaC7eQq0XjD/zB6So?= =?iso-8859-1?Q?kHK4Q/axc37X4Jw/cng31pLZjfl2AeKDaBMBWmRPmmj5/Azen1kEGXkIOT?= =?iso-8859-1?Q?8ZPmQ3I7AlmDwWLQ8/dh+HU2nIo4hHE=3D?= Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Exchange-RoutingPolicyChecked: BGseFcMU5kDRuXXDsjHGBJjz+ukof6d0EXeFx7YZ0aXKr3oRyMJ3csJoDUOg8lISqQG7Y1GKrY+W/kVY8PZbsBMDUA1DDIXsjk98gfQe/eWmIwpX/AVD/sUS8NTCEW9m436s+sH40hSiX+HowiHgzCsaZYPTdkG4LWgnZab1+zrSoIqwlNwbgD+OeNy7gj28R0ZQKNol1Po3+Ix/m41RarXDf7g9buqVqw9jEjzUJvVuUr/xx+7lqi+Q7HKzcJfrBHaxBnNOvlqSC2vm50/Agi+/wppCRkmJMSrboPpVIA2W9WXHD0UDNdEbhBO2I/feMtEiqWL1dvkN+tJXcBT9cA== X-OriginatorOrg: nutanix.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: IA0PR02MB9462.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: f17d8365-7188-4e6b-15cd-08dee667046e X-MS-Exchange-CrossTenant-originalarrivaltime: 20 Jul 2026 13:58:46.2981 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: bb047546-786f-4de1-bd75-24e5b6f79043 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: OwpLBIdk2HZoL21qWjPzV+6p6cJIAqUEKHfuXX1xZeQrXPTEykyhVe9QJwsiQld3deC0XPNYj1KXOfZiylAvss6rMqziWmZAGYSO1TG0EMs= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH7PR02MB8883 X-Proofpoint-GUID: QREJbDdIGloKIhdYiN1cpCbeyckL8P00 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIwMDE1NSBTYWx0ZWRfX6VyE11Il5Vsq M9IoojG1XCggXe7uVMvvM4svMm08p1OBIoIR4/UiAhLAny6HC9iF0UpVtuoO25b4OS6yOUzCeUN LKydGBzbUKPnuiMkKaftT8gsQct0Ndw= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIwMDE1NSBTYWx0ZWRfX5p2iaj09FGu7 RrpdqRIh50JykOHNb5S/iveuOIdV8pJkSYKaueIuMq44k2G4Dmy3adMlclVa6N2HWUS5AzbBpzO dhhvZob3Faqw1JPMxKRI6JHQe3z2jzrJTmlvjEcCOG60pdpxjDP4jA4vGU3pmt0QzW4eXESuXGb Z54Hr8/hFyuxAKvvj7q9DR/faeW/U19XdliskRHD8U/m2kHdDzYFtaqEjyVjLK61FM1Qqb6R1hY KWNXGAvlLvd+1bbzFx6y0uiKZOKOy3gdA/SveRbf1qovPZuSSq0rhdQzAJy894IoPLC9/92gK0+ 4Lb31RDk4HjZmuIs4qElglV+W0dDzx7LUDGsK/zO18a6o85dIhdeweysJV0QCL7iS4qx34hIArT oFJAU/WVYzsZPrVsl+1LxJM/tRSRDp94yYaIrXdo8mFDmYKqyv0rN0gjfm8hmOMIL2/fycWxOOc kYE4cIXgbSge3OOP84g== X-Proofpoint-ORIG-GUID: QREJbDdIGloKIhdYiN1cpCbeyckL8P00 X-Authority-Analysis: v=2.4 cv=Ifm3n2qa c=1 sm=1 tr=0 ts=6a5e2998 cx=c_pps a=onnDVuI42kX/OVeLv55qNg==:117 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=8nJEP1OIZ-IA:10 a=RAioF0-LDSMA:10 a=0kUYKlekyDsA:10 a=VkNPw1HP01LnGYTKEx00:22 a=VofLwUrZ8Iiv6rRUPXIb:22 a=dEe9Ve2bX-KnNSUMM2s9:22 a=64Cc0HZtAAAA:8 a=aB6u2EZEa9mQxSzGBCIA:9 a=wPNLvfGTeEIA:10 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-20_03,2026-07-20_02,2025-10-01_01 X-Proofpoint-Spam-Reason: safe Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.155.12; envelope-from=thanos.makatos@nutanix.com; helo=mx0b-002c1b01.pphosted.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @nutanix.com) X-ZM-MESSAGEID: 1784556199334158500 Content-Type: text/plain; charset="utf-8" This isn't in practise a problem since feature->argsz is not externally provided, it's a good hardening step nonetheless. Signed-off-by: Thanos Makatos Reviewed-by: C=C3=A9dric Le Goater --- hw/vfio-user/device.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/hw/vfio-user/device.c b/hw/vfio-user/device.c index 67736383b8..131be7af61 100644 --- a/hw/vfio-user/device.c +++ b/hw/vfio-user/device.c @@ -79,9 +79,15 @@ vfio_user_device_io_device_feature(VFIODevice *vbasedev, struct vfio_device_feature *feature) { g_autofree VFIOUserDeviceFeature *msgp =3D NULL; - int size =3D sizeof(VFIOUserHdr) + feature->argsz; VFIOUserProxy *proxy =3D vbasedev->proxy; Error *local_err =3D NULL; + int size; + + if (__builtin_add_overflow(feature->argsz, sizeof(VFIOUserHdr), &size)= ) { + error_printf("vfio_user_device_io_device_feature argsz too large\n= "); + return -E2BIG; + } + =20 msgp =3D g_malloc0(size); =20 --=20 2.34.1