On 7/21/26 14:26, Thanos Makatos wrote:
> This patch series fixes some bugs where the vfio-user client doesn't
> properly validate information returned by the vfio-user server.
>
>
> Thanos Makatos (9):
> vfio-user: vfio_user_get_region_info: prevent buffer overflow
> vfio-user: vfio_user_get_region_info: respect max_xfer_size
> vfio-user: vfio_user_get_region_info: reject unreasonably short struct
> vfio-user: vfio_user_get_region_info: prevent excessive malloc
> vfio-user: vfio_user_device_io_get_region_info: fix capability check
> vfio-user: vfio_user_device_io_device_feature: prevent buffer overflow
> vfio-user: vfio_user_device_io_device_feature: prevent excessive
> malloc
> vfio-user: vfio_user_device_io_set_irqs: prevent buffer overflow
> vfio-user: vfio_user_device_io_set_irqs: prevent excessive malloc
>
> hw/vfio-user/device.c | 54 +++++++++++++++++++++++++++++++++++++++----
> 1 file changed, 50 insertions(+), 4 deletions(-)
>
> Changes since v1:
> - added 'Resolves:' in patches 1 and 5
> - added missing SOB from patch 1
> - removed reassignment in patch 1
> - added a new patch to address the same issue as in patch 1
>
> Changes since v2:
> - expanded cover letter
> - added 'Fixes' tags
> - improved check in patch 5
> - removed extraneous new line in patch 6
> - added patch 7 and 9 with same check as in patch 4
> - added patch 8 with same check as in patch 6
>
> Patches 1-5 address issues introduced by:
> 667866d66620 ("vfio-user: implement VFIO_USER_DEVICE_GET_REGION_INFO")
>
> Patches 6-7 address issues introduced by:
> e2358af5838d ("vfio-user: support VFIO_USER_DEVICE_FEATURE")
>
> Patch 8-9 addresses issues introduced by:
> ca1add1696 ("vfio-user: implement VFIO_USER_DEVICE_GET/SET_IRQ*")
>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Thanks,
C.