From nobody Sat Jul 25 09:37:54 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass(p=none dis=none) header.from=nutanix.com ARC-Seal: i=2; a=rsa-sha256; t=1784636891; cv=pass; d=zohomail.com; s=zohoarc; b=MOvzKGK0Imk7FxL8lIRgc53h2z4/Lx8c8YHGQ08wsrP9Qy6RNjvFfCSm7IHc/x+9abDPvVqVRBT8V1XRAeuWivJeyU2pzK8QIAnUHW++Uit6XQNoUjOqIbMUo61luLMeZHdjtJWFrc+0OQUJaNtZt115iw+sZuV+E7z0LapRC0E= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1784636891; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=UJa92i5BiHKdWyaLCcknMhJr1mn5dFoF/lrh2WBaz6s=; b=n2MCjx+EzJyG6wSbDL3p0vfE0ZQACXJ7wQojQ6hYv5dTALANbC+0Hb+KzbE24eBySHXG8/7IsWsdyqy5va2AET3gOF/OwnQXcRv1EtVDpJWyyttqBivVmwMAkPXsvBzQ/ISQytKSep8AQP9w830/t5l9KWGZ0wRqbFyUG0UO92g= ARC-Authentication-Results: i=2; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1784636891641651.492427569849; Tue, 21 Jul 2026 05:28:11 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wm9Yw-0008AE-Oc; Tue, 21 Jul 2026 08:27:06 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wm9Yq-00086r-Ro for qemu-devel@nongnu.org; Tue, 21 Jul 2026 08:27:01 -0400 Received: from mx0b-002c1b01.pphosted.com ([148.163.155.12]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wm9Ym-0004lb-Sg for qemu-devel@nongnu.org; Tue, 21 Jul 2026 08:26:59 -0400 Received: from pps.filterd (m0127844.ppops.net [127.0.0.1]) by mx0b-002c1b01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66LARrlC3214231; Tue, 21 Jul 2026 05:26:56 -0700 Received: from sa9pr02cu001.outbound.protection.outlook.com (mail-southcentralusazon11023093.outbound.protection.outlook.com [40.93.196.93]) by mx0b-002c1b01.pphosted.com (PPS) with ESMTPS id 4fg90xean5-3 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Tue, 21 Jul 2026 05:26:55 -0700 (PDT) Received: from IA0PR02MB9462.namprd02.prod.outlook.com (2603:10b6:208:406::6) by DS0PR02MB10249.namprd02.prod.outlook.com (2603:10b6:8:1a1::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.18; Tue, 21 Jul 2026 12:26:52 +0000 Received: from IA0PR02MB9462.namprd02.prod.outlook.com ([fe80::c493:aabb:b834:f53d]) by IA0PR02MB9462.namprd02.prod.outlook.com ([fe80::c493:aabb:b834:f53d%7]) with mapi id 15.21.0245.009; Tue, 21 Jul 2026 12:26:52 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s= proofpoint20171006; bh=UJa92i5BiHKdWyaLCcknMhJr1mn5dFoF/lrh2WBaz 6s=; b=L/QgDacc8nf7TcIRqswseMX4gR5I9PRy/Bs8Tyjz13V51VJacrO99rNUu e+Oy+GO/S7vJ+E3uSmjd8DfcYqbfsmP39IBN8HWm/8fGU9w7mV1A2Y0YmtPz1tqr hzpviWRQqDX2sd/RmrpvUPrq6MRSBzhJ1WMfTbPHMfOjzfPKJHghsTQFNbI43Qdh lUDczRGteiJcVHJns2dG8Z27gPFBX6D1CtOlBM2yBflQTx5H5CtmqmX2zzO4JcdS Ezxiuzp2QOQxr6I/1116ticcveJRvA71VtpO7Eid4hCy9miPn7pcWeB/QpMPWaNf +UvpMjKnesYdn4g/cfknfhEJmXqBw== ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=a2rmT6myEamlp8o9FDstnlJSwIIHn8H+Azjf3emyc/7rQVBBo5ofIrxv4DkBU//Dn0xTrcExjSu4iJyZmR53+WI2j6HLVUKCg7E/qQO0vg4Qtv2tX5lPmUjUnpNYkwYSHjzery5esNU2xjKJ6GYZoPpdnA1k9AX7aEV0bqo/EAtRq60MxNQH5LjQIcF22FuvN90RQ4ScQIo0js9c9aCMOWD2m9/7hGeufmfF9YdGPWO4h9S97uAHZl+4LAHPpL5Tn2UsgpfsWRF0W5r/Skq81cZP7rPzC4DznWe0rjMvAxzFgFWTofOR6h+Og7g24xWxkUzqhCd2XHg3grf+EcF0JQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=UJa92i5BiHKdWyaLCcknMhJr1mn5dFoF/lrh2WBaz6s=; b=pLui1v4HCfHq6iSRejPqTr2ZeU7ucj57F18lLzEeZTIe3dD3XgyAoNmwWu7MjJ3qs7wqzHnGTzj74SN5DiWxHA2H6Mg4PVEs/pff2KoE/rYneFl9kC2LLu8iYphFkpkYJ+CvZYLxlmtH29wodrFjArfCU0CG+n9QtbZSfmrh4T7nvF6GGPcYuwx2Fvc2B7Jd28s/h+rP+fJ48kupPkvaANENgzOEl2nNOhzMmfKfDhCk+QfnOMN9V8M33dPZPoP+XYXGuqJ3DvsVyZRQle0Z9piw22qX299G7mNVHPQZRVoKPVmiszru80liEu0O5cCAWCoqOuXJ5VBQApf9OL1WvQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nutanix.com; dmarc=pass action=none header.from=nutanix.com; dkim=pass header.d=nutanix.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=UJa92i5BiHKdWyaLCcknMhJr1mn5dFoF/lrh2WBaz6s=; b=VzL72sj7/DPhTiMFA5L0qXyeOLQVLsfVKh1RShAnTIPrKw8tlN5oV5PheOFoRZeFma5Lkq3xfwl+kLEP8fUzbGLuL6U0kN9nLw5Bx2D21sRLYq3C6uy4ijfd89PguOGyLJWJDfe2up05Qjok/QXRCKIdDFgDuWm8wDgB169loFguFOOpD1m4yy/OuNh9YWXjq8hJZlG+yjbjWxbGUy6c66JdCYhrWy/TpS7i0tslqkcoZJPUtFB7jbX0JGalJ/AvvOPShNNGukYHpSqhgfAIrQI9YUYRFx6BrvuISoNkr/RYzjAhWIuwRZ9LidWed7YAn+Xd4YFmgigf3cpsGxBKCQ== From: Thanos Makatos To: "qemu-devel@nongnu.org" CC: John Levon , "clg@redhat.com" , Thanos Makatos Subject: [PATCH v3 1/9] vfio-user: vfio_user_get_region_info: prevent buffer overflow Thread-Topic: [PATCH v3 1/9] vfio-user: vfio_user_get_region_info: prevent buffer overflow Thread-Index: AQHdGQw0LPZfbQUTR0OULgk3x75/Gg== Date: Tue, 21 Jul 2026 12:26:51 +0000 Message-ID: <20260721122643.30985-2-thanos.makatos@nutanix.com> References: <20260720135823.21070-1-thanos.makatos@nutanix.com> <20260721122643.30985-1-thanos.makatos@nutanix.com> In-Reply-To: <20260721122643.30985-1-thanos.makatos@nutanix.com> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-publictraffictype: Email x-ms-traffictypediagnostic: IA0PR02MB9462:EE_|DS0PR02MB10249:EE_ x-ms-office365-filtering-correlation-id: 41ab97f6-26cf-4c9e-ce90-08dee723580d x-proofpoint-crosstenant: true x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; ARA:13230040|376014|23010399003|366016|1800799024|38070700021|22082099003|18002099003|56012099006|4143699003|10067099003; x-microsoft-antispam-message-info: ODR8SwCLr6Hmg6C0liYGAciN9cPfa+HH4j2zWFyg3iEDGg74qYuoln+LWSvMNMqozFjBTbMjxAzWCq06EZ6QAPD+XGE1XOzK552ZEGENOgS/szAeNjk9v0fp9pJ/0oHDjjjhYA0xE7iEXkOwron0ENqLELbWJsWk4IzWZzI+XG4hMYkLkdJ8BKzcfkyHYdFpfafNra2pi4Xo0eS8J4lSs3BnlLzwv6uzd/7SrAlzZIwWd+WDFb/WTIUmFtecc8/AhfN90dqHUmeLuHimYaCn0PPETpbnhRd2sSovrMFyeLiMR+YQDg9VahW80e7IrdxOZZpy6BAnImNBx1eXetvsoOHmd9oci5KUzU9Fe0yNeUVPL2nOwnrPi1/Am7Y28AZCC8P7KMDh4n3zk9Wf4k8XYKxfM74cHYxwpecClT6NYsAtw/l6ouPCQW/QR4rmV6Ju4VbtqXyUxe676jCiIxeolVoPCmUhs2x1PkXoJylUoZxPYlC6gyOzdczAxHrbI/zXWVq7j6masVwQVgBKRiGZWcB9lm41lZDLE0mSxYQfXwXZQa7+V3cTmet2YfpQJUhc002l2NKXls5K6vP+XbIvArOalq5KZv+xb2qwqdTCndjqZcNnuzKduV3RjRcNko9kyApDEH0ugb55TzkArdvbmwG/55ISmb9IpMCddcQ5dqJV7hOknijngECvu3afoFCbkeTbBO3Ayx1to7UOmfVoCaMLEfe7L9tVVsdtf+Jj3Bc= x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:IA0PR02MB9462.namprd02.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230040)(376014)(23010399003)(366016)(1800799024)(38070700021)(22082099003)(18002099003)(56012099006)(4143699003)(10067099003); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?iso-8859-1?Q?cXOM9dxtrM62I8BzO/cSewGtlcb9t4DQppxLy+Nalidc0HlIanN8TTIyvK?= =?iso-8859-1?Q?bLHKtwc3pg4h/MQo0z3AECdKSVok5dFuNHpp2tG+cZnAAiix5VwhE2utI2?= =?iso-8859-1?Q?mdRuVb5H/pTKSdSqb/OE+Qd1rgD/G+TKWz1hcGdlQdupyel6gxR3KI8N5p?= =?iso-8859-1?Q?IFhZLRBU6Ao5H3rcvghnEQjywO6GTQJGyR0PIqhKLvjsJvuRtGW3HH+jQ3?= =?iso-8859-1?Q?/U/eWodYizK2spSCGw+7CSK5+kuvw/YvLUEQG1LTzp3QK5OL0n8n2+Qo7a?= =?iso-8859-1?Q?3EooI031aVqhXs52i3MO5cnMYEdYUv+ZWJi/yx9xyL07RuRR+vwKQcbMIR?= =?iso-8859-1?Q?7Ej38B3rO2UjkMxaEBaon1Ynmj3M3QkXiNZ7BWT/l5pkhwM16BCHMVE+x5?= =?iso-8859-1?Q?3/CpQqXy+5xqGDSwF1gb+VvunUTHlX2Y6eye6owfDe2fo2pa7pdUnF3PUT?= =?iso-8859-1?Q?dthYbkXJa6AXYnLNBqkyl0hurOqy4ox0/6DTeiwCAuJiFnwFQcj4gXgLQT?= =?iso-8859-1?Q?v9uqOFfJS/Hr8WlSGtIDCNMH+HjcuZeg7LO2y6/eFobuY1kBTKgQLbIwqA?= =?iso-8859-1?Q?wBz4OMx/JcuFOulJ0WzNnTkiKat5ByGH5EL8FDtzydE+3vl52gGztAZh5Q?= =?iso-8859-1?Q?qA2cg0wWTra2EPosJgg4/rvS3mMudS8RJadsjrWUpp9ZfpuEQU0SECweYM?= =?iso-8859-1?Q?NQoorzo7p1WogiAJkJVFgeQlOtP7v6tEfXQNMAeA85UFNVdBPR0zgib+0n?= =?iso-8859-1?Q?5nyOMH5KM4xPomXBJKNn7snzEXBtgftXXtyHe0jDb233I/22G4JXU/jc4g?= =?iso-8859-1?Q?DauJrKEpyULzL7HDEYX8KU9iQNUgSQZpVKGmIcTYn5Rd88o/OY1KM/U6H5?= =?iso-8859-1?Q?Vc6eCYFzeYoRhMcS0geNJfv6xKFzzLYpw5rs9I/JcRictIgbPByO1Usg9j?= =?iso-8859-1?Q?BitQsOlW7CE10U/fhs32aHnwHEDCRQawzOb3Ky/Bv4ZRbBEW9dVPZmEFjw?= =?iso-8859-1?Q?0SBIkf/WPYoIEP4T8DMChRmdCi8n81o3KFkthOz+Ut2p7SXZ54JFE/Jai7?= =?iso-8859-1?Q?Umr44d8yVT6O+tiF3fJ4AbiWJfMYzzg+alCCHx9bZ4lK3WhaZXGSCktI7u?= =?iso-8859-1?Q?E2OUpmtSHZ/Z0bSgyGdcHcf3I2yLJeL+U4ZC2lMduylew49wPUyXLropPI?= =?iso-8859-1?Q?UPDYo8H3Cg0wVnNFOckitJaE1Ns1Dl42El6yQ/Ur63XziCm9p9iGpb1uMl?= =?iso-8859-1?Q?PbdR9JFI5WEDqxN/222rnQ+dL6W7ZT5OOBnPkajklOJtB8JgON5J6cET04?= =?iso-8859-1?Q?ZTQPc56CUvsTbG1Sx6pfrQyg/tCgo0lj8P+Qd06bgc7+gGNplzpWh4AXJ2?= =?iso-8859-1?Q?PHmDTcaPMh+qlGTbNh6FtiARG59QWPkwynVCCMVHrgnT/S7kuJ9ojEBXgv?= =?iso-8859-1?Q?1tLh8xtzqYDoFeKcMq91rY1S6RXPGX85n43AJ791mhETfwoAPPAyIGZsxs?= =?iso-8859-1?Q?H89lZu2t4UUn+pAqkBdpUTVFCQY+YEFLVzMRTYRT9t4WMqTinyjOkAn+oT?= =?iso-8859-1?Q?BusD2F7c8sbNhfVhmkGNwnC/u32EQrxcOSDnTKd7VVjblZSXRGrWHLyIMH?= =?iso-8859-1?Q?wzxf0faT4FgEr1j46KgyeO9/mA5JEzgoHP8AOfRC1h+enpZeyt2LHkupZ0?= =?iso-8859-1?Q?KPr+yc1n2g9HSCk6+gH4pycpo9tO80qZ7sNRNVAULLvUmNUoy304baag6r?= =?iso-8859-1?Q?3EQuWpUskM6R4ydFMrHuCXa9UnwwiQErnG30iq59BgYEH/8fMQI7C47SNR?= =?iso-8859-1?Q?M7/qVG1KLHZghL0YPzxwonIvSkSiu9w=3D?= Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Exchange-RoutingPolicyChecked: Z3AyYqxfcAHmdOExVWERvfCRhe4TbbqTJWgTnCbEApfHQePshJGRE/+uQB4x2i+klKZXsgmLqiKzIilWIornFuwivfvtsasTcyyuC1ojII72pNKyo8jBe6fZ+YOVv+NprpM8vD6IdftfwR74xVaVtoXfOQE18JCrOl6+youcPOSiG19lbUW/+vpSjXJjQmTzVDwT17fXp/ulB9baoU1xosILH+dpJxVEgMn1i4gd1fR0VHrTyQ6hUgvnij+xqLM/wYFpwzO9Wgq9RSxkt9ayupQzhMqoGmpBpvpOqpKK0y5SUYQFI0Qy1An3dltoaGPX1OBbKmcoIXQ0DBAx2BNbIg== X-OriginatorOrg: nutanix.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: IA0PR02MB9462.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 41ab97f6-26cf-4c9e-ce90-08dee723580d X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Jul 2026 12:26:51.0647 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: bb047546-786f-4de1-bd75-24e5b6f79043 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: Kufe1WzTeuuIkRzuxlV+O+yz3sTuIt8wAWgtLd9QU2486D0lWv2DU7477kV1t90Klr5Zp/I9ehtqX8Sny19HD3tKX+Agz4LnEXQTXywIIl4= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS0PR02MB10249 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIxMDEzMiBTYWx0ZWRfX4uD6ckon9ljF lgBJ0/+fuzltPYmZDLBhP2l3VSHG40KqCzJ1GPPaLZWhOL/qRt16hIg1gCTDPn6W8wH+8qsH3iS b+6kR0mNFtnYC4xGfGPY1M3zjlI7r4M= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIxMDEzMiBTYWx0ZWRfX8ewrYY1KXaSa McpHV0TBgPdcIiK3aOux6+2b8l87P47sTGcf4SUYq/WKbzmFiu3uY5omXDkUvFc82jg/k72xn9l XKreL7RHOqEZlIfa5/pvK2MjfElv4ERz8QZr7p6c0MdOxuFiu9sPe3id3jEOLQEICIVXzIHaBDY Dkv9c81Ant6S1cH0qKybdGvtgVdM2kniw+KXWa8b8e6ZfZ4fbSn/dWL5DKdNYlDUQKKfimP8ZpP y/4f/YvEG8e/rGZO+eIK+VSbVwEz+gDzjHEtXLkDrhg9hdaiFROnRPpHdYQi/JXTHuuTMUxokvL +mctyGsyBIWXQPU2er0HCMdGI1PXTh3lIDY0/l3KNeBm4wIi9egeZfywddj9gL57xnZxuvH36SW Y0WrAzr5AzTXO0q5J8GKpjqXnWTRh28QK3vGNEIbNJAg2S0q/bzCu8iu69yhTTucCrb+myvy6if xekYNKA+s+/sXiUHKJQ== X-Proofpoint-ORIG-GUID: uSj3Vov1uK083kviAqMvaOVCsYZOlOId X-Proofpoint-GUID: uSj3Vov1uK083kviAqMvaOVCsYZOlOId X-Authority-Analysis: v=2.4 cv=CfY4Irrl c=1 sm=1 tr=0 ts=6a5f658f cx=c_pps a=0mOrEJ06uaCo+Tyi64Ng2Q==:117 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=8nJEP1OIZ-IA:10 a=RAioF0-LDSMA:10 a=0kUYKlekyDsA:10 a=VkNPw1HP01LnGYTKEx00:22 a=VofLwUrZ8Iiv6rRUPXIb:22 a=0LlEyIVc8U2lsR7dKhuH:22 a=p0WdMEafAAAA:8 a=64Cc0HZtAAAA:8 a=lJFH3X02AGBvrhoyKgEA:9 a=wPNLvfGTeEIA:10 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-21_01,2026-07-20_03,2025-10-01_01 X-Proofpoint-Spam-Reason: safe Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.155.12; envelope-from=thanos.makatos@nutanix.com; helo=mx0b-002c1b01.pphosted.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @nutanix.com) X-ZM-MESSAGEID: 1784636893855158500 Content-Type: text/plain; charset="utf-8" If the vfio-user responds with a value large enough such that adding the header size to it overflows, a smaller buffer would be inadvertently allocated, leading to buffer overflow. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3867 Fixes: 667866d66620 ("vfio-user: implement VFIO_USER_DEVICE_GET_REGION_INFO= ") Signed-off-by: Thanos Makatos Reviewed-by: C=C3=A9dric Le Goater --- hw/vfio-user/device.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/hw/vfio-user/device.c b/hw/vfio-user/device.c index b8d2b7c1a8..e58167a818 100644 --- a/hw/vfio-user/device.c +++ b/hw/vfio-user/device.c @@ -128,12 +128,21 @@ static int vfio_user_get_region_info(VFIOUserProxy *p= roxy, error_printf("vfio_user_get_region_info argsz too small\n"); return -E2BIG; } + + /* + * Ensure that size doesn't overflow, otherwise we'll allocate a much + * smaller buffer than we need. + */ + if (__builtin_add_overflow(info->argsz, sizeof(VFIOUserHdr), &size)) { + error_printf("vfio_user_get_region_info argsz too large\n"); + return -E2BIG; + } + if (fds !=3D NULL && fds->send_fds !=3D 0) { error_printf("vfio_user_get_region_info can't send FDs\n"); return -EINVAL; } =20 - size =3D info->argsz + sizeof(VFIOUserHdr); msgp =3D g_malloc0(size); =20 vfio_user_request_msg(&msgp->hdr, VFIO_USER_DEVICE_GET_REGION_INFO, --=20 2.34.1 From nobody Sat Jul 25 09:37:54 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass(p=none dis=none) header.from=nutanix.com ARC-Seal: i=2; a=rsa-sha256; t=1784636891; cv=pass; d=zohomail.com; s=zohoarc; b=RPIfeSCO+r5TgTqefpX1oOB+zaTT7SzAOFLSgdPNukv5qyS32Whiio0tKBPAzYI26aS10gWjFhIWzyxLN3Y2F7uiZL7mKdGejEb9Yoe8puPEwFpR2o1Rm5YZ+g0xyCW5DQwgQ7lX4lwBjRn7Sn473ZYuj35KtrrCFxuuQpKWEnE= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1784636891; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=A10H2/g52r6c30Xu7lLfyHmHLc11YD0fRAPYpUi+Q/Q=; b=meS+fJHiT14okbL/FoxafR/zJquCHKSXYaI6lK+Dgvp37mc8DrPwYdLVnHIdjzuDx/OrmpdDUsRYS8XxbMkGQXnTVevJXSmS9Mz8fpVdkQ9u3Aawh39IANoqxChti4URA84x1QUCE05wwPAOHozB9v8CDqdeYGqP+Oz4xBVBFGM= ARC-Authentication-Results: i=2; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1784636891103467.70058172976655; Tue, 21 Jul 2026 05:28:11 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wm9Ys-00087S-Hc; Tue, 21 Jul 2026 08:27:02 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wm9Yo-00086C-TQ for qemu-devel@nongnu.org; Tue, 21 Jul 2026 08:26:59 -0400 Received: from mx0b-002c1b01.pphosted.com ([148.163.155.12]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wm9Ym-0004lT-Se for qemu-devel@nongnu.org; Tue, 21 Jul 2026 08:26:58 -0400 Received: from pps.filterd (m0127844.ppops.net [127.0.0.1]) by mx0b-002c1b01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66LARrlA3214231; Tue, 21 Jul 2026 05:26:55 -0700 Received: from sa9pr02cu001.outbound.protection.outlook.com (mail-southcentralusazon11023093.outbound.protection.outlook.com [40.93.196.93]) by mx0b-002c1b01.pphosted.com (PPS) with ESMTPS id 4fg90xean5-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Tue, 21 Jul 2026 05:26:54 -0700 (PDT) Received: from IA0PR02MB9462.namprd02.prod.outlook.com (2603:10b6:208:406::6) by DS0PR02MB10249.namprd02.prod.outlook.com (2603:10b6:8:1a1::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.18; Tue, 21 Jul 2026 12:26:52 +0000 Received: from IA0PR02MB9462.namprd02.prod.outlook.com ([fe80::c493:aabb:b834:f53d]) by IA0PR02MB9462.namprd02.prod.outlook.com ([fe80::c493:aabb:b834:f53d%7]) with mapi id 15.21.0245.009; Tue, 21 Jul 2026 12:26:52 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s= proofpoint20171006; bh=A10H2/g52r6c30Xu7lLfyHmHLc11YD0fRAPYpUi+Q /Q=; b=IzPFQCxBO4q7sFNg58KVGmAuwLY0o3mXdnpa1b0pjpQIsrZ902J2w5dAa JHYtRS3wAqOCvMaxferxOwbdQoZ8Y7ewtiRx/XGH/nN5/nRQ75Lm0HDzLp492y7y bkozWE9TAlnlDiPl52NIA+P6SpABkTw6vNYWOQcZvcr9rBNKVae1oioZ3EY/BZG+ 4oxiPPFXGcriLb65UyZeIX/tbBEujDDsAxGoeuGqy0guwFrqW+dePUn/GKaihynD fx4QgGULb6wyi2VHD/KbWiSCvNKaJJ8waDRmGPk46L3g8pwBQlpR4xp6NFRK4r7M r5TxwOJMuUCUgWawMTbLLnCLFgzQQ== ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=s1BtyVQaF2xJCamypY7aZgsLBSHL4a2n61LLPnVFQEMQ4h69MaDvgWNGjcCXZRhe/OQdQ9KVg7jg9Fg8Vz4hyPCMpxzRWNlJB0RW4LHSv1ZEHZZtT1wNJBkKsr6RmTGFDrA5NuyYgsyRJ6KP3g4+VpZum7kfXV/nE1figpjAkl+lb4bIZ/ObBQo2D4qwPhJu7gU+TsDBx+QJOM90QP8wJssBQbUXOt7FiP+OSCvbdTXVXp9vgbKiasU8j9hrk9BGq6VIcrWMzqdCNTTnI0B4vMmgfYZgHb7PdNVNHGgOXOWlTgo+8QF6d0EsyqTI6tiguyUE+b/OYYxF96NGdemlkA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=A10H2/g52r6c30Xu7lLfyHmHLc11YD0fRAPYpUi+Q/Q=; b=Mh6UC/bOCndHn668BbCkjmfTKnJP6BFMQM3iTsx2eZFDkBXUKmbLGtDZmUb855dreRCwyBmx697krIzEVM0/G9bvo2AUu/iY9t2yamKfoc5BRhNXO7/IJViBq1rViBHRnh5gb048SNKAX/CYlWLs8unXz0OB4TanrXo+6q97OJLVziWT/45E312wnlqvcVr4nrWO07gXMfDuQUc7PpzG7oDEdtiK+dpbELO6kYer/cCO3QTVsLew7t5bMhOWxF9waMRdhtsix0kzQkcfDlsLbccvLrPDluHbrLdM09Ph56DJtPkJGu7KiQN+KBqC1AKcKkQ9JvMIg2RpKdwHtSiN6Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nutanix.com; dmarc=pass action=none header.from=nutanix.com; dkim=pass header.d=nutanix.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=A10H2/g52r6c30Xu7lLfyHmHLc11YD0fRAPYpUi+Q/Q=; b=tuGJX065TZxToY+9yP45kBhAfLn+qB1g0r83p5Ohx/g5Zy0GrnDv7z1D0nz9o1WtzPRH0X275tA6MCiqRzqfmhAE9F1VBKRPtWS4xBA6+3a529+Ihi5TzR7iZpxlUJlyeecIZtGbCvUh0mE/Z+pdQ9V2tp34rSofShemJdKW1EcVO82ijQUkRDvBWUg2ZyXhtRIAPKugXIcPpiLJ6PsL6m5QBV4J/dpA4O3MB2eiBgV7HLDmK1TqtsRthkKsn4N8v9tV0RvZjwCznDd6TvGFHqeZ2+uVNkzlM15NZi1A62/VpmDoJipOVBy3Cmqc49RsNQgeLpsVegUrRhxRlsZhCw== From: Thanos Makatos To: "qemu-devel@nongnu.org" CC: John Levon , "clg@redhat.com" , Thanos Makatos Subject: [PATCH v3 2/9] vfio-user: vfio_user_get_region_info: respect max_xfer_size Thread-Topic: [PATCH v3 2/9] vfio-user: vfio_user_get_region_info: respect max_xfer_size Thread-Index: AQHdGQw1GOZY1dJu+Eye/qKtJW2g5g== Date: Tue, 21 Jul 2026 12:26:52 +0000 Message-ID: <20260721122643.30985-3-thanos.makatos@nutanix.com> References: <20260720135823.21070-1-thanos.makatos@nutanix.com> <20260721122643.30985-1-thanos.makatos@nutanix.com> In-Reply-To: <20260721122643.30985-1-thanos.makatos@nutanix.com> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-publictraffictype: Email x-ms-traffictypediagnostic: IA0PR02MB9462:EE_|DS0PR02MB10249:EE_ x-ms-office365-filtering-correlation-id: a5f259fb-0dad-4b02-b69a-08dee7235859 x-proofpoint-crosstenant: true x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; ARA:13230040|376014|23010399003|366016|1800799024|38070700021|22082099003|18002099003|56012099006|4143699003|10067099003; x-microsoft-antispam-message-info: V1RFsckgo9StZvfLdH5HYs4kADrMP7aKBwSo1KJLjyfpF8c9BMOYyc5xkhYa7h8Mfotu4HFf04BR24JMCjnFimKdQj5MxelbT6F6ldxRPNyjk4sJ87H6e9CiSg6suqv93uwrp8o4mjZz65DmHpVUwCTCP/AALGOfErvktG754NIHEMOPGCvTFaWQAwVWU2vqNCKEUBqDaanz/6H8/q0I7YAOsoz7goO3hhXwXEIbLXgy38oY4ZjnfzQS2OELKRKg7UbflLnpkPpEQHGq0pWA/3mDcrm4aeAGtMaSayPaXRRVGzsOILiauy/BucC3J8o25dDxHGYt6Ap35eAjD5DWZTfRHMrWcSYnuEZyXWFaRbjmnU30VBb5WOMMhZcaHNfvDKVd+1OKXm3Gdhc2CrDdSIWiNQJyFqa7WWsoEsrpOlNfwr9G61YgK5di13dCIN5Gcx4eF1FKWeZJe/f1LvlQV1JfSQDZd+fshggIcka5dRRAVt24DKKNVZlaLHvHPIb286UQDVZrSEZksF0mflpfbiH+j/KjfKnowah/cexF+JESQUCxLD4wLezzzVkls6tRFT1TKkht/vkkS854fjyyQ43qIGdnUsqTcWWwMvqN0pUE49h7so9Hs0ufe9M/Q9Nyp4pr0GQP3/B3UEOdpmFN6kOwcoJ9So+P2tZtMy+SpEEivQjS6bgoCEl+1gRFYWyX/dzBDiEjfo+VRe5g2YMdKVQlRiY1UmsRqmgKH0gSJxo= x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:IA0PR02MB9462.namprd02.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230040)(376014)(23010399003)(366016)(1800799024)(38070700021)(22082099003)(18002099003)(56012099006)(4143699003)(10067099003); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?iso-8859-1?Q?AcyAqFW/7akJhQXF0tpDhjFLLtT5tn5A2vPIEbL/1u2LcxdZvPtdnKH9jW?= =?iso-8859-1?Q?4d/4hDrLDsQu25+tRpvd/MtMVUHTM1FyHzMZMgXlSONaQYDK5nka8vekSj?= =?iso-8859-1?Q?kDfnvEe2NHd6NBfPTskKnrkLhr/NyxI8VUaT8lBt6Z8aqqV9vJs4w+GzKS?= =?iso-8859-1?Q?i6mwF73HiUQwjBUayymGEanbJLIXxTvPJrrxGXeYIocfFEJSYI9wiCNnaR?= =?iso-8859-1?Q?jxlh5Lt9G4YuAy9W3EdBnBi4E0NTBz/ZcSyRn8UKDhGVNuMtrV6mPAYICi?= =?iso-8859-1?Q?TZRRDqXmkKABd2yB1YMOZkvGiXAITIEt8geYV6aqAN4FrHXN1uMpt8EL5P?= =?iso-8859-1?Q?pa/0eIPNjGkprVxFtZaFvHSO1TkWCtpCbhKKXFFg4RUfduP4oBX433wQ5V?= =?iso-8859-1?Q?N91VuWMOF3kfniY+28824QN8OMPV1g9bM7tri6SqCBHtpGzi2LjaTjdUqi?= =?iso-8859-1?Q?vxtOv2D+2SrcqazeyFgsHdoT+5S7MZUFg6PobW4/LgWbQnFmH6HRWvrcw6?= =?iso-8859-1?Q?Lhj0jPTk1E7r+ecRf4K0YguuRbzY1DRtU1ofV2y0ZWAvqGsV6FMedbSGDO?= =?iso-8859-1?Q?jBLG8frJbFW0Y3pnHtQm/+jLaBuab4RtmiVD7QctlHvhF4t65aAvEbeeJf?= =?iso-8859-1?Q?OBuoUFS7xDTbQhMqz9Krjy3oNPQSnlRwKbIJSckX2Pmqh7ssHy+HlGkIV1?= =?iso-8859-1?Q?XX76FPzq+TUOIpswpJJlFhWqWkKAW6o0+KYCV9MLTIWjNOelGU4K8GH9oZ?= =?iso-8859-1?Q?yUBN2H3vG9fDXtibyDjndoc6881fB+KzWGjeD/4BoBE3SQbCAMBuGrtAo1?= =?iso-8859-1?Q?066A1TAH5xxwux+JZmOb0bHinQpvDlRqkpFhlfII44fI2if8lEcGjz4jyy?= =?iso-8859-1?Q?TbKIaBzU9SxeSDvMEo70d0WPWF6n73P9Qe/f2B86wNxbJbCW8zo9gefzBs?= =?iso-8859-1?Q?934h423TTBdV9bLEXz0qHDAirLndaa/HqmeYqBSbZXfu4nXpMXNwjiSxtp?= =?iso-8859-1?Q?mSpqvYuwHOYCdH8TewjusCkXbrGhRvLMq4uaaqygyIPZfaaj7ipPPneJuB?= =?iso-8859-1?Q?CS6XfLoziGb1+zz6uvePXY0KZaDrkJrTskZNVIR2TB8biohTnFjTTQm8gF?= =?iso-8859-1?Q?pAlAw8Dma9MhLx7PFjtqBp6tUD8IspNHVsf1pSrB+OPHLbhARS3UbwEElE?= =?iso-8859-1?Q?3HRBYF5w8XQY3FEJnnAEExtkTFgzK2AVe62H1gg12qPEFvZfIi6i1m40ME?= =?iso-8859-1?Q?nREMk37SBS92bOwGe4fDswVy+B7wjh8GtPRZfvAMg2WwuWJLAi9CE+MZAr?= =?iso-8859-1?Q?vqRQwZq4UlfWKB7Vh8L2VVTXbV9i5QZNPvurovV+SrN9rj4MFBbMT9gkQg?= =?iso-8859-1?Q?K6SyAChK73/q3WuId9PrNtwdn4eaOe1eT/BTvROHTrVRlceHLuxL8DVnzD?= =?iso-8859-1?Q?lTHjRkMIrOocBRCyoQspiMlKw3IDBtaP/bpqfKWMEXr7v5tMJTT6tADuYq?= =?iso-8859-1?Q?agaF+7aB8TR/5OVfSQFqEujtpGii1A+zEms8O5AzXv5l+o5RYlo31TaxPl?= =?iso-8859-1?Q?X495uyNj8cKmzEdfHQkHrprT3dQ159I00U52zh2Gc2gXsp04eDzsVesSSU?= =?iso-8859-1?Q?+ylVv7YGXa2gMk/g0cIEE+PJLoHD8vlLyu/6g16jPyRqhrVO/xZiDCs/sj?= =?iso-8859-1?Q?D1+NVMrsxHK1rrqhHhFjV5sAPjuB6vGLwFSJoh7mxeXnZlp3LL35DDPBt2?= =?iso-8859-1?Q?68CcUrSfH8zbYxgl6mvcIQER7miUT6UTaBh+JTAN2db5PQZTlSMTAcpqZN?= =?iso-8859-1?Q?e/GZDMek5fgQAfWCZ0ozlGtGShdB0w0=3D?= Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Exchange-RoutingPolicyChecked: na3wKP9EgYiV/KLeO2iZmAm4jBoTiYLQofr/30UjZoGcyUYQkem+uKl7xzq3cxOyfEcwN4uk9mmagxtSUXoHfmAkKfjVuIDkciJmSxcBWFQtuj/9Wv6jxtcNvc8IfWzLzmfKn0TppyFSF9J1PfZOIYb2hFAcrFjZBBiCSbj7rKzSM6EzFFLZfPMZQhuh59W+jjhjQiy0i65ZUnm/BdE3Sgls0nfdlWkr128+GY9Kf9MSIrq8cgXCbKR/84e7pIPWaGeVMk7WerStcGdGb0v6loW6wDb2sH2mX+jWhIGE9bSf0OrQ8xwWRKDKJHV61g3aRsRxMCbmkQrZkDt0R3Ud8g== X-OriginatorOrg: nutanix.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: IA0PR02MB9462.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: a5f259fb-0dad-4b02-b69a-08dee7235859 X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Jul 2026 12:26:52.5184 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: bb047546-786f-4de1-bd75-24e5b6f79043 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: bRG+s7eseh+IGhlL3ltxcjC+bhhqa82sktZJRZ8lQTbr5PRjgKSeG4fTZ5A53f1NuFBEhZedy140O+Qb0iva7P/jGD7fqHxWkRQ6jFOHa0c= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS0PR02MB10249 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIxMDEzMiBTYWx0ZWRfX6OYKuzsI0NiI qz596bjRRHjQpbjYVRosGeCXSN9Axk1nqQns0ZswXF9ewmjSU61AXIGlXc4qr9GYvLTmbydamWl kDDJmecDXhwIiFyMGA8HB1vuzoojqI0= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIxMDEzMiBTYWx0ZWRfXwn7V2vYfno3C ftLxaJRMLUx4OLJwaBYKc2v1ZlwZfyH76jyI0CpYTiIzojopQidgNYoJ2vFIiKoCeB3t2974ptl ngztIbytEbH58E5wgdPTNtTKc3pgcCctV3fOclT+NQL5rVhJPaoBA4oeoCN1fpNQV/HEvbCnzBG 90EiW1RllPindfdQCZBw0E9TOrxRkCo5Prox5mGFvCGBCbcL418d13x2PAhR7X2Rd2sOIgK4g3o EL+7zmpmInhCL22o9EIIO+dqiS0ad/CM1Eg4DxBkePNB/WlOCGEQbCATYunOoh8i2RrP5UHmoBX 3tpBceiDmql3AqHCEvDhKXiX2xT1ZxXtkEU+ddzz3f+9wWjOs61jiP9rFz+/iAHu3xr3q539f32 oVoK39+8OJjsXZlgIIfjwaWmMLn2ex/ZkXKYrJXi/tArhaHxGc4sDli8eyAxIGgfCQ4d0SwXsNV WCJpEnos9lKlRa+i26A== X-Proofpoint-ORIG-GUID: CAXN83KDQrXtRIdo3gh6rTPLqa7-4z8x X-Proofpoint-GUID: CAXN83KDQrXtRIdo3gh6rTPLqa7-4z8x X-Authority-Analysis: v=2.4 cv=CfY4Irrl c=1 sm=1 tr=0 ts=6a5f658e cx=c_pps a=0mOrEJ06uaCo+Tyi64Ng2Q==:117 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=8nJEP1OIZ-IA:10 a=RAioF0-LDSMA:10 a=0kUYKlekyDsA:10 a=VkNPw1HP01LnGYTKEx00:22 a=VofLwUrZ8Iiv6rRUPXIb:22 a=0LlEyIVc8U2lsR7dKhuH:22 a=64Cc0HZtAAAA:8 a=kwlPqA7JoD2zeNbm8cgA:9 a=wPNLvfGTeEIA:10 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-21_01,2026-07-20_03,2025-10-01_01 X-Proofpoint-Spam-Reason: safe Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.155.12; envelope-from=thanos.makatos@nutanix.com; helo=mx0b-002c1b01.pphosted.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @nutanix.com) X-ZM-MESSAGEID: 1784636891966158500 Content-Type: text/plain; charset="utf-8" Fixes: 667866d66620 ("vfio-user: implement VFIO_USER_DEVICE_GET_REGION_INFO= ") Signed-off-by: Thanos Makatos Reviewed-by: C=C3=A9dric Le Goater --- hw/vfio-user/device.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/hw/vfio-user/device.c b/hw/vfio-user/device.c index e58167a818..8350bb2c01 100644 --- a/hw/vfio-user/device.c +++ b/hw/vfio-user/device.c @@ -137,6 +137,10 @@ static int vfio_user_get_region_info(VFIOUserProxy *pr= oxy, error_printf("vfio_user_get_region_info argsz too large\n"); return -E2BIG; } + if (size > proxy->max_xfer_size) { + error_printf("vfio_user_get_region_info argsz too large\n"); + return -E2BIG; + } =20 if (fds !=3D NULL && fds->send_fds !=3D 0) { error_printf("vfio_user_get_region_info can't send FDs\n"); --=20 2.34.1 From nobody Sat Jul 25 09:37:54 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass(p=none dis=none) header.from=nutanix.com ARC-Seal: i=2; a=rsa-sha256; t=1784636865; cv=pass; d=zohomail.com; s=zohoarc; b=b0ImvYgMuRzJ3cNwvlDaTaR0vyENu5pe8phC6SQw0yAZUd9LrmvT7Cc1PSxv2lBdc/6y6LjpAYinNd+B9lOEtxFpJEYGixfy24CRlMUN9Gzy/rsGogBXT74s6Jnik8Nf+ARpcGZ1NlrPKbCrZ5seJ0+RN5gbhxuWaOyva9e//ws= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1784636865; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=YQIw8bdie+F7u9LF/7zfZRO4qi+hJBGEYyE6aq78j/g=; b=mLfUP2SzueP8UJT4LTeYpAn4R2Ih1D4xidpbaROzF4E4I4AQxV2vfNOhe7i7ycvGoVbv7jb3z6BeVjB9PEb9cGxTc7dv9c8p1JDqY9yx26cUjGGsC78LsioHLos2DoJuk2Uhp55ZprfWK9g4wBbDVGuKLc735tcWaqcGP9IH4t4= ARC-Authentication-Results: i=2; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1784636865071819.3692930908676; Tue, 21 Jul 2026 05:27:45 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wm9Yv-00089J-5O; Tue, 21 Jul 2026 08:27:05 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wm9Yq-00086i-KI for qemu-devel@nongnu.org; Tue, 21 Jul 2026 08:27:00 -0400 Received: from mx0b-002c1b01.pphosted.com ([148.163.155.12]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wm9Yn-0004lf-81 for qemu-devel@nongnu.org; Tue, 21 Jul 2026 08:26:59 -0400 Received: from pps.filterd (m0127844.ppops.net [127.0.0.1]) by mx0b-002c1b01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66LARrlD3214231; Tue, 21 Jul 2026 05:26:56 -0700 Received: from sa9pr02cu001.outbound.protection.outlook.com (mail-southcentralusazon11023093.outbound.protection.outlook.com [40.93.196.93]) by mx0b-002c1b01.pphosted.com (PPS) with ESMTPS id 4fg90xean5-4 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Tue, 21 Jul 2026 05:26:56 -0700 (PDT) Received: from IA0PR02MB9462.namprd02.prod.outlook.com (2603:10b6:208:406::6) by DS0PR02MB10249.namprd02.prod.outlook.com (2603:10b6:8:1a1::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.18; Tue, 21 Jul 2026 12:26:53 +0000 Received: from IA0PR02MB9462.namprd02.prod.outlook.com ([fe80::c493:aabb:b834:f53d]) by IA0PR02MB9462.namprd02.prod.outlook.com ([fe80::c493:aabb:b834:f53d%7]) with mapi id 15.21.0245.009; Tue, 21 Jul 2026 12:26:53 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s= proofpoint20171006; bh=YQIw8bdie+F7u9LF/7zfZRO4qi+hJBGEYyE6aq78j /g=; b=h40b+QmyqOm+76myitEFo/zWy2FID/CgR7nt/DR0N5a9/IaaPEnhbkapr HNjO9UWMaiRtD1YQ159ep0617dVS/dUvf9JgelWRvnI+UEg7mq3MO7M98AdR1BqM g5fgjqAm/P0rc/Czb2tRnouv+aRt/7ouGHE9Mub9XeR7LjGyYHN/1QzUb0UjTu1b hUsy9nXcZcWoiKv0NJ6uQ6mXc0gdF7/w2v4OWbnIQSKDtjlwhX5Cr8r01MjVE8KP wFFUP2auyUW9vW77ih2aREIhPc24Zf9nYXln6E8MpHAvzLo9tHxXNQ9vJqR8n1x1 7xU8tDaQ6guN5lJ6wByHLYBzSTfXw== ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=FArIfyNELe/pnsTYhByCiJf016/6FycEVRzGh+RnV4/7PsZZOj3W9uM9sr0w7RoqWdo6nRwnrEgit791H/u4bpsf6UaZ4DVTAhYu3rRZIoPWW4WVwG0aLNrppt0W/uB+2CWYIYdtEI45THsTKkwcTqVA63GYq+kTmcIjq0I/jGmrNlatqh2lSYmer3NYfuvcS+Kfr1x1F4spYYuryxYt1ALTKfmF+TbDnc7/W5WoqFGgf8rjcgflenLH3p5x0OukdIZ+jK2HNYXkjlTL/JZ0F4l6tIe5MTrFTN8H3IEGggCfqK/VRVYN7eCwtPd321ASUhoeqUgmgxJ8AMKERHfIZA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=YQIw8bdie+F7u9LF/7zfZRO4qi+hJBGEYyE6aq78j/g=; b=s8g/0ma4vswhex41pqX0MmQcvljMQXPhCF9OfpMHcti0KyVeM9g41e6SBrF2CmRbNPTxdNu+V5bc/yjmt8ViQnrFL2oGOhKSFW4ti9zMWH5XPJpGtQm1DUZY+g1WVr2DMkKCyMpKupXzXyQX6M5+neo+lv92dQj63UvDoOW2ywygl7q0wVllitesvNsaKuQuiwISxZ28rtGGSx1RT6c+qQuBRYxzTmGwy4HySCZEZYv6jfBBkpgq03IeXYyJncMcZByIO5+LqsBz5FtxJEjDcPdAztd5uDR4BPaa8n0ErIbzIdn/wkMBef9woCnTqkbXb5lTXd4loLDa4jt1w4Ishg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nutanix.com; dmarc=pass action=none header.from=nutanix.com; dkim=pass header.d=nutanix.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=YQIw8bdie+F7u9LF/7zfZRO4qi+hJBGEYyE6aq78j/g=; b=BxnII7R8UgT6uegd8tMFGd83rEshqMNB8RWnF9mNvRF+nBT+yJwbe5yLP2P0OoLr9QC0zNPYyWG3xc8XQ2YpVqLizYctJu6EiXob9HJKgw29/bTNHUvGtX9vZLl6xCyQQaGxcHefnM6Xw/hphY2jJnlu36cF8SRTK2VaQLiMiHzmw4ssjC7h0M678i+486O6RinRmsZr2uKVl/XrJfJGPixEqRuWH0sPb9yQVt2/ilKBt8GsimHhJyQlzBU8cM7CY+5ncbnSymqPUBM/DKjJ75jE+Bfa1Cufy7VvoMMGjUgvZ24BxoMZ9burf7sMcK5G8ToXyzxJphC6z75S24SNiQ== From: Thanos Makatos To: "qemu-devel@nongnu.org" CC: John Levon , "clg@redhat.com" , Thanos Makatos Subject: [PATCH v3 3/9] vfio-user: vfio_user_get_region_info: reject unreasonably short struct Thread-Topic: [PATCH v3 3/9] vfio-user: vfio_user_get_region_info: reject unreasonably short struct Thread-Index: AQHdGQw2BmMLrXt/3kKJjqk6eLhKPg== Date: Tue, 21 Jul 2026 12:26:53 +0000 Message-ID: <20260721122643.30985-4-thanos.makatos@nutanix.com> References: <20260720135823.21070-1-thanos.makatos@nutanix.com> <20260721122643.30985-1-thanos.makatos@nutanix.com> In-Reply-To: <20260721122643.30985-1-thanos.makatos@nutanix.com> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-publictraffictype: Email x-ms-traffictypediagnostic: IA0PR02MB9462:EE_|DS0PR02MB10249:EE_ x-ms-office365-filtering-correlation-id: e03b82d0-36fd-422d-ce59-08dee723591a x-proofpoint-crosstenant: true x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; ARA:13230040|376014|23010399003|366016|1800799024|38070700021|22082099003|18002099003|56012099006|4143699003|10067099003; x-microsoft-antispam-message-info: lGNmneBQ96y/RmprXTXzuGEV4tlw3DEf20TBz9TXw6E9ss32A6Q7UP9TF45LtfdiWwV7FTtdoCmPO04X7fImmtkC7oNQTgn6784RurI/4f5+1mCFPyJVOsQquRSZEn8snj9ar2nEdP4oBdKTmG2kU294OIWrMs5sfMfxHvjbzz82A1loOOGTLd6Ln++z2MGWG4GoaUX24a71gu3V29xpqAGZkwHm+DkJflmTgz12vMly350T6wpiS4Phwp9ZzGy/58ujuhyO3uE9wJhd43yOx7Bycb0T3uSydtCZRW5zl6MbD9fhcnjvnSHeGNqNWoF34rFsAHChDChU4nzrf6kkFWrD4bY1JL5EBz7i7+OkZxxQPqo1IbAZW+KFzwbOz8ne5We8+6xMRS3+iXFckUfSK413z3vCJZMRAI8jx1B1VWcskqoF0pkzVdKo+stTD/F3OzNYgmfNr6redUn7uAufENS5HG32lWw9tjdB7YsPhdNsgDA29yBGO6GHzcPSg7mrdp1tuw++cPhzmD73BSWl/MsobA5rQ8fh9OPcojGGHoJeY8vt+AYwNN6SshJxrIiA3LmQquwVOzVe7zBCzeF+9zDHRJjroNPwnJ5+HcQLBFQ6oBhvxv2XY40SXsDEo3Tb1w3FMUIfbSjKv4i6R+uqIzPN1hbDg4Of1R9sLaGbtM9mT22pol4W0ULD/17LTUYkmSXUZ+pQ2i/nwlx7OeQiuw== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:IA0PR02MB9462.namprd02.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230040)(376014)(23010399003)(366016)(1800799024)(38070700021)(22082099003)(18002099003)(56012099006)(4143699003)(10067099003); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?iso-8859-1?Q?5+9JXFPCH/tK38MEQkAmu0Nr57I/AFtas6esPUMBB8MhPa+SnazSi3O107?= =?iso-8859-1?Q?iG+0nvrfIdRcqt/PPxKfmbcPzbzTlQMOJsmVNaXZn1eMUsoZJWGW61V1pD?= =?iso-8859-1?Q?Nbb+xmMNpYOqndDbRbEMWoubcsYXIWwtI3cuvNVZHXymdQXj6hqYNi1ui9?= =?iso-8859-1?Q?dgg7OaZmB/gbaQoxKrPlL7cWrYUfkNXRx6lgcLJIlkA+JckK57R/L6d+6O?= =?iso-8859-1?Q?I7E5PNaTzT2c96bdp7f4atSt2v7eQ8bmdKtX9XQfq4OEHTZLXdw5cE8nEt?= =?iso-8859-1?Q?1+MA11t5sC3OyvEExKSmvj8pgHcgpHk6MyPHnGggVTt9VrfntUIW507p5W?= =?iso-8859-1?Q?HGjk2knoUOk/YZ3LI8Pj41tA69HGIChPHXeZUSGyRgIaHLmne964493U7o?= =?iso-8859-1?Q?59CZ+dA4TMMEGtJWtJoBmii8UkBigizZJG05K8o9T9mneXobECXG3dlKqh?= =?iso-8859-1?Q?9sBXSUI6braJahAyzVwe2ymLbAJsKyH1jwPbt7W01zDXoATxRo2X/VpaxJ?= =?iso-8859-1?Q?wryKNfwABQfvIFiqUgErYvpp6wPC7+XII8XJL0S8nOExvcb0lg+rrfecT/?= =?iso-8859-1?Q?il66EWWMaFL0a6/CafltRs0/PDb4Nm9euXtim1dN2Q+V6PgBnC1BhgiEdW?= =?iso-8859-1?Q?G6bLTLaRRj/wwamguLMO+Uhwo9t/WOuC9hL8fDy1w+RnB/8A9zhfJl764u?= =?iso-8859-1?Q?++mB+JRIgFQbeSYQML8XBJVAaaEwyrC1AWC5mfDQk+PlS4Lun54yv6RsWV?= =?iso-8859-1?Q?LLFZxtX7FLYYDVv7yNGFB5XCBvnKTBXbxsmUoEwX9EjZVOb+te1GP+yruR?= =?iso-8859-1?Q?g+Jx8Htq0LXRrXVhSyHGgmz3CgYgejSgxNyanwQsUlNsH4NJwkBzjljZrS?= =?iso-8859-1?Q?dd2rI6DuaP+vk+v2ad16DSMAZ3x1f6jV0JYcQ7kLG/hg1Kdw5IEJ5AAeAR?= =?iso-8859-1?Q?k1vG3kpZeNIoBBPPm/Rs/3i0H+eIJbIpkuE4EKZSWoHoqQRIcp+lWoViK9?= =?iso-8859-1?Q?OhSd60AqwQnD0SdZ3aq3X/Fk08u8nm4rold0fTGw38yNiD1O/tTUsReRo9?= =?iso-8859-1?Q?gRMeCSFiSNu9s0L3bSHQEsyeMi3ZndaOjkM8hUPEC2E6FjpLi0tOFYEjae?= =?iso-8859-1?Q?EU8+fE90dNW2X8d7RPxiVsG+mxCLV1LoV4QuFuJaT0mvcEZrw+eba5ypgf?= =?iso-8859-1?Q?jkLk4vQ4mCrhhQxHl3ZC9R4RXT0amCOS/kHTamX25ANfcxXTzgfBVmrnIB?= =?iso-8859-1?Q?7a2+OLnVpPzbc08yKbbve+1vJV60IPomKig5QZw1Wo2WxwZRdWiGGuTLn6?= =?iso-8859-1?Q?LLrzqHtc3Jxi4+UX3tE3qvmkpOkQ9BoCas70kR9hslrXuoIwD9UKp+URNZ?= =?iso-8859-1?Q?jv99C7AYxOXHX03v4ahEotFTLyIFZPR6/LyYdX5tlGFl5TLnYaPfYb4mQZ?= =?iso-8859-1?Q?GunQ5XcaVSJaTywgsDXh7wYFRD6OY0elaZiklVmct96kng7n+nHKqgamgT?= =?iso-8859-1?Q?z5X427ZBVqomkmSki3hpTpf7mn4OhX4+S5rcU6nagGQhT8bDZA5MWeYQuX?= =?iso-8859-1?Q?IYvAv+xHtN50AqgkQsRsxXcL6C89HVE5gcLKO2wyHxfhvtTHyjL8RM8Pip?= =?iso-8859-1?Q?WwqwgO5tL7eArzYtj1X/Ip1iKjpb1CNySwaEl7H2kFUG8TJFyrJSEZo63R?= =?iso-8859-1?Q?pWWjATKC97ibk4vOKN91vIqyzJarJTKrIRaCgksSeRkhANqcwJfyjcfg7M?= =?iso-8859-1?Q?eNyisHDpzZJxoXNhBXW+tv+TzqXfCE7prbbx23LurtJw8PgrWbqRv2HC/i?= =?iso-8859-1?Q?uLf7rran8rtQYXR3xlVA7wZD3s4+y1Q=3D?= Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Exchange-RoutingPolicyChecked: mOiydqtdPzwdg0b2FZByTVOD+ov15gdr3lmRQ/AIYVFw0uwbPqEC77t4KocNNqE8+NQZsmfUwroonCJBC4GvOVNXNUOOa4FgvF8Eck1S78YyCBwQtbG3IhfWCKedfpF8fuOwAi5Za/fr8xloUDJK/bKb1YbKPi/xG0Lg48QW758fwg0pw6Nq9DiAuCOOFKs9mJixpRGFzQCvBYKr7RSrqLuMyTDo2g6zc5vUla2eXkLofryo6PvliPBFylDspa6MB28h3bfE99Yw8YzSpTCGXjX8q4fO8WDISwKfK4y6vNSJVdaQldZsAbUHg/bpa0lltz69WNj4p6Z4QVwi7FFLFw== X-OriginatorOrg: nutanix.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: IA0PR02MB9462.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: e03b82d0-36fd-422d-ce59-08dee723591a X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Jul 2026 12:26:53.7579 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: bb047546-786f-4de1-bd75-24e5b6f79043 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 8EGOGaGIwj+IDZ6GevbOybcyJWM/KCSrGAxsLyXbuIhal5OvkjhqlQ4ubDaf4YNg5lvcTIzRwdl6K9UmVt8tMYYE84TGedsHnKHFOI/AW8c= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS0PR02MB10249 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIxMDEzMiBTYWx0ZWRfX3vqBUo97ntpM N+kK9OR9vw2pp7H15480bU4noaYE92qIuzTZzS/w9hE6sIDkrN5PXoJe0VZN8GgmtuNG/BG3eF+ rhUNI1eV4Ejm9wOpcQOFuYvTtViiohk= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIxMDEzMiBTYWx0ZWRfX5W3rgXbuu0+l Wkt81g8bkFAzLRdDosywr0h4jrLUOqfxI7NFyfuNER242wZQzXW+pNt4v4y+9m1ZhmMBYuQjXZV zL1HkkrQlWaCwgB/eAg3Phibm15D/dTTJFXo7upf6k5/f63rALrmKd5hwWxNBmL5YbpBvZ9cG6W Mv1se0Lsl211IbMoUshEZuRhATfD/sDtkAPhK96yH5mYUZPiQ9i3dgbYxZbeyHRUL4DctJdi6M0 x1ndh6B7ZhCOBo++d4MMRO4RhEbctFD9qq61MIcpasqJT2DrN5FpSXFpguTOhIoZla8Vk2P4e1P N0/CWyExVrw1ZeHarnKiFbxTxA1hd4YP2g0xF7yol+vIGe+2KKtEwZjOZwG626B6nT6KsZ8ft0F WyzyL9sLFQIE65HAa1/OZE7blGqU2S2ns4RJ+q7mSKL6c2hFQmN4IxA4pdjlIOEkwv4TNLUZwWu VoYKCvBHIWS/A5jNB7Q== X-Proofpoint-ORIG-GUID: Wwj6-SWZFDoqxHYyvu7agkrTJ6OT9QL7 X-Proofpoint-GUID: Wwj6-SWZFDoqxHYyvu7agkrTJ6OT9QL7 X-Authority-Analysis: v=2.4 cv=CfY4Irrl c=1 sm=1 tr=0 ts=6a5f6590 cx=c_pps a=0mOrEJ06uaCo+Tyi64Ng2Q==:117 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=8nJEP1OIZ-IA:10 a=RAioF0-LDSMA:10 a=0kUYKlekyDsA:10 a=VkNPw1HP01LnGYTKEx00:22 a=VofLwUrZ8Iiv6rRUPXIb:22 a=0LlEyIVc8U2lsR7dKhuH:22 a=64Cc0HZtAAAA:8 a=kwlPqA7JoD2zeNbm8cgA:9 a=wPNLvfGTeEIA:10 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-21_01,2026-07-20_03,2025-10-01_01 X-Proofpoint-Spam-Reason: safe Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.155.12; envelope-from=thanos.makatos@nutanix.com; helo=mx0b-002c1b01.pphosted.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @nutanix.com) X-ZM-MESSAGEID: 1784636865734158500 Content-Type: text/plain; charset="utf-8" While this isn't technically a bug, it's highly unlikely that the server wouldn't be writing an entire struct. Fixes: 667866d66620 ("vfio-user: implement VFIO_USER_DEVICE_GET_REGION_INFO= ") Signed-off-by: Thanos Makatos Reviewed-by: C=C3=A9dric Le Goater --- hw/vfio-user/device.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/hw/vfio-user/device.c b/hw/vfio-user/device.c index 8350bb2c01..3d12e8b2a2 100644 --- a/hw/vfio-user/device.c +++ b/hw/vfio-user/device.c @@ -165,6 +165,11 @@ static int vfio_user_get_region_info(VFIOUserProxy *pr= oxy, } trace_vfio_user_get_region_info(msgp->index, msgp->flags, msgp->size); =20 + if (msgp->argsz < sizeof(*info)) { + error_printf("vfio_user_get_region_info reply argsz too small\n"); + return -EINVAL; + } + memcpy(info, &msgp->argsz, info->argsz); =20 /* --=20 2.34.1 From nobody Sat Jul 25 09:37:54 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass(p=none dis=none) header.from=nutanix.com ARC-Seal: i=2; a=rsa-sha256; t=1784636894; cv=pass; d=zohomail.com; s=zohoarc; b=KrWc5ZCpVLCFdmFwktTdS9YFTLydNwIsCDD/Ci6yeIEPBbsCMNfuADSfkJ8Hp9omWedKknEJEnQAvqliO9EW6q0yAtbZK+f/lY5XZ4Lb4qsFT13tNNtHHd03Um8ES3DQpecRvaDyBWratuUANhW93u2JTdyx83DcB9gRv/P7/Dg= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1784636894; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=hKRZx2MAIFi1tv4el2yhE1Y4l+uM5iZAVyFWHrf/K1U=; b=j+SYT2DhESaQjDIvZ1PBhGuNceikO+ESdFyT1GPOzMbURaEQczvUKY9keBdNEki13vNbbbHOlq1DJQGrppBttm8k2Jrl4lMNaG8JV9UuPT8EJp93NS9uNtTvdlzpmL0XT0vq0Rgikb5+h+1s7GQ0l5rBTw1PYbjlefBr0LoyGck= ARC-Authentication-Results: i=2; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1784636894954824.7077684568857; Tue, 21 Jul 2026 05:28:14 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wm9Yv-00089f-Ks; Tue, 21 Jul 2026 08:27:05 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wm9Yq-00086s-Up for qemu-devel@nongnu.org; Tue, 21 Jul 2026 08:27:01 -0400 Received: from mx0b-002c1b01.pphosted.com ([148.163.155.12]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wm9Yp-0004lx-8P for qemu-devel@nongnu.org; Tue, 21 Jul 2026 08:27:00 -0400 Received: from pps.filterd (m0127841.ppops.net [127.0.0.1]) by mx0b-002c1b01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66LARAUs3215317; Tue, 21 Jul 2026 05:26:58 -0700 Received: from cy7pr03cu001.outbound.protection.outlook.com (mail-westcentralusazon11020140.outbound.protection.outlook.com [40.93.198.140]) by mx0b-002c1b01.pphosted.com (PPS) with ESMTPS id 4fg8eeebs2-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Tue, 21 Jul 2026 05:26:58 -0700 (PDT) Received: from IA0PR02MB9462.namprd02.prod.outlook.com (2603:10b6:208:406::6) by DS0PR02MB10249.namprd02.prod.outlook.com (2603:10b6:8:1a1::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.18; Tue, 21 Jul 2026 12:26:55 +0000 Received: from IA0PR02MB9462.namprd02.prod.outlook.com ([fe80::c493:aabb:b834:f53d]) by IA0PR02MB9462.namprd02.prod.outlook.com ([fe80::c493:aabb:b834:f53d%7]) with mapi id 15.21.0245.009; Tue, 21 Jul 2026 12:26:55 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s= proofpoint20171006; bh=hKRZx2MAIFi1tv4el2yhE1Y4l+uM5iZAVyFWHrf/K 1U=; b=Z4K9TEsNjfDRvVYGo6zBMay1xrSKH1lbtjhhOQISBpY2g2A4BAT1T4RIv YBIjeFTbK7Qr8vSIpVJuf1mk3QLqFV9Pmx1tpTfwerUyt254HiRHSOBv+cOS7603 zGWqoavtJJ03LYYVHOVOytYKzNMwo6MUWKRe0orHYmU60PeDEp1pd+syjJAZ4nyg zOCH8K2d7H5yoq5rJWLOiDFIUArselH0RhOY1aaz99NT27meXdBZe4Uj5wR1HTk4 RNLQX00Zfei/6yjBnoV29cQ7o7xF9mWzey2nIMBTrimxiuYJtducO16Ef0kZfjPC b+wfq4kyGwr0n/0xlV+JlmD4Gfzqg== ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=DcsxynWG+mn1YmFniMWMIoIlC9Pr6k/ePGFzgZcsJ6lrJQY/75kgW/fDdfU1fLFg3c4+WnmrpHpmT4rtvRU15uJzbTgBQQFGByehJakqIGe95vsltsyd4M5835pDDUZBYQan6p6l87J/ixP9qdYY5NdubkiPeggmzThCdR82rltmZw8DP4QHC+XovT9SqHanf9Two4UoAex1EyUtQ3LKPKfVKQF46RJpO0+CnAX/iAmR/a3x4vES3TpZwfTcHGwseCzBgIFDEhMIgNRJ+Q1Xx83g84afUhPEP4PievHwQdAUj83MvPMMHrQLs4UpqtwudicAiEqtz5jGiCETIVd93A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=hKRZx2MAIFi1tv4el2yhE1Y4l+uM5iZAVyFWHrf/K1U=; b=sUyq0ervHeiyId/F6nA9hWiGIhQuqP1hXX5aPemoGR0eWDewzrNFHODslvIiikNEkr3x0RK+zvAxeOyvrXX4v9uaG19nI3Q7rnkvE4F2AaaSteR9OMo48K+n758+Trf5Icly4BV2COG6vzjep6rqgqNb94G5ADwhj5cIYb94jGVpUF3D0BXS6tJYlcEmoqr981GzDG4kYh/c/3Ri/jfhcw8F1/SgQSK5jlhayRl5mr/Z6YpPfaslkNSrkve+uLitz0Gi9lAbK4N3BPYESrJLkf0RSB0gNaJ6vB1VFCzKv3M6MFxxQ9aNY8LnQMSfDq1ndfPrbszF6zjDiJJcOHUngQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nutanix.com; dmarc=pass action=none header.from=nutanix.com; dkim=pass header.d=nutanix.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=hKRZx2MAIFi1tv4el2yhE1Y4l+uM5iZAVyFWHrf/K1U=; b=jkeLLQCL+tZE4aguDLwmKaZ3Xvwv6JvAd3+um0XwtklEq2omsOksiF0MaNURglnguBFOtW/+ac0lO1M9/qBpOOhTfDLWfssQyXuZEKJuD5J6yuIuplWdAORspexuEMzAXxfepJ5vIm4Cu1/yXvGIiRMI9+IvEkcieksb0Tv/O2iT4nDibbEmYrJVrqmQo2Ir0dNH/dAqiV3X6j05PmG340mpSf12N4SxiwkKIndPksW+upnM5Uhk+wQDWOWXlPdjVK4ADZmPKjGMP+dWWOR41b24xNZYSEFqzCM8l4XTJFcrz/cdpjYNTz0EKfcxkH0BOYsJoT/cbC2edpmsa+HK1w== From: Thanos Makatos To: "qemu-devel@nongnu.org" CC: John Levon , "clg@redhat.com" , Thanos Makatos Subject: [PATCH v3 4/9] vfio-user: vfio_user_get_region_info: prevent excessive malloc Thread-Topic: [PATCH v3 4/9] vfio-user: vfio_user_get_region_info: prevent excessive malloc Thread-Index: AQHdGQw37tRi5qNrdU+sulKs4rQGMQ== Date: Tue, 21 Jul 2026 12:26:55 +0000 Message-ID: <20260721122643.30985-5-thanos.makatos@nutanix.com> References: <20260720135823.21070-1-thanos.makatos@nutanix.com> <20260721122643.30985-1-thanos.makatos@nutanix.com> In-Reply-To: <20260721122643.30985-1-thanos.makatos@nutanix.com> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-publictraffictype: Email x-ms-traffictypediagnostic: IA0PR02MB9462:EE_|DS0PR02MB10249:EE_ x-ms-office365-filtering-correlation-id: cbc53356-898f-40a1-7e7f-08dee72359db x-proofpoint-crosstenant: true x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; ARA:13230040|376014|23010399003|366016|1800799024|38070700021|22082099003|18002099003|6133799003|56012099006|4143699003|10067099003; x-microsoft-antispam-message-info: bjikmcmfP5szq6GKPt+1wntjE/LLBHmPcrwDGd6jH/++QYT1KyC5SabupWZIoRcOH+mMJ9pBeHUbXTPOwI4FA3wEv87vk5fSrfHLmHCetj+Ov75tpplEFUQC0t8NL9B8xhQXtALX1TvampcytcGCVRjomKIX3jcqSdISlLFn12Rc7nTWHDio/eH2tkspWLbx3/cRxLRZaeV2y1dbo5vXudxVIHSYHPUGIPjLJ1okxTSy3UvdeipAFhXBRYXpuLBzck6iAxJqBDXlOoGD9oi8SFyCfbybKlnMPxG5dDjCP5roB8wStjK+aABeRbp/6J2/rwsitTkajZ/VH3OJUputNvvGUAS8XWYhzVobA1/svk5GsXTDNPm3sNBRAwtvfUjx3RY2SVRtl+CsJ0SzqECDKEUvsFQS2bQ4hMAb9v0aGCbz+rupyBxSaiJPjCA06TZ8BhIa0MuBer5sKWbE9kTUJbyPKkgM0Dl0UwqAVSf3C9Y0GG7qdL1mti34Y5nq6JE4bfKHnaT1ND9JVRAIGFpWgu733r/nkfSptJkOEV0+M7VVP+ylNFoH6T0Dp3HYHPOh6GRmaEiw/37EaMnc2moTnDPLyjnnsBfuvEWcrTsETVCOz1JIhrWdj7OnFPY/2G0DvS/9hw08l3BGxujJgpVu49qntL/RKdS3zqHwChTM7XaVnacHfg+kDGmaaOM8GbQ5y76SzDxjyiXLOwh4mKGjIg== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:IA0PR02MB9462.namprd02.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230040)(376014)(23010399003)(366016)(1800799024)(38070700021)(22082099003)(18002099003)(6133799003)(56012099006)(4143699003)(10067099003); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?iso-8859-1?Q?GWAf4FgQWElVEIUDYEHxkPR/m59KfhmUO/vALmbIJwd/sOORuixHZSXAq1?= =?iso-8859-1?Q?fzq/EkHrGmHQDGeV8aOL9po8WFlUkFkhG6TUyjuGks+otwlTjS81F5xDF+?= =?iso-8859-1?Q?O3B/kL8HLGnnNY3NvXxaIHFVGGhHjEaYWmAzyxGSg4fCeWfHkXCEHzEFqD?= =?iso-8859-1?Q?39AXetEsXBt80mjviUGt1jdU2zAcqQ0r3iy1HW9gm+x8RL4g0YU7TBIyi9?= =?iso-8859-1?Q?5yLbPKU0cX8hfLga216ZzyETZ+5ZzNDb2sCM+OEZ6Yrj6SQmaaLs9Xs7wO?= =?iso-8859-1?Q?P3RMV8FqtVzj0RkNUPavwdlQtH1D/IUJr+1xy9S3gpBl0IVVLFLldLsu3h?= =?iso-8859-1?Q?2trrZCjoFR1fIe/T96MgsK5BncKmAiehwp7LLw1C2JAKFwLYJ2bwVLAoel?= =?iso-8859-1?Q?f8qD6SzP6GmwFp9pm4W0XsfjmejoA49kWmeeyoCEgipgdfKNeOUPmgND6W?= =?iso-8859-1?Q?R0YsNkFIUhF5GcxJS72CwPhlO/GaN21HigIDHkiXeQcaRn3IoM+D4HtM+4?= =?iso-8859-1?Q?YCdfKj8H50/+xauSmbPi3Q17BnZKEIJH+mHjLZDLV9QUu4/ogxgf5mqbzY?= =?iso-8859-1?Q?bNKWQ8iKUZOjTlCDf1MDb6/I5qUH0QERxGGWUjMHrlCd9wbfaljlm+gURU?= =?iso-8859-1?Q?6x7DUiXRtrYToJGmBo40PFjmQGfJyS9gq1x5M3OTnn80sOJorF8kZ92TJ9?= =?iso-8859-1?Q?lrV0rvPXW/egA8jKPYeLwJr4SY3Sne7ZJa4SPmh3vBKU06lBftQrIQKeDy?= =?iso-8859-1?Q?9jXJ01pKoEQfVk191zC6s8uTR9WYouxIiPrhfu0XJj2MK64lmPGyUBbLDf?= =?iso-8859-1?Q?Lh2ZNrwS6cnm39N+0nZV3nq95zIB1/nBt5tGMJ2hzeVI3nY4SSpFpmsR9C?= =?iso-8859-1?Q?HUDT2juIDesDVZZlDcX440UQHZFO/0AUkZ8v89TFFbjau4cCQDwJZytm9M?= =?iso-8859-1?Q?x0zEzRxfbR30Mz3TI1caK6EhlncFxDeT8VR3vkdo6g3b7AFfi9/PTkbJUU?= =?iso-8859-1?Q?+/QD2qMNtvS0TKh9QWizKhbUHE31blqF6itrREPYQ32Ua1igfDtevXgv4c?= =?iso-8859-1?Q?tDL9W66MWzZ5iY9E13UU8Z0fh8zcf7GoBhwC6XlpUepMCIxxKhnY7FDClf?= =?iso-8859-1?Q?9vY2IV3UWLZB9JOQ0xIHrQkNxa9/tkLhM7X0X6Uwpp65yYYldyL/NEzaxa?= =?iso-8859-1?Q?07gkLNgtCXEQF+P1MV+RKms3aH9pxLAi92hEsWmYiwyNdhe322KlDU9LVs?= =?iso-8859-1?Q?eN6krSkIfejG0Eu7tnyLvf0Oll1vax+BHu5WfMBZQqfnkOHznBVyFu+NM4?= =?iso-8859-1?Q?eo0j09cHCqIR7YFENkqB4WTy5V8a0NWe1CeAI0woYVqqXrDeGpfDkGGyTt?= =?iso-8859-1?Q?EBfDRaSIyvxHMfJmOEhwiT5jT5u7w3zr9kxBV3dJHsaV6UHtptF+dvLpuf?= =?iso-8859-1?Q?+tT+77JZ0l/e5dBW3n0m+jPFcmcFgZFhsgp7n8+8U7AOUh5nglVyVll/IC?= =?iso-8859-1?Q?VetpqdbE/zRBVEePoztU78PCN8TK8MKLREZq8jRfU7Qe6fadnd4MNQ8hpW?= =?iso-8859-1?Q?qJf3KVFDrNCucwXPkzc5n+b23ZfHL3Ub2oKPw7VqjjS0BwJWP1OpCWNZeD?= =?iso-8859-1?Q?7MTqhDHN2eqoctMJ4yLN/Win2bmD9HKVALj9BnqkrsZ6ELEgnreFHFTqHf?= =?iso-8859-1?Q?1CXXhUqCjnKltImv5bV4EK/m+25soS9MqPIXBd/H7teLxfH3WwZq/2hjZI?= =?iso-8859-1?Q?jEa5m8lEsUcpxqa1GDplnT9OdNuRRzFTNd+GiZhwjO0QiPTBdPw558o8ki?= =?iso-8859-1?Q?EQMziJu2eou/dP52hjEKe0ziB7PCwrA=3D?= Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Exchange-RoutingPolicyChecked: aFgvWEtXIvLjAi3Z8X1hYpvc+Nw/h4cc0ouBJoW++qnIr2vNgu/3G+4psY/552ShPuQw67lah6a6mS600LJ+tb6l/hhPgQ2Ik9adlI45Xj91qFfxzTOeC0L4KbMF83PnT9lJv9GGjmbR3m9iQRF5k0EbY0kunsiMwTnTtVSMzyY3Nr5oRNqANIXmREWY2W9/YRXWLRJJDqZzporIBKH7LZb8wXA0VNpsZCa+5TWk3uzIfFHf+dBYUGOkHazNQfro1RhyDxCFU6wqvbaLrYcpPqz9iWaQ4oM/gduhYRVhKw2iu18lTAYqmloiRhoTgBG/ARtZLwrc8PMU/6iVnfO0Tw== X-OriginatorOrg: nutanix.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: IA0PR02MB9462.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: cbc53356-898f-40a1-7e7f-08dee72359db X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Jul 2026 12:26:55.0445 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: bb047546-786f-4de1-bd75-24e5b6f79043 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: FO3Kn0GNlvmZEh+0zDhdWFG5VlC5ra11MO08FqGd4JBC9kT+agvLyto9DQH4q+EpxHvY9tr0FvNa9IPxPCQbXwwpZsGO2Zvd0skjq38El4w= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS0PR02MB10249 X-Proofpoint-GUID: pklShFR4GjSeqJUtSyO6L5iJCENIvtY7 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIxMDEzMiBTYWx0ZWRfX0Y4VgY8D+z9i 9IOZmt3TFNdaWupKYKKOf8wtbU30zIblta6lPtDRGLI4gGg3as/QBybepICDQGoYCQfFRXHAUKe N2DgSFURIlFERr8BGeadHbePB2injJE= X-Proofpoint-ORIG-GUID: pklShFR4GjSeqJUtSyO6L5iJCENIvtY7 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIxMDEzMiBTYWx0ZWRfXz0l4tD6FIVEc ombuF39kZsxUs1tlvwlZ9Qt1LRPNUieaAWyE4qPx0Qe0yJSTDk6hGpnMXHcFidA9kPS3pJhzCpN RA4KQeegKyKGkKcnck9noDdiKukLDHsW4sBnC39CwC1DN1XOFjkX79HOaQ3CaAajsgT/5EoWLoG 6h4XAcqYUZIjOtRZTSfKPUb/m8ufnjZxNgTafBGd2yW5rok38MLkI+dbDe+dBKEcOAGf2B6LKsR cojYnbDmKNITYTDxEm2wTc4mG5DvQoQoGhFbv+dQXzYytqOvmpj1IlzXJqQF3tsQlMD24UaS8FO EIvzISvGkIKfH0dsR1XoZhs76tVeUjtEAGDP+sw5CnAwU0a/93l9OYhZ5SG4o3PtII3wMuvCHv9 OBT+Q/QObDh+BcmGgLdEfTE+4jjVXJ0fyshbYeeMY6p6BwNE5AF8pscKbClYq3P0WflhERfWsXO pAS9hU9QhgZcnm8PQow== X-Authority-Analysis: v=2.4 cv=Itgutr/g c=1 sm=1 tr=0 ts=6a5f6592 cx=c_pps a=PBbaNSpV8Z2umfVkjBDg/g==:117 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=8nJEP1OIZ-IA:10 a=RAioF0-LDSMA:10 a=0kUYKlekyDsA:10 a=VkNPw1HP01LnGYTKEx00:22 a=VofLwUrZ8Iiv6rRUPXIb:22 a=jxMXjlTPpCISP5mWtjnE:22 a=64Cc0HZtAAAA:8 a=lJFH3X02AGBvrhoyKgEA:9 a=wPNLvfGTeEIA:10 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-21_01,2026-07-20_03,2025-10-01_01 X-Proofpoint-Spam-Reason: safe Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.155.12; envelope-from=thanos.makatos@nutanix.com; helo=mx0b-002c1b01.pphosted.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @nutanix.com) X-ZM-MESSAGEID: 1784636895866158500 Content-Type: text/plain; charset="utf-8" If the vfio-user server responds with a value larger than max_xfer_size vfio_device_get_region_info() blindly uses it in the next loop in g_realloc. An value larger than max_xfer_size is anyway rejected by the check at the beginning of vfio_user_get_region_info(), however that only happens _after_ the g_realloc, and if that value is excessively large it can cause g_realloc to fail, so check it here. Fixes: 667866d66620 ("vfio-user: implement VFIO_USER_DEVICE_GET_REGION_INFO= ") Signed-off-by: Thanos Makatos Reviewed-by: C=C3=A9dric Le Goater --- hw/vfio-user/device.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/hw/vfio-user/device.c b/hw/vfio-user/device.c index 3d12e8b2a2..008e5cf687 100644 --- a/hw/vfio-user/device.c +++ b/hw/vfio-user/device.c @@ -170,6 +170,16 @@ static int vfio_user_get_region_info(VFIOUserProxy *pr= oxy, return -EINVAL; } =20 + /* + * The server can respond with a larger argsz in the reply to request a + * larger buffer on the next iteration via vfio_device_get_region_info= (). + * Reject values that would trigger an oversized realloc. + */ + if (msgp->argsz > proxy->max_xfer_size) { + error_printf("vfio_user_get_region_info reply argsz too large\n"); + return -E2BIG; + } + memcpy(info, &msgp->argsz, info->argsz); =20 /* --=20 2.34.1 From nobody Sat Jul 25 09:37:54 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass(p=none dis=none) header.from=nutanix.com ARC-Seal: i=2; a=rsa-sha256; t=1784636830; cv=pass; d=zohomail.com; s=zohoarc; b=i/U0xCC9CsvDvo7eEHyMs7ZI3ciN4ZHqSTN+/O1rpuV3zOOxHnjZB/AYszsqDINmM2EQ2po16uOMBE9CWrIOPG53pmPTDqmD90Dvq/sCnd+z005eoKF9Ju5YrG3SMbOj1dxcFtRc/kZHmRz+2WeukeB/dQ0ZP7p7B7bePvysVgA= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1784636830; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=SuI0hrYYG9I1gzQEMTlUIypL69M25bykqFjyWtc8R6g=; b=iVWv35W1z/7gdZNS1Fp1c9jgzI+a0k9RHeCUb7ycjnI8oMr14gVjeL8ZCRM5FCQHDvlFa8RkOV3JVujzwT0DLscBX0CA05A3OuQmHEa7xnG1kJjQzniiGJwGkmIN5oVbt7qi7iQwccijOvzuuYDcKcRs/yuOIk3LWS7mAQ1Rvgg= ARC-Authentication-Results: i=2; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1784636830533362.6790703317587; Tue, 21 Jul 2026 05:27:10 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wm9Yt-00088R-L1; Tue, 21 Jul 2026 08:27:03 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wm9Ys-00087a-Jg for qemu-devel@nongnu.org; Tue, 21 Jul 2026 08:27:02 -0400 Received: from mx0b-002c1b01.pphosted.com ([148.163.155.12]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wm9Yq-0004mA-BC for qemu-devel@nongnu.org; Tue, 21 Jul 2026 08:27:02 -0400 Received: from pps.filterd (m0127844.ppops.net [127.0.0.1]) by mx0b-002c1b01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66LARrEG3214189; Tue, 21 Jul 2026 05:26:59 -0700 Received: from cy7pr03cu001.outbound.protection.outlook.com (mail-westcentralusazon11020079.outbound.protection.outlook.com [40.93.198.79]) by mx0b-002c1b01.pphosted.com (PPS) with ESMTPS id 4fg90xeana-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Tue, 21 Jul 2026 05:26:59 -0700 (PDT) Received: from IA0PR02MB9462.namprd02.prod.outlook.com (2603:10b6:208:406::6) by DS0PR02MB10249.namprd02.prod.outlook.com (2603:10b6:8:1a1::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.18; Tue, 21 Jul 2026 12:26:57 +0000 Received: from IA0PR02MB9462.namprd02.prod.outlook.com ([fe80::c493:aabb:b834:f53d]) by IA0PR02MB9462.namprd02.prod.outlook.com ([fe80::c493:aabb:b834:f53d%7]) with mapi id 15.21.0245.009; Tue, 21 Jul 2026 12:26:57 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s= proofpoint20171006; bh=SuI0hrYYG9I1gzQEMTlUIypL69M25bykqFjyWtc8R 6g=; b=VKhrZYVU1hZLHsCZ3YdhlKxX6mcfpRKM9SKsIsWTEAjrkJAcRkLlNKuW0 LfJqS/MqWU9rQCzrLRAAwnCRfaxHp5gL0vsxfsu0kGhq865CjmfHbamwjPvT6h2y OcNigDZriI2bdg4+NROy2qbHTkRW5gCzqrNsrMvK97y+ISbXzZGW8PSjVXKn5a/3 CKn/shittlaQxml90J5lP8gfwASXPj0+ew3iD3fwcYUE4M5+7V6XolzP9H0ViiK5 svb//5XuVf6zBnG/utIRQs1CtESfIXrbctSAOqvnNb/q/S+vKkYqR0QHraKF1ql/ ByZcebS0GGI3tUUn+eTqdiB3r9NHw== ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=UncwHjxcRzPlLGEBHqv7eh2xEcnza8Ghdb9t4LuWJKumnTbAx/Nd/wJbr7SUgGfF7taThXVTqy8GlSw4u0MpKaAB/QpfYhwvEyX9F/KhANDVNhmZW20tyNl5t+R1/wIUMYDejtZ1uGqg2cBP4RJ21hmreAAEShwGVmGBFq9UYueizZjWloHJvRDb0fJLTSawNkEGaoPADBedHqRaRETZr4ANjRMiLaItlLmCYFLmTh56PtadeZRQZm1GAt0l8p0YqwYyiF0mgin/ukylLbVwQRmzD6fqa94mJdE5c3QnzrG9Gm6myTOGzrhTaxFMjkzEwwHei/mFrPJPhBya5AEuRg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=SuI0hrYYG9I1gzQEMTlUIypL69M25bykqFjyWtc8R6g=; b=JXaYqKH3PANVfwZ1FixeGKu9ugllFr0IxUn54Uwij31hihfYgJz0cG9F57lbFfhqPGbYGG0AGDqITX5hncgiLbu6+iH3si60lD1Q7+8yU8TToMnJlziFV4XyiOkq7c9693oojTVWgVyRk7zTL6nY+lpaV6+wisPNxQze/M8LhXADEzs40pbs83LtK0KPOlEI7ApaW2HuyKqAOycu58+Zi0ICnVo4Ts1MYyojELGu+HbAey1HqcbqGJ1CF0iQQcIWfl7yQzqgShQFLKNmlB3C/49hP9qIDciGW3WKtwfx0OmXGgWyoq/rS5VgJKzbFwAen8iONbKiGx4bC+lQUaiubg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nutanix.com; dmarc=pass action=none header.from=nutanix.com; dkim=pass header.d=nutanix.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=SuI0hrYYG9I1gzQEMTlUIypL69M25bykqFjyWtc8R6g=; b=uSRi5rbbJz1BabQgZs5H9WoOQfVAwxrOfq+xndV+DJl/XXooFgzH3FgdK38MLS6zBRy9unbeckYg6UC73lEUcU2mCU8wcgcMZDoWosZzNTkExCOBvuyc7mASb0iRBb7krbUSK41g5qLh2Va7XNd0FveJvtY8P11ChcQTf+zz2a9E9d19DLqawuloAh2GCDfZHiv3to4hSOYH0EFtzVaB+2Bi/c+HjhXMI2ri3ZbDP83a0FH/jKOTYxVdNiO3SviS16yisJTpk4Lw5N9WnNm75hQxWNI11lIVGWotvi/KbBK8MM++sIa8FiH7MP794yEgipd/MDDREwaPjGyChWG/5A== From: Thanos Makatos To: "qemu-devel@nongnu.org" CC: John Levon , "clg@redhat.com" , Thanos Makatos Subject: [PATCH v3 5/9] vfio-user: vfio_user_device_io_get_region_info: fix capability check Thread-Topic: [PATCH v3 5/9] vfio-user: vfio_user_device_io_get_region_info: fix capability check Thread-Index: AQHdGQw44wk/nalIyEO4gjaHm6OE+A== Date: Tue, 21 Jul 2026 12:26:56 +0000 Message-ID: <20260721122643.30985-6-thanos.makatos@nutanix.com> References: <20260720135823.21070-1-thanos.makatos@nutanix.com> <20260721122643.30985-1-thanos.makatos@nutanix.com> In-Reply-To: <20260721122643.30985-1-thanos.makatos@nutanix.com> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-publictraffictype: Email x-ms-traffictypediagnostic: IA0PR02MB9462:EE_|DS0PR02MB10249:EE_ x-ms-office365-filtering-correlation-id: 92ee9612-2b67-4c7b-e119-08dee7235b39 x-proofpoint-crosstenant: true x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; ARA:13230040|376014|23010399003|366016|1800799024|38070700021|22082099003|18002099003|6133799003|56012099006|4143699003|10067099003; x-microsoft-antispam-message-info: 9IS9PYHhzazOWDtnPkRQJDQ2nhm0iotOqaaWRN3/qjc6USTjhhR9/WPsEv7yvZYJyt11YjGIXmud2Gu3aeGKpt5/3ECvvrZ2tR3fmlBm2jnAsFB12X+LDLali1VareJ/z5njqVXLS121oX5izfP3tiV88c4p+ToWsGOY0EJxWTm9g67yNVGrJqAgtFi2O9kWwS11FwQ0Go60mQ1lc2via0FMGv1aSlIZoxkxt0hKVLiEd1zsZfy9zZlgfV48xA10FbqeTLIoAll/JTrgJB97BrGzl5I5akwt5Zp9gnj8BvnWtjY+cSELHZ6bi2T2HkjICQE99gg1lQyglz4XB3/8HBG8eTA/qNgHQy6IPSOOdD2aZMFMpL9sraJetOr8mas1hjir19PRCsbmTjPr+UM0z7DNLYbArTHVzbM7N6FJNa1Jl9egTmHAGurJQvEN0Dga2fzJyJQCOF4t9AKySTrJaFvBUxq62Uqa1+jiPGm147JVPjUx6MW0NlDnm9hg/gXJIn5vq1qRrpdCp8tXByA+bJgJ7vGXMGzur9Yjq+YokBuLQ3NU8JjCTtmy9P2eSp5qsBSMwNL4X2sVqojgDO7JDiY4iQvyWqvUsKyLTskI8IeK4lbF9xJYgIZS+Y6OVf3VJSgMRbpgryKbj5oJr7Nxk6nPD7ARKAobNUm9BvjEC4D131/SFQqK46G3FW+EwJyDIHYSAFJ28O037W8yKSCL/B5EO1xYuIemiyK3U7OAZOk= x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:IA0PR02MB9462.namprd02.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230040)(376014)(23010399003)(366016)(1800799024)(38070700021)(22082099003)(18002099003)(6133799003)(56012099006)(4143699003)(10067099003); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?iso-8859-1?Q?E+qAPtsKAgXYbI3UhPkWZq7wXX/IhPjaHd63EnRVSJvWCxgNgvcsp+jm7M?= =?iso-8859-1?Q?v7jrMlav6hJZI6ouB83ED9ySaBSU0tokGPttMGrTgen1q3eqTHE1ZwGoHR?= =?iso-8859-1?Q?gwJ90aBapN8dTbql2IdvC98EZiBpOpCmNGmxat1PMdD3jRR+nSd+F/6PBe?= =?iso-8859-1?Q?ns/70q4n9V7+WPn1REmFUFWupll3G286S99ofKNGuvojNuxai8d7KaC7Ul?= =?iso-8859-1?Q?nb28rt9AheVQazAoHyfrNXPLJYj0jA8XxxjknoBbhAXf3LCLMeABA6L6Ac?= =?iso-8859-1?Q?/4Nit7SmeRVV7ujw/9DWhRN9vMKPw2ovbb9geu+vRBoPiPHd9vV3ZfD0Ep?= =?iso-8859-1?Q?J+RDhzwK0MNTSDG3c1tByInS1ym6K2O/R32socr8wACrJE/vCf7Hs/92+E?= =?iso-8859-1?Q?YBnCJ8L7aNeQ6vUJwyPmsUnrL+B6e5IW8Y4/n5I7ePYdzlvNpWiN0a60n7?= =?iso-8859-1?Q?ucQg1NImgjNZMKphamyRfuIaj7uu/hSUajMsSUU+OkD6TTUSP7LBfPrrvQ?= =?iso-8859-1?Q?uXaAHfnLdPLcZ3tCu74wvnvLhyEiIG2hQA1yMf9Tv6LhDyauif5sq97fNN?= =?iso-8859-1?Q?kuFIxiczvfTYjVNF6VEZVyr7DAINktq95TWjeMhzWGh1r0+JUX7Rr99/2q?= =?iso-8859-1?Q?f4KJ9E702P/tNNarhDQz2iUeWkyW29p1LF1FAz3NhtHQQBYAsJRt/lu2ub?= =?iso-8859-1?Q?aT6jA+UmHay91i8WbIwX3MC5ivE0fV2dvqGsKEYkRB2KBbn4xlT9woGybZ?= =?iso-8859-1?Q?9Z7qOMgj2AmTffIF7SsnwqbfR2EgPU0yNn/iWWGCa5vQnnZcGKLY7+qNYf?= =?iso-8859-1?Q?nGfdSm8oRcNTLZa4qQZe2AetQiKFTX+/9vQAu2FzQy+WQ01mW5KnyeJbkl?= =?iso-8859-1?Q?n4VhoBozUTWsFEyNPU07Ja8pV/nX/AyiDFgNM8Nm7r7HXE6+6+pNL3jw9+?= =?iso-8859-1?Q?+IUPaWxcuVyuFdOEL+hOOy16jVlk4iLSGQBmSJvPcdk+5iBicnA190iwas?= =?iso-8859-1?Q?LngE/klaAhS0grYsoMpuYo9oydWovsxa/mJcm0BZsYRKqzna6uplNRzJqO?= =?iso-8859-1?Q?a0aXt96M9GfPN4RPe6XW/0NCCst06VEnvkyjQXnwWjfnHZwTGBcPozMNdq?= =?iso-8859-1?Q?7tG2tp9R70NNGUwf8/eJuoC0CEPVQ48XaNcumJeaYTJmgby+Rz831GRNp0?= =?iso-8859-1?Q?dvhpMSdNff4MsvqRDdnKd7nIQ5myGusX1ODb5L83vbauhvzZiXxbOnvZwV?= =?iso-8859-1?Q?0N39ysq6h0AclIdgVzNaRskdBRm2ve1PVXFZqG+GXsHiSUbWoyGPSVzLlo?= =?iso-8859-1?Q?oHXHcl57X8RzN1u22LYurjoTNpbSPeMCPet6AFzidVVIbS+KhtcsMlJ9aL?= =?iso-8859-1?Q?Vvk0Tay/vRyhPzYe8Fwbe3S4ri1dGlq6PweRwsU94kR/1kAEIpcETshms8?= =?iso-8859-1?Q?3eTRMNgCTf+WDZaf5gJdyKvMkwZnbJtlc5K3KvG/GI1PjglorfCw5BMuFs?= =?iso-8859-1?Q?eSfm5fYxpInIqtQgQ2Q7n4HOz5EYJ0fJhC77kVUdVQAx/zAO8fhcMn8PnT?= =?iso-8859-1?Q?CSOaDrCVQNAnx5FdUxlBtF1aresBc9dBLrjjn6LN4GWIuB+FOJ0Di18rpd?= =?iso-8859-1?Q?HAMzeXxr+YcXiG+2nu8Q6/uL8hVSPggfyfxdkGTpYoC/hQ5BmYW/UmIhBk?= =?iso-8859-1?Q?kJ1HKl5rlMM38NldEWJmzWlImR653IsIzXtST9eU+1bpqarhMzGI0pVmLz?= =?iso-8859-1?Q?wTIsCLQag0i0Jwr/DV1LBc9Fa07aujYfu5U3zA/ASGv/iCXAB6669E6WDq?= =?iso-8859-1?Q?xEGLFeu9tgcCTYZXMuSbVX8hYUfk178=3D?= Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Exchange-RoutingPolicyChecked: pOWLVLSShG3vJxv349q1cxiUzBAfxgW9rOgg7u1Zc5sQWpp8zrGwZ+uENAvJJ2yA1Q9EuJ9N4mHdacvDkmN7hEdEnh+9yA2ngENW4/sNcVTn7RPv4TjUkTBkPpR9NwKezIwLJWb8W/ocWgG8Ybf2DpFZEmc09b8mtEDHc59NbKblbdEQwetR/DBRhFLFnlgj+NKVXv/CM4OTNu/t1jhAKYtOHVrxTOKWCGFoy1dhOurVFIzaAj4tTw4JEdMG/oDHSe5yyIwmU4VdPtz/XBhEmTiri/bpBBnkjjVUwNB7elliPi7TwHnLw8GoIZuAihz7Uk/JCGXrPhi7K5tA4fTfxQ== X-OriginatorOrg: nutanix.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: IA0PR02MB9462.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 92ee9612-2b67-4c7b-e119-08dee7235b39 X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Jul 2026 12:26:56.7650 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: bb047546-786f-4de1-bd75-24e5b6f79043 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 6J4A+S7WCGNWAQqqktAoqmZ7rfoIXY4UHa33GHJZy4cYpHJpb87ggP+oQSN7r1/xLhmVC2LHXuLIitHulNtyIE4hGg9Z+NMsRESku1ixXiA= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS0PR02MB10249 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIxMDEzMiBTYWx0ZWRfX3YEpl38xZteJ kly7hrdZn+x6mgoz+zh12ivuozL3m+FMHn5BNX0w2BM00Oz7ZKnDT7ni49SzugfhQgBV3Z3E3f/ s0sTal2yFurIXYZT5DVneaX3JnEwskg= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIxMDEzMiBTYWx0ZWRfX3IP1HtRuek+p FA4kvHXPgZQokRjlkqKMp2Iq64HyXHRlH+HYoh9OC9bUJaO8mRNSlCi4fHbuUmps7ooDw3ka64V sE08M+xjYFUgePWnpzZd1Bp73opLybzfPpXh5YwMnb2FLYzUNpJK9A94DmAY4BEgw9VHztznt7W o4vtqw2uOjT8SRWdj571do4xF3SfEyvpTwKYAit9Zx9yZF6cwxddi6k+KQt7CdLMHYHK/qY/B8J lF8BaKV3Xg/wWYvbLzrsyODfmZafQi6+75NGl0N098Elw+UiBNrwMEuTGyA1bxOylUOeLNN9AvF 8Ut3SqImtVecFh4RPWbfXfmikqIXft+KejfNOorzQSNkuvGcVWtNbXRvVfKmGv5NK+DH6+XvT09 YRW5czdP7i0kOHAM4YLoWVX0rF9cNSCHOSZ7iWbCTKLlA8pey81ODt5HpUM4TVp6QiYTeq3ti2T 9Jf36poyUUjeTuqXO3Q== X-Proofpoint-ORIG-GUID: fP1mzPf5wbV0o-PA-HU9i_8c7LMNrKT6 X-Proofpoint-GUID: fP1mzPf5wbV0o-PA-HU9i_8c7LMNrKT6 X-Authority-Analysis: v=2.4 cv=CfY4Irrl c=1 sm=1 tr=0 ts=6a5f6593 cx=c_pps a=iFZJ8MWJ1PfqyJABywbvdg==:117 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=8nJEP1OIZ-IA:10 a=RAioF0-LDSMA:10 a=0kUYKlekyDsA:10 a=VkNPw1HP01LnGYTKEx00:22 a=VofLwUrZ8Iiv6rRUPXIb:22 a=0LlEyIVc8U2lsR7dKhuH:22 a=p0WdMEafAAAA:8 a=64Cc0HZtAAAA:8 a=omYdixH3HiAqfKGu9RAA:9 a=wPNLvfGTeEIA:10 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-21_01,2026-07-20_03,2025-10-01_01 X-Proofpoint-Spam-Reason: safe Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.155.12; envelope-from=thanos.makatos@nutanix.com; helo=mx0b-002c1b01.pphosted.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @nutanix.com) X-ZM-MESSAGEID: 1784636831958158500 Content-Type: text/plain; charset="utf-8" The existing check for PCI capabilities misses the case where info->cap_offset =3D=3D info->argsz, which results in accessing unallocated memory. Fix the comparison. Fixes: 667866d66620 ("vfio-user: implement VFIO_USER_DEVICE_GET_REGION_INFO= ") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3865 Signed-off-by: Thanos Makatos Reviewed-by: C=C3=A9dric Le Goater --- hw/vfio-user/device.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/hw/vfio-user/device.c b/hw/vfio-user/device.c index 008e5cf687..3d0dbe8406 100644 --- a/hw/vfio-user/device.c +++ b/hw/vfio-user/device.c @@ -214,7 +214,8 @@ static int vfio_user_device_io_get_region_info(VFIODevi= ce *vbasedev, =20 /* cap_offset in valid area */ if ((info->flags & VFIO_REGION_INFO_FLAG_CAPS) && - (info->cap_offset < sizeof(*info) || info->cap_offset > info->args= z)) { + (info->cap_offset < sizeof(*info) + || info->cap_offset + sizeof(struct vfio_info_cap_header) > info-= >argsz)) { return -EINVAL; } =20 --=20 2.34.1 From nobody Sat Jul 25 09:37:54 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass(p=none dis=none) header.from=nutanix.com ARC-Seal: i=2; a=rsa-sha256; t=1784636900; cv=pass; d=zohomail.com; s=zohoarc; b=CRLPM7qByzx9P2zXUCzOj910j+iLzvTF+fxPb6p3i0Oa6R9ShQ428ofEr3SFbaAgyZO+ln2NSEcsxDth7BSL6ovRsoCoDlKWFN4nmW7L4ajbk+ZzzBXnPrem9hPbmqzPQmAk5npoQEi0I7uUOEBMiBp4PDAvmN/M9ztN3gaQZfc= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1784636900; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=1Hc/qhemsrrgfCxI+K3Spk+aNhpSDK1P9WtH5TUxltM=; b=a4GAs1N0PPPP3p1MwGcoIQ5/bkrzwvai1b7aboUq8UjqqqzAwd0C5KUq9KGleaGmz0Gs9HlmgrRuvXYXNUf2lSBeqjtISKd1JUWgdAvM58mKsdrmYl9+f+lbePatsVC8DwGtctxNX9EFRmyNrClbelV0D83jPbilfprGayq6daY= ARC-Authentication-Results: i=2; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1784636900687628.1843548380081; Tue, 21 Jul 2026 05:28:20 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wm9Yv-00089i-Nn; Tue, 21 Jul 2026 08:27:05 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wm9Yt-00088X-QM for qemu-devel@nongnu.org; Tue, 21 Jul 2026 08:27:03 -0400 Received: from mx0b-002c1b01.pphosted.com ([148.163.155.12]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wm9Yr-0004mL-3k for qemu-devel@nongnu.org; Tue, 21 Jul 2026 08:27:03 -0400 Received: from pps.filterd (m0127843.ppops.net [127.0.0.1]) by mx0b-002c1b01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66LARHFR3272672; Tue, 21 Jul 2026 05:27:00 -0700 Received: from cy7pr03cu001.outbound.protection.outlook.com (mail-westcentralusazon11020091.outbound.protection.outlook.com [40.93.198.91]) by mx0b-002c1b01.pphosted.com (PPS) with ESMTPS id 4fg8fspbfn-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Tue, 21 Jul 2026 05:27:00 -0700 (PDT) Received: from IA0PR02MB9462.namprd02.prod.outlook.com (2603:10b6:208:406::6) by DS0PR02MB10249.namprd02.prod.outlook.com (2603:10b6:8:1a1::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.18; Tue, 21 Jul 2026 12:26:58 +0000 Received: from IA0PR02MB9462.namprd02.prod.outlook.com ([fe80::c493:aabb:b834:f53d]) by IA0PR02MB9462.namprd02.prod.outlook.com ([fe80::c493:aabb:b834:f53d%7]) with mapi id 15.21.0245.009; Tue, 21 Jul 2026 12:26:58 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s= proofpoint20171006; bh=1Hc/qhemsrrgfCxI+K3Spk+aNhpSDK1P9WtH5TUxl tM=; b=YNDLv6C11o896GrqdPL4lRfBVXCuqwbJcIohlDwgCl7n2B8RG5FhKT8s0 uRCVumVXssgb5kmuj1DdQ8yO4WR/CyB5mPAgD71Cv9w0qP1L29bcbNpzlcAtwF/F QhBm+/bFQSnSwVHxnBbVQjA0F/5MO10cqCmHb9WO2IYj5CezdToYnRbuSa3E6vMY nc7YtLfppd5xhNCDL1CB/xLT5rd4kiudBXvB9ejUU/M2kqTjaJGc35cC0ygfKm60 NAv5X/OzQ8ASBOW3GEre+IKA+4DbCsVUlO+6lE11gceRKK/KLbtWlq6Nj0kWgHgY XWRdzZ+OrV9GOWszoqCwGP6adUmVQ== ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=yplcTWg5Ia0xXZdYsZj1Y3FPO9Ibd5VwxNA7Ce7YR2my93fJbVRhvWydOf76OnJqaqQCikH7dXATKPgwdC5KH+a23DI8vax445nwN9BJ/1oYsBDV/kUms10lP17wZ1vHQBtlPFo2hV66RB2WlNSp+EH16OAdf7b3TEsgLL3Pg4u9kAf8Ib7jg9ZpPY2XO3HV3BJ/3KdqkFw45Ysg0oI4qhNhrOwpKhTNre6n9kkMvg84xvMl8drqWAwMBxO81XZWiMO0HE8ChvfgifQ5VzQo1xnPJiKR5ioNP6ieg+vnhvSrxLtXArdDx3O2svQFs/XMtsM5bOmlduUL5Mw/msRl9A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=1Hc/qhemsrrgfCxI+K3Spk+aNhpSDK1P9WtH5TUxltM=; b=QsMbYNwRMvDAXwgFNTVGAaYDJCwYTL7UZzC80eNVWyLyP8JZI2yMNXrZc46BwjWyIWgNf/f4f534i5iCfGqQEMw1Gf79IxN8NsJQhZayhvviRiP05vSlNT/WsyBdrPZhTjzCoZkrPvaXuhA+XGCOObZKVEc6ckjwKD7dzXVVH+TjXQTXw6IPPKv1SYaYsKwSrFPVxh4nBcAxVjTp6wpNsiU+MGVzXcM1vifJfc7pLzdPa1j9hXbrJkx/kYI/70Ktej3LUSdssQN6R8TZ6tHewonwBTnRxTAO4A89fovs77o2M3HXKR74+we3S1NV5I6MqUhOeXpLIFG/5d9f8oS0Eg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nutanix.com; dmarc=pass action=none header.from=nutanix.com; dkim=pass header.d=nutanix.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=1Hc/qhemsrrgfCxI+K3Spk+aNhpSDK1P9WtH5TUxltM=; b=wzMGZIoJ+XpJXXNRwXbbyiu0XFf7aqLIcxrrL6hOTdveic9D51p3ZMpN/o6jUyMTsW479hsuGfEwd6EUoAwnDQ/xLXSe8A7MPS45cceAtzQxLRIjSJitIlH9ySQtdSRQZ65BeEuWH9Yf1pGzPRT5qRknqO7W+wxKUlB9rzOlkOmO45e7QeAjjghiVZp8hpR+7Cp2zGIOB2TsinQCFUfecBp06IV9Zjzy65ssB8zEpA28p875ufKTS2sH9WMhodTKd9kzj9yvPTIQnyuP3PKkOw3OPxikLcnztD4HGbFis77svE3MoSUD4Z/sCTiFNAmcGl2ILKySg1VW2XO+bgIGxg== From: Thanos Makatos To: "qemu-devel@nongnu.org" CC: John Levon , "clg@redhat.com" , Thanos Makatos Subject: [PATCH v3 6/9] vfio-user: vfio_user_device_io_device_feature: prevent buffer overflow Thread-Topic: [PATCH v3 6/9] vfio-user: vfio_user_device_io_device_feature: prevent buffer overflow Thread-Index: AQHdGQw5uwDr1Dh3eE605cuorXi5kw== Date: Tue, 21 Jul 2026 12:26:58 +0000 Message-ID: <20260721122643.30985-7-thanos.makatos@nutanix.com> References: <20260720135823.21070-1-thanos.makatos@nutanix.com> <20260721122643.30985-1-thanos.makatos@nutanix.com> In-Reply-To: <20260721122643.30985-1-thanos.makatos@nutanix.com> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-publictraffictype: Email x-ms-traffictypediagnostic: IA0PR02MB9462:EE_|DS0PR02MB10249:EE_ x-ms-office365-filtering-correlation-id: c32088d2-3fc2-40aa-5b18-08dee7235bc7 x-proofpoint-crosstenant: true x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; ARA:13230040|376014|23010399003|366016|1800799024|38070700021|22082099003|18002099003|56012099006|4143699003|10067099003; x-microsoft-antispam-message-info: moVywDSWjkSVV8yrf7WTy7/zk5l7DinRObNbX9/9CcPaa4tf8CvwKWU8yqRIeTyrKXkJlG72sSmQymZNxW5WMLNKF3RE3GZ5wjbk1eLTBZTglzN8b2luh2boEC+M/vEH43uuvo58/WwPZHq80QrZDpjHY5tVxVnipnijii+NmW3O074zwG3VATnjujt682cCIO6s2jRE/T11mOi6SefQobO+5NZnIC3R9IMosNzTDjb/BWPX0VH5RKpkFqg/FAj4uRQP2DPFevZih759A0jwI8hourSNKSe7+if3e8tzhOSWeItspHxD53jcZxgLvE908YhBbA/mmrXHuIsBIvtCKfkYUd+3uRk78S9T7a2xxSHuzOKWZXEnfZ8mUkSvA4vaTjtkTucfMpSs8WTUWp26uzIJSnONoc+q8QC8ITlIfkHsXA+jjl3ulJg7kqnMq/T5BqYoMev7R2vseDC31/TUrmzF3Kb4Vzhu6VMjWZevMu/8ytOj5Z/qrwGgWGpyzdaYwJCPziLfL2GkC9hD1juwT/YHzqWLqtEaL/xBAZgzNROEIwZyO8EVNcXZXe55hUAxtvAfMg6E/tqInPvViTgkFljksqgtP7Rwcj+bK5ydHkOtPtvA5ipupKoiy9O3jEOYfoKmMJejNbDwcyNcZIGsGIaHFFtHhJ6bZgGNXKt2KfpdLxbTLQr/Dn2Nke6xhpb2Yn4UPun++2Zcd79lKYJOdXGQpWAEjp2kUjhKdlVFy7M= x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:IA0PR02MB9462.namprd02.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230040)(376014)(23010399003)(366016)(1800799024)(38070700021)(22082099003)(18002099003)(56012099006)(4143699003)(10067099003); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?iso-8859-1?Q?6hVECHrzlgIkdujxOcGsrvAdRZspnJkIT+UC0vo5btmYvXhjG2ZbChEEMI?= =?iso-8859-1?Q?wnGugGqUJRe6dQofoJzq17QYXqM+/IUPnM3SfPX6s/nLZhm6uYQ1BS7Ugm?= =?iso-8859-1?Q?DQIC+QjDcDnu5PNOLfS2wIE5mT6BSHu0h0Xdi49uICOqOJuUW4s5rwNqAq?= =?iso-8859-1?Q?8tHEpLV8a4LVTCX9FaztP9Zw2WkD0vnhIYEzNF9ZTq2BIAzsJcPDRScr1v?= =?iso-8859-1?Q?GkqyQOP2AugNWbQTrYeDDLJAv4X0ZRpsivRchlUm5WZd2SM5FdJece9PX5?= =?iso-8859-1?Q?+sfejSJBZV9CMgP6uoPI+pwnGl+SexKWZ61l7axqb+xgDJeYkAiEnBLWEX?= =?iso-8859-1?Q?GoMfPNPCkgBaEzAOJcOsk312MyeLgX4ysCD7oOor3Q75yNg5HvOZPw6Mdx?= =?iso-8859-1?Q?xh8+5ZvwRV7yutZZfIww+anaihYNsycpZsbCoiEJKjm+eLQl74daZUQgic?= =?iso-8859-1?Q?WOsrTo+xED6UXKKpIHNxtoqiirauq5HDXF+jn9uFFg38vYl7RHw5/rHMfp?= =?iso-8859-1?Q?cKasUtupicZLEPEOVvsmskUSyv6ldj8eoHoQvDbJtDr5dIJUjB7F3ZVVnV?= =?iso-8859-1?Q?HSAuJ8EbLcfS4hhrQkwuQ7aPh3Z53fmiBzbzyDYb9zVl5Rho/PwVp8My2M?= =?iso-8859-1?Q?CUjn2PvZJxQZI5isOfon+zfHoNnJzwfl/LunphuCoI35mYSgZyWvT2hF8W?= =?iso-8859-1?Q?gpaxozOAIr4YxXmpYouhBs7d1wwI7LZC8wirmo8wmhCdufu1dq9lD6WILa?= =?iso-8859-1?Q?u966jXF62VObjAd/bggwsPO2LeUQL9HXEfOmJybJ6SyWW5BKf04RI74AsY?= =?iso-8859-1?Q?WEsbobPRlH6rDkC8ire64RyIfQg4SEMVEfGfwpuQJ3161zMniwHQdS595B?= =?iso-8859-1?Q?CwXTXmi/G4A5JCmemqC+VEGys1HGHqnlAIiIFOvxmE67GxewgrI9RTWp01?= =?iso-8859-1?Q?0ABWte3sGwZ/N0EmIkyHNabKhBWSbC2CWa5JfkxjwXZ8oNGeSVFq2xCDGO?= =?iso-8859-1?Q?i3nVwlrfFJcxesp11/GGq+7SedP+SgsQQ4Jg7bXplyTUjdxAc1DigcvFpI?= =?iso-8859-1?Q?NEhe2izFQSdGvnKIARtSvjheE490XOzpf1185Idv3jzPCvsPnPcUnLmrzT?= =?iso-8859-1?Q?n+zta5YzM6DhZklZ5M46i1s8lvbT+M74gaXhx9attTnwHl2kF9qme1hI+h?= =?iso-8859-1?Q?mA8+INQL2dqn3Aa7HrIThjzpfzfpD6SUhrqRuVXgEpiYSJl8fTM3R9ySSv?= =?iso-8859-1?Q?z5k52A+aOqH4entJ69Ed9Jai99pmxKkvYaydTANwZLzDn3t/CHRa1PWwOP?= =?iso-8859-1?Q?f5owiCTZC9sRLSISEdTnG/sBlO7ItKuTKmEX9WHG+Dm/9zeHPiDpfgCkoD?= =?iso-8859-1?Q?klal3g4AxILhkv/FW32xUWUv0aL5qUF0aZ6piXVdcKenr5NTf9zJX7QR6i?= =?iso-8859-1?Q?agpeH9rN35bfA6yL2oSwEWYZWxPND57V6cWv0NtK0xhXYv+0Zj2Y1hM7Pg?= =?iso-8859-1?Q?PBvicH4R90GDfS9t0Ay06VMREX210w0erlKqW/hLqF7I8+v+PUN0mTOK49?= =?iso-8859-1?Q?JHdvDo01ED9oKe5GBmBbWmraoObnDXSiPlaxxFkpd47bJzrI5O9XkNW/4u?= =?iso-8859-1?Q?UXn4qzUtpccpM6PKXnign3AqkkfQP2A5a36Dx/ltOTO0QfNgs6itxkinmo?= =?iso-8859-1?Q?z3rb2Xh9TyA6LKbGmAcSR42DH8fFnkUKyhShubA03oy2aZaeDyZ0pIuJ3L?= =?iso-8859-1?Q?fY8s/CXbxCWN6Atiug4tVOWw558rZitH7EoDNAF4Ehro/09Fn5+SQnxYa6?= =?iso-8859-1?Q?MGKU2jSyiOgN9FdatJOKvgUXPTwNB8I=3D?= Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Exchange-RoutingPolicyChecked: FYG5F767nYi7dlYYQuIU2w6lnn2v/kR1DGOSKLJQOuO4BzkF2/aI/G/Cf1U7gUc9YihVLD3CVPI8CclFoFeUpaOPElcPHgHzPVyeicLKmjX1V6LFl+Cj/RpXJYJG3V0LtfvCq7LKHvGqAw7f7n1r3nWByhtMCujM7VDkuT0N/qrv//nQmwSXDX4SxF1aWjQN4aTQQDs2nJ+zALFnd75J0dxGZ1EVUujhrIT8JfS/W2cTM/LMlukabsyb1FuT4FTdTONxKYem7jEIXp+/IZAKGOT9nYOti5K03Eit7YpPzmsPgCAlIhaw1lfcpkdJbw6yqNm93x1v6mQ5BRPMolNkMQ== X-OriginatorOrg: nutanix.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: IA0PR02MB9462.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: c32088d2-3fc2-40aa-5b18-08dee7235bc7 X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Jul 2026 12:26:58.2410 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: bb047546-786f-4de1-bd75-24e5b6f79043 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: qmakO6VB4wOrVYzAG0pTb8zjQ/Hkcw6rzOU4UomMqX2d84mAACZIPjKaH9X31s5YSYtwwBWL3eQrBsmTQyy00t2rI3CEiLeoEoRQJoKgwEQ= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS0PR02MB10249 X-Proofpoint-GUID: cpS2xRtgCAezg9Sy88TRaSqWqgytfqkp X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIxMDEzMiBTYWx0ZWRfX5IanjNoBo/GH Tf4G4RbChEIohpqlcaKvoJGEO1+ucwpefIg+Ipp4ZV6Zx1qrJPw4V22m53OVd+UA2fukxtwZUPg j7bi4fvltpzsJi6/laHEcMC1oriXfp8= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIxMDEzMiBTYWx0ZWRfX3iTFgbpfF/2r rY+p+8hHexojoi0knc1Yto6EhNa2XrlG+xJZBX1zhJpm3Dfa2K7e5iajNbqvQyT8ocrS/I694Qo DS27LHPB7agLs2ismB0Ug7GPqdPDtUx2mpFhgFI/b8aFtlmeT0PZ3i0AWL7m0mePt0Tm6zx0MUd yeygBkZ7joYVzY20KnVDJTFEYucBX2BpdZ30cTgSIbo6NbFw2jwJeJ+HsjP9ORR3seOdMSx8K5G x2Z5mbFZ1mRVvUQ42FTFT+3bZ6D6YK61YVT5Arpbn1BwsApv1lXT46yZDbCfiQU6z7UKxYUZfLS 87vCAfidlkhy/jWSEDtLyK5z/9xxCQ3SQwb97iKAS/qrRUA1sdjjkoBzpznBd73qBLhjyZsi4WS //Kzp7CFCjtQS/ej8b66tWsiOkdFCwMQaFXJNSu7DAmP8M0S+nIA8NGHVh0skHaBjKhWEAsideV D9jyAysR/wtENurDRmQ== X-Proofpoint-ORIG-GUID: cpS2xRtgCAezg9Sy88TRaSqWqgytfqkp X-Authority-Analysis: v=2.4 cv=Ifm3n2qa c=1 sm=1 tr=0 ts=6a5f6594 cx=c_pps a=LgTXwy+OxRus0W5fFstXuQ==:117 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=8nJEP1OIZ-IA:10 a=RAioF0-LDSMA:10 a=0kUYKlekyDsA:10 a=VkNPw1HP01LnGYTKEx00:22 a=VofLwUrZ8Iiv6rRUPXIb:22 a=dEe9Ve2bX-KnNSUMM2s9:22 a=64Cc0HZtAAAA:8 a=aB6u2EZEa9mQxSzGBCIA:9 a=wPNLvfGTeEIA:10 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-21_01,2026-07-20_03,2025-10-01_01 X-Proofpoint-Spam-Reason: safe Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.155.12; envelope-from=thanos.makatos@nutanix.com; helo=mx0b-002c1b01.pphosted.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @nutanix.com) X-ZM-MESSAGEID: 1784636901935158500 Content-Type: text/plain; charset="utf-8" This isn't in practise a problem since feature->argsz is not externally provided, it's a good hardening step nonetheless. Fixes: e2358af5838d ("vfio-user: support VFIO_USER_DEVICE_FEATURE") Signed-off-by: Thanos Makatos Reviewed-by: C=C3=A9dric Le Goater --- hw/vfio-user/device.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/hw/vfio-user/device.c b/hw/vfio-user/device.c index 3d0dbe8406..353fa5ee21 100644 --- a/hw/vfio-user/device.c +++ b/hw/vfio-user/device.c @@ -79,9 +79,14 @@ vfio_user_device_io_device_feature(VFIODevice *vbasedev, struct vfio_device_feature *feature) { g_autofree VFIOUserDeviceFeature *msgp =3D NULL; - int size =3D sizeof(VFIOUserHdr) + feature->argsz; VFIOUserProxy *proxy =3D vbasedev->proxy; Error *local_err =3D NULL; + int size; + + if (__builtin_add_overflow(feature->argsz, sizeof(VFIOUserHdr), &size)= ) { + error_printf("vfio_user_device_io_device_feature argsz too large\n= "); + return -E2BIG; + } =20 msgp =3D g_malloc0(size); =20 --=20 2.34.1 From nobody Sat Jul 25 09:37:54 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass(p=none dis=none) header.from=nutanix.com ARC-Seal: i=2; a=rsa-sha256; t=1784636888; cv=pass; d=zohomail.com; s=zohoarc; b=aMFXUkB+tEbDFs0c15wQphfrvkmNRawl92msfbi9aYv1Y6zeEUzZp9k7eFkZF9yZNpGXxnU72+GPYzW9KAsnq6MhCR5VtRa4TX688+lxvge0xNySU7aBu1ToAsGI919bl33z0IrlYTFfOqSBkt/7CUHeKHFx5meyXLBeNRVKUg8= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1784636888; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=UDdkWSOJeYJ5V1Ep4aDQfwgtNKsGAOKXMpT3tM57WaY=; b=I8DF4YpPL6SM1y6Ze8MWSQSKH3MSwjc6fHxZUF1FcWUQN/Nfj6IXcStcAdCzabbvnSaKyscS3mhA3wPxpVFP7RKmEYfMsyKG3+b5pVjqR+9NuwqrDFrgYRXKspFxNkgwx8rhjs0Ve8ld6A5E6myDJH3DQJIPt7r/ZslSt88ripc= ARC-Authentication-Results: i=2; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1784636888907636.2990347004927; Tue, 21 Jul 2026 05:28:08 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wm9Yw-00089r-AJ; Tue, 21 Jul 2026 08:27:06 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wm9Yt-00088c-Sv for qemu-devel@nongnu.org; Tue, 21 Jul 2026 08:27:03 -0400 Received: from mx0b-002c1b01.pphosted.com ([148.163.155.12]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wm9Ys-0004me-9S for qemu-devel@nongnu.org; Tue, 21 Jul 2026 08:27:03 -0400 Received: from pps.filterd (m0127843.ppops.net [127.0.0.1]) by mx0b-002c1b01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66LARHFS3272672; Tue, 21 Jul 2026 05:27:01 -0700 Received: from cy7pr03cu001.outbound.protection.outlook.com (mail-westcentralusazon11020127.outbound.protection.outlook.com [40.93.198.127]) by mx0b-002c1b01.pphosted.com (PPS) with ESMTPS id 4fg8fspbfq-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Tue, 21 Jul 2026 05:27:01 -0700 (PDT) Received: from IA0PR02MB9462.namprd02.prod.outlook.com (2603:10b6:208:406::6) by DS0PR02MB10249.namprd02.prod.outlook.com (2603:10b6:8:1a1::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.18; Tue, 21 Jul 2026 12:26:59 +0000 Received: from IA0PR02MB9462.namprd02.prod.outlook.com ([fe80::c493:aabb:b834:f53d]) by IA0PR02MB9462.namprd02.prod.outlook.com ([fe80::c493:aabb:b834:f53d%7]) with mapi id 15.21.0245.009; Tue, 21 Jul 2026 12:26:59 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s= proofpoint20171006; bh=UDdkWSOJeYJ5V1Ep4aDQfwgtNKsGAOKXMpT3tM57W aY=; b=TDjac7u0b0vzlXTZ/tv0Zd5UhldVoqv7RrGd5rxhMnADPgSf3q0HR7qKQ 8Ksmm8AHadXax/Oq1dITGJvioeEJo+HZMooH7ildc+vud6chY2m2GC1Pq732AoxC 54SLnSRf80mbUwi98s4/UvFpz+AM4SeSN6rSYuTy3OVThN4hebF1eRrBiQGK21Jb xrs9JaGV6ZP7xf7or4cDJQANsJIn5Y2JY4uCv4MiRTjmERDkZ235rjvyia/SlN/U LUkmnl5CHtRLeEZeHzuW+rf/hmz0Qe8CuDLQX2k0KsRVirerMx0leZeUUTFqz0aQ YlMGl1Z8OdE1/LwUsM1FJsjiN+PSQ== ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=Dhgk9GlCeVxEB0/NZQnwLYpAF7m8SLDj5uaCB6Juf9aSnJrTwE3rstVvuWIlvtOnVetvaJ1DY8NcBzDlL3OOzySxZ3D8y9xZ7G6wsQS+Use4pT9yz8ibZKTZdD8eZx7irlB5gyrmIxFQTzvXbnTBY3uVWEfygjGHcbwEt2/e5/OqJtMk+QERYD4XNQywpBj9ZlCIhB8HSv5kd10oNld3KWwContzF/sExGkyQD/X9MXUfe3Zf1ic0wRn9BTwpgJ2WzDObDVqDEP8gIWMuRNGzcSs8NPUQ8DAST4Dg3O57o2tTw0DFF4iXTnFUrO57723SloQppU3sIM3P5PTWruQig== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=UDdkWSOJeYJ5V1Ep4aDQfwgtNKsGAOKXMpT3tM57WaY=; b=bL5nasPa6UtAP+2vrZ8W+hTFSq1YXA1aATKxNu0TcsWScV5I47yYpCGaivNw/KWEYOM/HUha1gbqP4QYyQZa5dm5BrqjdovTZguwj7CVsRxlb1H++GTzg2nXREkJHeiTgYHBkvISMRucQHsK8Qo3bqNsyqWQzkRxO2EKzrq+CMFA+j6WkuGNaJi/+XBr7HtudgWyKKO4eWTL/hYhgWjARgIcr7/D52EpIlRO+c8iJKGuMcwKd783S+ym8ZEn8Po7S0abQP0FQ3OmWd/nqm5acoNS+b4UA5r09zY3FTIvHpmDenspXqEHJlHiuwy3LuSyMSGYtirGL7W2WxBdODU7wA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nutanix.com; dmarc=pass action=none header.from=nutanix.com; dkim=pass header.d=nutanix.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=UDdkWSOJeYJ5V1Ep4aDQfwgtNKsGAOKXMpT3tM57WaY=; b=U56WJJ3GX1D376w6qvFvIpI1zpABSVR/VdL01XzXghndY4JAddP6qy7iqUlpT36AjA//HG32rvpLFFejaRuU8FUW2v+AA6zwaEsxctO4E07GTAwGGH6POwAPniTK2yNUg6VbzshI458UoGMXaa0qNPZhN8EbfoBlLkAs5xBgrXNqFXxsJgmFQMmfJSNjgKhxM2AIAlkTXlHzUoiDGtewRLZiXkDKa9KngxG1ymJyDSk+bw/VJga8NGLtgv3A5MxId+9LoDngHduImxsg0/LjxJju7sKnSYg9igTMfS8NJZHcj1IkjDjxRacqq2QEgdp/Qj9bJupiddhFfw2ONc3lNg== From: Thanos Makatos To: "qemu-devel@nongnu.org" CC: John Levon , "clg@redhat.com" , Thanos Makatos Subject: [PATCH v3 7/9] vfio-user: vfio_user_device_io_device_feature: prevent excessive malloc Thread-Topic: [PATCH v3 7/9] vfio-user: vfio_user_device_io_device_feature: prevent excessive malloc Thread-Index: AQHdGQw5szpTdEQiuE+Zx81YVplpKw== Date: Tue, 21 Jul 2026 12:26:59 +0000 Message-ID: <20260721122643.30985-8-thanos.makatos@nutanix.com> References: <20260720135823.21070-1-thanos.makatos@nutanix.com> <20260721122643.30985-1-thanos.makatos@nutanix.com> In-Reply-To: <20260721122643.30985-1-thanos.makatos@nutanix.com> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-publictraffictype: Email x-ms-traffictypediagnostic: IA0PR02MB9462:EE_|DS0PR02MB10249:EE_ x-ms-office365-filtering-correlation-id: c9e29e15-54bb-4411-5794-08dee7235c7c x-proofpoint-crosstenant: true x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; ARA:13230040|376014|23010399003|366016|1800799024|38070700021|22082099003|18002099003|56012099006|4143699003|10067099003; x-microsoft-antispam-message-info: 76gOg2GMwK3lY9cHJ5TEaeq4ozok66cCnRMa/4KRx1XLBugnwcwdfzBizh4y4c87YaSuU4I+mGj9J8I9QL++Yow84bCXv4BZGaFaNT75bzi6D1v4923cSt7bLv7CmTsMIiyEhT1NADSimhbxCvdBT+6S3HCyjCpOiPsedU0zetHpErV3wyCMT22iVoGTStgVDbhvtKFrnFQ/ekqAr4IqN5jk76dADIG7ftrJ0YtoNaW+rGx2p5WUWRORgLhJH6VZ372U0YrFUKYTJM3RwOt6v5ts7XFxNZ7MVeftHIW350rNUSmuSbexDiX4c0lRW+3dYK/WtnrdoWozpx09RWh8HjCX9dxEE+8/3Klh2p5DysPBCzDeuwVLxEq3PK4xlxoAwaxiv050TS9EYX51S0VoiTeH8MIB5+ZyR3DyOPc5aRAKW2cKX7Ama/qU432WEZlTKOxtRnTV1Td6MVELufU+GMQOcytd5Gk/YFRLCvncBjWo/hmcyrVrMOvKtfvYq+FrX5JeYcVYd7dxbRlEQKxHjvUZJXNdqIdU9R4edmf/yhpzH6k9TqWiiMIRP06fgehKh/qHP/9xB2iDnnK+Aulvrfg3VTKxqs/1yrGOApFHib4QFfny3iofWkid9XNVoiHWVGkzKPQm24RUOahf7GINebVM2ZiracOZ/tyw4+HTdckedwn1gRrR0GL7dBNZ9YieShZi4lgW+qYrNC4lARefHERpbzB+bE/CqAdf3W4sQwk= x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:IA0PR02MB9462.namprd02.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230040)(376014)(23010399003)(366016)(1800799024)(38070700021)(22082099003)(18002099003)(56012099006)(4143699003)(10067099003); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?iso-8859-1?Q?dGJLApbkpgdsIAH6fQnCWvrdHUp+IOeZJH/N8ahmTJG8ZLcjrtXnTeZMlr?= =?iso-8859-1?Q?10teOtf5j8soeI6uByl1cYECT9G+CbTnHgrnJ3rPM74pEB5SRqNqc9LMsM?= =?iso-8859-1?Q?/xf2+Y5p++ZlUT39V3eYmvzCbkYhKo79TTW/Jc/cP/msiMo1Cuh3gzX8lI?= =?iso-8859-1?Q?Zrk0+rHCvDVgH46V9x9PGzAdzE1fcY01l+Fpl/+UgNeVphk5RJD/V0nS0J?= =?iso-8859-1?Q?pAYpsVzk7V4V/icSvt9wt/K4GE4J+WnUm3rxYWy/6/ctm2gVZggHBwYb5n?= =?iso-8859-1?Q?A4miZOFmqZkb/oGik7B877uDh2Ip+0evb17I6w+MfRsLMHznqvtcE8g6M/?= =?iso-8859-1?Q?2uGyXgcm9NnWoSCchoJCEhxnYaLOroWY+SJi0W77dywvkBXn+krKKZmQT4?= =?iso-8859-1?Q?SnQH2Fyyt9tzR2hpdk4xjhXmExD06YmrMqiDRRCzQXwpEIE9eaaa8VGfnl?= =?iso-8859-1?Q?px6mrktEHGYxYssDnVQg+afL0w6NY44/LlKLW1Dt6DZy6erZ9F30/7EJTa?= =?iso-8859-1?Q?8U3Rw/BJgFq+mv4xdpnepMky9LTKuxKdVhLXc05Va6Ty9dXcYJd0Zo9jHx?= =?iso-8859-1?Q?DSGPNM5E6gm2u3EyVfLdPPih10MJ39tzGWOFozkbhOc0XzojQRdRSefbsz?= =?iso-8859-1?Q?oVSUzBr7vsYc/iQt0rtOuVkfOsvpu51Vp46kODkktH0ZLxKOXeS/oLZLPB?= =?iso-8859-1?Q?0xJ9Jzx9zuaV9/vNeQnxsTDOrugS+xKFC+wDmWmJR2yvkFFsP40gBOPqaj?= =?iso-8859-1?Q?i7OEh4q7sYtaLaMU5neiQQAWFku+Q2gqP7xlfarxD2QKAda7xfmiKSrhfJ?= =?iso-8859-1?Q?K3qhkqrbzftbsWNeN1xkRUrllekCQvrGDYkzN1yZDosZxSmcoJUGb5pEvm?= =?iso-8859-1?Q?XzLN2e9lV4sEd0aNWH2W9CYOpJiTShuDUFgWxy+HjSWpHGxKiGh23Hx9ir?= =?iso-8859-1?Q?O7ejays2anQky5Zi514pZfPXbbvJp7SgK3COWmf1v3Qdc23IOmV32qcacW?= =?iso-8859-1?Q?5sm226krIOcdlgfBXojqipaH7UmpQ5JUPaTfSVrR6wqY4lUn+PByOfN0xA?= =?iso-8859-1?Q?oqvp8I14UJiVsreMWpT0VnG2khPLtQspOsbmGiHSlxRujSHFBbb6Z6aExJ?= =?iso-8859-1?Q?Jw2e1vdLQvRppnHBAWhsBwz+JVgmUNLPYGOaIiiYMwN5wG2ev9WAbFXjwk?= =?iso-8859-1?Q?90yr6aYkEC+XUJ9XXY1i+/KDUJ+deygjNojEpzphStsJOGeFlvyQ9AR0zI?= =?iso-8859-1?Q?HTgnT6VJMfmnNB+JVrGwMtSx6XTYf8G3mZDZJNoIjf14GUwEPsZvVfF2aO?= =?iso-8859-1?Q?ZRIxuGUrgzhv5QHeDLx0j7uIhplczvNE36FP3G+f9TKddKl+C858OMqeVl?= =?iso-8859-1?Q?q0fHNeLNs5N/3UF780JMffOkItHtP9eYOugUzVmGTovXpZWnSfO4cXa3R9?= =?iso-8859-1?Q?USo7ZdpnbR+3oS4irBD8loecLvGtIgW1FQSlWPd9TFnCdFG6JL/NQDoPZL?= =?iso-8859-1?Q?kDStG93YkAkEd6KPWAPTN0WEHvAeN1BsSiOrSQ/CPjsQ+IiXWTAYtkkGtT?= =?iso-8859-1?Q?VYvp35tMbNN5K61wbCTfm5aSB8WFTJEqPwvkvk4sCzyctR6uBL7C9IZWpD?= =?iso-8859-1?Q?K8osf7SV8D2hX9d70LNiXbAIPK787EsUiWV4kE+Yi9A5NymlK4ZjMSZyij?= =?iso-8859-1?Q?j/3ew3urN8//1NeAIC9XWKrZd/xFSyfIFNNEf1u/50wN6zhK4CbDPz45uD?= =?iso-8859-1?Q?ZP05y0KDi0xhRSQesM/cL3U/iM5isKwryPQY4QxNFzkG23CP1oN1lKTsDN?= =?iso-8859-1?Q?oFiq2kFGhDn8+LDY+ErXtyhlq7rL5d8=3D?= Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Exchange-RoutingPolicyChecked: FFT86l1aXSd06DuwtOT+MfDIjqpmCFkD8CrkUTcXHh3Kk9BTu9p9fwbs0J0HU/7qx4uF4ZV3TUgm5YCW7UKFYa2k0UgxYqg8oWGEnk0ZDTNFxI5GU8qz+A3XIe/KwWDlnyVRpQ5rHXhKpYvEOIoKynrn/xodJ74DA+fjQj7NLuqoD0kZUC/s2TlsX818a/cNBMEqzefUOOMRLAtSih+MknxjgpWgCEHVuNd1X+oJZbmOdCUWGXL413rm7V/+JmnwkXAz4syl+BzEjZ0/Cl4D+a0SWwvZfAS1jssfbvBxNLAz/EC0dyCgDmcRUrrZiXCCT47IDsNyJ8Om2p9UCzN7SA== X-OriginatorOrg: nutanix.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: IA0PR02MB9462.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: c9e29e15-54bb-4411-5794-08dee7235c7c X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Jul 2026 12:26:59.4552 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: bb047546-786f-4de1-bd75-24e5b6f79043 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: P1skPELXw55CcwI08re0CrwQzJ1LwM26eM68kcsW3t5I3DRAoJ7whw76hNxUfuFEqk91AdiTvNJOPUYQHB0jsL3aq0SqAP5aFHmo016zX+I= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS0PR02MB10249 X-Proofpoint-GUID: ld11lPUFfgDa1IjLl9Na3xAwoZtiSZrw X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIxMDEzMiBTYWx0ZWRfXydfLRx5pyBmy quWEsYkRaAVAKx7OeH5k7BqtqKPXEgrtmCW1v3RKgg6/jfgXf8FLAnZbbTyU2Y0SFp9zohfAOnF NzUXu4XnJpPdYdwP7/CUfM0enosAsx4= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIxMDEzMiBTYWx0ZWRfX+0Wghx6i5QXt 3NVWfF028noTb/ZXD3F2OWIQMsa8HGzvLQJc5KhVaGqHyZGTrTKEadCXnpMiuoUyCHyS0FZf7d/ 5+DwZyRQatG9vHv57PMUBjwUmf1V2kQifaKCJmrR/JPB8W9TUQimD+rGqcr5AtOHVAmMYbIBM1v x0trtgw4GsbvNAsBk0Vz4MEhODbP8NRBN8N4M+yJHPgZbWt3Zb1MfskHKrTx4n1jLfx8wVQ6N3o VK9kDrfiy9hzDAyqnfMsGG5wHkyEytTq6RExbFl2UygaL53AJGbTWW/X9sqS7pnUoR2x43srohV 11lNwtRohu7u7NdEfoYApKlmvtIeU2eI0v59JELKLbLYYThcgxsY5y6IuXVPmy8pjG75WcaNfQG V76RcEzq1u4r+eLSZYO98ICHsjBu3UATzNtG97uvgHA6cmd2AlOeIZ7znvQBY7RbgFcjkpfnNXZ 3jHK6HAOgWO196g8+YQ== X-Proofpoint-ORIG-GUID: ld11lPUFfgDa1IjLl9Na3xAwoZtiSZrw X-Authority-Analysis: v=2.4 cv=Ifm3n2qa c=1 sm=1 tr=0 ts=6a5f6595 cx=c_pps a=eXjbGYYLs/cxvPp3erIRkw==:117 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=8nJEP1OIZ-IA:10 a=RAioF0-LDSMA:10 a=0kUYKlekyDsA:10 a=VkNPw1HP01LnGYTKEx00:22 a=VofLwUrZ8Iiv6rRUPXIb:22 a=dEe9Ve2bX-KnNSUMM2s9:22 a=64Cc0HZtAAAA:8 a=aueCIXYKo1H43F9MYFQA:9 a=wPNLvfGTeEIA:10 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-21_01,2026-07-20_03,2025-10-01_01 X-Proofpoint-Spam-Reason: safe Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.155.12; envelope-from=thanos.makatos@nutanix.com; helo=mx0b-002c1b01.pphosted.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @nutanix.com) X-ZM-MESSAGEID: 1784636889901158500 Content-Type: text/plain; charset="utf-8" This isn't in practise a problem since feature->argsz is not externally provided, it's a good hardening step nonetheless. Fixes: e2358af5838d ("vfio-user: support VFIO_USER_DEVICE_FEATURE") Signed-off-by: Thanos Makatos Reviewed-by: C=C3=A9dric Le Goater --- hw/vfio-user/device.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/hw/vfio-user/device.c b/hw/vfio-user/device.c index 353fa5ee21..8feaa56875 100644 --- a/hw/vfio-user/device.c +++ b/hw/vfio-user/device.c @@ -87,6 +87,10 @@ vfio_user_device_io_device_feature(VFIODevice *vbasedev, error_printf("vfio_user_device_io_device_feature argsz too large\n= "); return -E2BIG; } + if (size > proxy->max_xfer_size) { + error_printf("vfio_user_device_io_device_feature argsz too large\n= "); + return -E2BIG; + } =20 msgp =3D g_malloc0(size); =20 --=20 2.34.1 From nobody Sat Jul 25 09:37:54 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass(p=none dis=none) header.from=nutanix.com ARC-Seal: i=2; a=rsa-sha256; t=1784636848; cv=pass; d=zohomail.com; s=zohoarc; b=e8s1Uzj9afzNQvnD6LPTk/3Mq7FcjuHc6+sgDv4PT5K40xqeCW8H88fqipYST80evI5KyKrGtU4GSnhv6Ib0Tda6Cb2mk9XWAAtytMmff2gs5o5tUJK8URQL0qVicPyQDXVihy/d2hR1y2JNr8rfIcBa+IR68wKNnnTi5yPKcfs= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1784636848; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=EE8e9cR66Xp2sTSYFoivVnsPw5pxojt0t2Jiz+ikerU=; b=dJuompHIylONgeWsPetF521QatEk48wdrM4V4pRjzaTsOa5BmRyzSi6bL++0ej2+C+pLoTPCp4h2I6xQIQeu7rg9JZ74ur/Mcwcfsho9B5PyXs87ml2rORz5ISKL66BPC6g0e71KQEWrLxoAqXRcH4NXRDnXgYBq0DjysWE1UOY= ARC-Authentication-Results: i=2; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1784636848566556.1797212123022; Tue, 21 Jul 2026 05:27:28 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wm9Yz-0008BY-8F; Tue, 21 Jul 2026 08:27:09 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wm9Yw-00089s-Bp for qemu-devel@nongnu.org; Tue, 21 Jul 2026 08:27:06 -0400 Received: from mx0b-002c1b01.pphosted.com ([148.163.155.12]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wm9Yu-0004nN-RC for qemu-devel@nongnu.org; Tue, 21 Jul 2026 08:27:06 -0400 Received: from pps.filterd (m0127841.ppops.net [127.0.0.1]) by mx0b-002c1b01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66LAR8p23215302; Tue, 21 Jul 2026 05:27:03 -0700 Received: from co1pr03cu002.outbound.protection.outlook.com (mail-westus2azon11020105.outbound.protection.outlook.com [52.101.46.105]) by mx0b-002c1b01.pphosted.com (PPS) with ESMTPS id 4fg8eeebs7-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Tue, 21 Jul 2026 05:27:03 -0700 (PDT) Received: from IA0PR02MB9462.namprd02.prod.outlook.com (2603:10b6:208:406::6) by DS0PR02MB10249.namprd02.prod.outlook.com (2603:10b6:8:1a1::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.18; Tue, 21 Jul 2026 12:27:01 +0000 Received: from IA0PR02MB9462.namprd02.prod.outlook.com ([fe80::c493:aabb:b834:f53d]) by IA0PR02MB9462.namprd02.prod.outlook.com ([fe80::c493:aabb:b834:f53d%7]) with mapi id 15.21.0245.009; Tue, 21 Jul 2026 12:27:01 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s= proofpoint20171006; bh=EE8e9cR66Xp2sTSYFoivVnsPw5pxojt0t2Jiz+ike rU=; b=gqw2jBe2QtBRAsUttiwvPbU8rWMU87c+3DkQuD9DaUoNqtcRdWqcsDHpr xfmUtTm4oKas0vQyxTSA2CgX3oq8HuE98rhrR/hCJmxLn7sRBKWcf1ZMZUDAzY1V hizb+PFqrdoFgKty/y6fXUTim5xXUiFdV3N8fMmQCQKwJzpTm43VI4KvrM5HFuHi Lj/RfD0EOPIWWSlhdcUZoBLPYwjyh3z/TpNd6uR04ewq8GfVRG3+0OXdqazjC1t9 UXByGMo6Xc6cVg/TGRqlUuZWSymvymeAiNPA7JX5keP/qE9BgVZ6/rscc/wXNR6w p4+4AayDz4zlxOM7ffQZYvyn0QniA== ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=J7f2b7gjGXbd/P15l5w7VW3987u4+OBN+7nYZgE473dMj8rhIfCjQUn5JmoML8+4oMNhOZoZXwo46iOykc/OozyRErnCuLuQBdOXGqn4Rwky/hdnSxNN0R3Mf4jWc2D1GZf/pO19nJCL/JqI8WSJE4tA+EriVBkE8zOiVYKlsgSF4k+K+JR+pkaJmKOiIddugrByy9ZBOYGpENE+pLcTyHWh61RBM54sA9Vo9+bHVke7WuqkavcUMe67qhco+eIRinN1yX7ovx+8S+W5JXwlBjHMZK5xB9UCUuCR5KBL3RSuSgeRT/Miim0+d109ZSaydKPGeAcr2BKypJVIrUd0eQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=EE8e9cR66Xp2sTSYFoivVnsPw5pxojt0t2Jiz+ikerU=; b=yqYcYHzXGtxEcr6mYWf4jIOssGg9ur1bqBkAsyyjcKZsjuTd73iwLBadn7kpeZvxdbIGrLx8fwEE1tNY+VKbJ1P94LVIuhSmSwBwEmAe5SNCbRhKL8Z36OW06rgSXEtFAurLcg++x+9LXHvVjAFnIg3YDtLFxrc7Rjx1M+3w8kBkNg/r+EJI1imTVY/QJgvWru/Hr05qZCHnizRkLPrcWKtLTt8xCIwqEAIfEBMgC37UqYmoiyX2UaWXjoC7xZj4VaoyXmigGgzdJWa7yZJHb+xoUnNV3FTb8Na9H9fBTdkevnh31qrce5PVCRNRWMCSKCHA0t2Z3brxaiCXf3pKSg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nutanix.com; dmarc=pass action=none header.from=nutanix.com; dkim=pass header.d=nutanix.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=EE8e9cR66Xp2sTSYFoivVnsPw5pxojt0t2Jiz+ikerU=; b=L+Tt5zGJlN8CMXUNNfzMpgme4dAJpQrDA8e/SQjszBWfrRT7t/Bg4ewC6LYu983zXTt27E84+GX+qwbF+7dTQn6hcH2h6r0JXR5z+1UrP0MslDGUQxw2XMaSOs6eTH+/QFUkIqJdw9scfVGU6OewJbIBAV+eS9o1ZXM/5A2YQOzc9dMPLccK9cU9PHkCvqbkHhPzG5O/KD44HJ7qhDmDYXd5LLJyDF7GJRD+HGbYgptqTbTi5TLjN7kU1hWBXEJGqdkiiKNi32BrZ0nEncYPkPLCMSJhqOw0IDYf+coRFlv3ZEooE7i7A6FxUUCjxEc6DAaYaKkEBBrb5iz07GRkkA== From: Thanos Makatos To: "qemu-devel@nongnu.org" CC: John Levon , "clg@redhat.com" , Thanos Makatos Subject: [PATCH v3 8/9] vfio-user: vfio_user_device_io_set_irqs: prevent buffer overflow Thread-Topic: [PATCH v3 8/9] vfio-user: vfio_user_device_io_set_irqs: prevent buffer overflow Thread-Index: AQHdGQw6PB1Wh1SdGkyrkEtghAsWtA== Date: Tue, 21 Jul 2026 12:27:00 +0000 Message-ID: <20260721122643.30985-9-thanos.makatos@nutanix.com> References: <20260720135823.21070-1-thanos.makatos@nutanix.com> <20260721122643.30985-1-thanos.makatos@nutanix.com> In-Reply-To: <20260721122643.30985-1-thanos.makatos@nutanix.com> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-publictraffictype: Email x-ms-traffictypediagnostic: IA0PR02MB9462:EE_|DS0PR02MB10249:EE_ x-ms-office365-filtering-correlation-id: 76b4e46c-0123-4aa6-a467-08dee7235d67 x-proofpoint-crosstenant: true x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; ARA:13230040|376014|23010399003|366016|1800799024|38070700021|22082099003|18002099003|56012099006|4143699003|10067099003; x-microsoft-antispam-message-info: jAh3oMUbZCjDDxtW2jnA9NG5VxkpKifTE4geaWbCWrq3lphq6q9OyYxF+RBei85DaXaAy8ovdgKRsdOLHzD8pqIwTOyNSgpeuTv6tBHa7C1m0jqpZzgfVUVWw2IISwPsm+15y1wio31eHEsYR3nVRvrlVSBbL3Dbo7TqDMH73zME5Zl9RP/v+yr4UNr9yFvvFHNwhCX/zUS7z69W4SvSF7kJGUxJ2DYew4Do2LWUvVNnPsOGb7QRx+OrRFGJ9D0JG5C8efg8Ehn6XJ14lzm9bClqlO7pkU8SG3lmQjSTcDDcMlxEXmqYw+Lqa2ON/NYbUefX5a0vESGKwsq++/fIjROMbpQFsJDbVPBc9ZQ465EXocHSCmzFPZS/oZHSUYQyqAlQ6IjXxeZsYCHEi3FsirKhUYDpI/F/h/cF9xN8zzo8BVLnYmOjVdkY4Vzet9auLfhMtN45rOagxMCEwgPXT0PXmhPLaFgFE8KdiUq17OL7CbfSRrikoj4wlrB/xJSl+d/HpyRCDXN5jBfwX6cXBIpawBWre8GvA652ezPpyaxOAoNzhC4RTVRXohYt2N+VPU/ecFbmFxecEjIcwuW/oyLbJlC5VlYLh14/8XdmIB6Z5pisSTNvTtWogYuGCXhvJQbrjMwCeivzC0ew6QaZPo9uJDbAyESMIYfuPsbvDd6xFFMNqL/X8TZNUAdwMPmaAtTjI3sU4aoh8s/qa3i6gm+8esU9XMu/csQ9IQYSrSo= x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:IA0PR02MB9462.namprd02.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230040)(376014)(23010399003)(366016)(1800799024)(38070700021)(22082099003)(18002099003)(56012099006)(4143699003)(10067099003); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?iso-8859-1?Q?Vuo3gkJaeN1Gxlm+QWja1R3KDnPFJttOxV78Ntw+e6BleA1tQ96ZVNLyaA?= =?iso-8859-1?Q?RFZohoIefkkeZS4aUzheS2n7ybYESnU1nXbKMLKbRydQ9ZUWlLZl70KpTM?= =?iso-8859-1?Q?q+OBQ/u1konEg5Tju3pKejaclDk/3RCjpr7TjzFx3llu4tP393zCNyrU9B?= =?iso-8859-1?Q?7CUz3xOOybktdGsMq2jkFBqQhmmbNvk/U+97pTwPL/kMZO+pWilvNBi3Lb?= =?iso-8859-1?Q?bPXTbxMggrpa3eegzTc0dr+/YMeA0UonBrSIQIXvyT+dMY9/QRvWFt7Chc?= =?iso-8859-1?Q?fX2xCTcpKA+C2b8y3mY9jdYhGxY+vhFGtHORqwznJXlb7vNZe1d9TdgoEl?= =?iso-8859-1?Q?blOUGv9iiQZZ3i5DPGHPQhONYNQk6an+1vvF3YLok4ogcKmsnQ9+S+5mcc?= =?iso-8859-1?Q?I3/Hqs7mqOVBNj/ZGucWMNGchhzqwPBnnSMj2LLdz/aYO9smje9vbrF0mz?= =?iso-8859-1?Q?Hf+0JFFLFuoXXcX3tYnJXSsnNOdQabRkW/2m0b9RvZvaEpFX4S5GPoNFRu?= =?iso-8859-1?Q?R9FSVbJoXpGxoUkwaOPeIxqW2vXObaYVdVtMzAtq2/3/IXe3RYtWl7Td3e?= =?iso-8859-1?Q?U9kV0z27t3MsfUZdbAV+u+ecApSWLTheTeUAnhbKz5vsJ9UhP6+pizz+0L?= =?iso-8859-1?Q?GEpg3is6c+WHn39L+8zHtu4AcGyd72DO6eqgbGTfQNi1p6aWLU3JPLNp6f?= =?iso-8859-1?Q?5MFOF4csV/rvl3zuq478gJb0qZWGAE+akFeVKV66zjKyETyET07eC46GAX?= =?iso-8859-1?Q?wyr/GpX4Go8NC1V6xZnwJ725R5bSVV7BCAB4xfrImuSz3NKoOQVC5Ifcq+?= =?iso-8859-1?Q?Iw3rX93Rxxypx/isbFlQZAhHIjaXk6XvsiGD2m8DIHpsJC6x3C+nEDEK6E?= =?iso-8859-1?Q?NI0Q907bBGCXwg2sgZZSYH5t3nfCMihOxC3bKjKN4urKOJY+T2FBZDLUmE?= =?iso-8859-1?Q?phZpKu/6zjlDgD8jd+ohg1kJ3DIfhdmqB7H/88+CoomjX6CeCbybkRnqYD?= =?iso-8859-1?Q?eEjTMITTHwBoaSh/BAqhHtdqFlvqlZ1ByQiPH7boNpRAASrDYrajDNftwi?= =?iso-8859-1?Q?rMymWgx1mDkDCQrlv9GjtiJvBnIVBP+miul4UyU5F6vXqCIX8CD0NFsxV3?= =?iso-8859-1?Q?3HeFVyyN3KR1ybHbT9t10tKSKclSv0MQj5hoe9xczyNChEvSBME+IuiCRO?= =?iso-8859-1?Q?tcfjI5vstAJq4/7WiUjQRRNAEDvtNMn3Qnw2LnEK7Ei3g3Inx7aHnhJfZQ?= =?iso-8859-1?Q?MTbTlD1Dgao8BNQ4nPf9EncQaQVrTwm7BUHvR+k83Gh0qSCIYBwMJ/Bhl6?= =?iso-8859-1?Q?tamT18YJLmA/iDYwjDoFq1s6BxF12K69hQEg2j4dxKOoBINVmfuzC8Sis2?= =?iso-8859-1?Q?iJvYOstW4gOAHziqJKd/f7jOC/RuxD1xOUSGxXXxqkeCGTZCu8Q2q3WehM?= =?iso-8859-1?Q?uwnktWSRmFhbODjquZuAX/Xr7CUJrA7Xeb3+ifyPro5yOJLhnomNXPsEAb?= =?iso-8859-1?Q?Q8R0+aZgMj2+dwyeiQ5uu9asrPsmsmPrZuqhmkmTEswtDrngbClNZ6LM8e?= =?iso-8859-1?Q?m01At/JKH121HOvFZzEtIVtCpe+EIc2GR4VcAbtss+3FILUo6manK5HVEk?= =?iso-8859-1?Q?IbciHf+6WY1zmuVjbb/VWdYMCRQnAr4rcMb1TaHAN+7jgKKw+9ceSk878u?= =?iso-8859-1?Q?lcW5zjxXetbn9zpfFF8N6wf1sVuf+S/8ZsoaymNxw7b6nolRQYw70pX2nI?= =?iso-8859-1?Q?1L8LwftjQ1+LEeZU8THSFeEIKS2Xs4k2SEzB8nrxx1zd2SUsU1hqoh4HRD?= =?iso-8859-1?Q?MYS5njOVhVluLJjYjuKchl6pPEEK9X8=3D?= Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Exchange-RoutingPolicyChecked: g6+XdAUTIvfHKxeNYqw07ko+EqcRrvOhtDoDVX8XHAUClc+tKBjuJZsPOm9Dk+RKUpygg4JCwlkmEar8B+DoQi8sj3bi7hQa+mR2EwPTR4G+vfNW3hnxE4cD75DpAk/sVAIyebSJ2CR3Zuz/B3V5NHqoSjdA1kY53k1+9xECUbJZhTlJaXvJ2WNj6t+9O7pzLp6+mqeD/o3JTFju5ydyspRtlHUsWWcEPdglTesyfwRZBATq2gfTAKKg1FVUopbBTwW9YiBVsH6oBkZmCrvv6VEROhUSkECkPpwUJpXNxozrsKqmY1a6glk4UtlE/kLkroOXt+HykO/X7Gwr53O6fg== X-OriginatorOrg: nutanix.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: IA0PR02MB9462.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 76b4e46c-0123-4aa6-a467-08dee7235d67 X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Jul 2026 12:27:00.9104 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: bb047546-786f-4de1-bd75-24e5b6f79043 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: +bYHLXTjR0ej8zsfhd0WE9D2H3ZyBeEyWIYfMeOuVqr1dYe3Tru4CAVSFjUhmmRNgwJmqKNmU8regNoRUqamfDtt7DoPjnnJOxzCdUkgRdI= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS0PR02MB10249 X-Proofpoint-GUID: DgWjgiCXMDLp6VgudI5aShlNSvHeozyf X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIxMDEzMiBTYWx0ZWRfXzAIwybAw0Kwp aaBW6sFDWzW0QEiO3617dkPLPufMcKTI9Wn0+AOyhhNLtJbhXw83PlA4wqVJ5ULz4GZ4gdbYasH MdXblFCtJy1ODjCHQzC1aXz/iLQsLMo= X-Proofpoint-ORIG-GUID: DgWjgiCXMDLp6VgudI5aShlNSvHeozyf X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIxMDEzMiBTYWx0ZWRfX77Q9YQKxZhfl 3P8VMVjJDWDVIteXz5x7WN/6HqdELGdlw8HAFIWq9M3AdE4FkTtgqfkj8W99+2PFD605fwyp8EK 5CNhGEyAKzc9/UXwnfpk06IVEKZJy3nENOuPqvyCa9jYGGYD7S+pijeKzMRKiumObfxuh/MMn30 1es1bZ1EC+rn+q3/4rEgxhjGBHlWPJVt5Hi5vtl4SsyxCAzVl4QOtgek3fnQVjxL3xNrPsV7Rtt /xPEdobIeUceLEr8y9KQSMsOiDubGT/4tM+FXF3v0DN2MI4iWDKjKJQ/Fm+12D9+3nX2Szn3L5a NZOM1MlkyfsY8wFusRoxZ5zKgmgmdrxHNkanZvWLQsrHCloGwLdXyOKC2e8Wr5ZqIyj1Vm/Ag2y zyXrk9omQQ1CA10nIRQmBWaQZ52P5o8/40v10jnzwJit6nmS9irdSRhVyGqvPS5+utGusI/TFL5 sKC7FPv0imxn3MtFBeA== X-Authority-Analysis: v=2.4 cv=Itgutr/g c=1 sm=1 tr=0 ts=6a5f6597 cx=c_pps a=b2ykEmuCBAXBKoHv9pAjeQ==:117 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=8nJEP1OIZ-IA:10 a=RAioF0-LDSMA:10 a=0kUYKlekyDsA:10 a=VkNPw1HP01LnGYTKEx00:22 a=VofLwUrZ8Iiv6rRUPXIb:22 a=jxMXjlTPpCISP5mWtjnE:22 a=64Cc0HZtAAAA:8 a=3Gl3HxEscEPlAirTM4IA:9 a=wPNLvfGTeEIA:10 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-21_01,2026-07-20_03,2025-10-01_01 X-Proofpoint-Spam-Reason: safe Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.155.12; envelope-from=thanos.makatos@nutanix.com; helo=mx0b-002c1b01.pphosted.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @nutanix.com) X-ZM-MESSAGEID: 1784636849608158500 Content-Type: text/plain; charset="utf-8" This isn't in practise a problem since irq->argsz is not externally provided, it's a good hardening step nonetheless. Fixes: ca1add1696 ("vfio-user: implement VFIO_USER_DEVICE_GET/SET_IRQ*") Signed-off-by: Thanos Makatos Reviewed-by: C=C3=A9dric Le Goater --- hw/vfio-user/device.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/hw/vfio-user/device.c b/hw/vfio-user/device.c index 8feaa56875..daac0e21b6 100644 --- a/hw/vfio-user/device.c +++ b/hw/vfio-user/device.c @@ -293,7 +293,10 @@ static int vfio_user_device_io_set_irqs(VFIODevice *vb= asedev, * Handle simple case */ if ((irq->flags & VFIO_IRQ_SET_DATA_EVENTFD) =3D=3D 0) { - size =3D sizeof(VFIOUserHdr) + irq->argsz; + if (__builtin_add_overflow(irq->argsz, sizeof(VFIOUserHdr), &size)= ) { + error_printf("vfio_user_set_irqs argsz too large\n"); + return -E2BIG; + } msgp =3D g_malloc0(size); =20 vfio_user_request_msg(&msgp->hdr, VFIO_USER_DEVICE_SET_IRQS, size,= 0); --=20 2.34.1 From nobody Sat Jul 25 09:37:54 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass(p=none dis=none) header.from=nutanix.com ARC-Seal: i=2; a=rsa-sha256; t=1784636851; cv=pass; d=zohomail.com; s=zohoarc; b=OjPkGls2j7T5U0a4l1hHZpOW1pjdAOHesIFXU/KDwVha85Fg4jpM2fEJmbNi+V02NYvV3XHRbh9v/5w2YmWbT0+LnzX+dZrrRvwHFqrH3wD4GBEG4jA1W3UoG1G75Qi98tWuy8AUi9VzSUMQZsBibjthiJOYTCLK1GjIvOfq2g4= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1784636851; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=800TbBM7CSnykyjkOLAbVq2c53OfVHHyUJiDplMTnE0=; b=ie0QSijl4PeaOGW0lQSwSWDqkBLY2qPGpYA/UqFcsZd/EVdv55HWKZmCzeN7utC/I1Sgnl711XqkyPrI8VP5JsHFFYNRzzkfdJ3vOF7ytmHN9R43DG1N6HOZXZwLrXlRreQ4T20xPanDKVVDWrbT1PBA40V8JYkmNe2Vs1mJA/8= ARC-Authentication-Results: i=2; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1784636851242378.066746060589; Tue, 21 Jul 2026 05:27:31 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wm9Yy-0008BM-G0; Tue, 21 Jul 2026 08:27:08 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wm9Yx-0008AM-Eq for qemu-devel@nongnu.org; Tue, 21 Jul 2026 08:27:07 -0400 Received: from mx0b-002c1b01.pphosted.com ([148.163.155.12]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wm9Yv-0004nT-Du for qemu-devel@nongnu.org; Tue, 21 Jul 2026 08:27:07 -0400 Received: from pps.filterd (m0127841.ppops.net [127.0.0.1]) by mx0b-002c1b01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66LAR8p33215302; Tue, 21 Jul 2026 05:27:04 -0700 Received: from co1pr03cu002.outbound.protection.outlook.com (mail-westus2azon11020105.outbound.protection.outlook.com [52.101.46.105]) by mx0b-002c1b01.pphosted.com (PPS) with ESMTPS id 4fg8eeebs7-2 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Tue, 21 Jul 2026 05:27:04 -0700 (PDT) Received: from IA0PR02MB9462.namprd02.prod.outlook.com (2603:10b6:208:406::6) by DS0PR02MB10249.namprd02.prod.outlook.com (2603:10b6:8:1a1::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.18; Tue, 21 Jul 2026 12:27:02 +0000 Received: from IA0PR02MB9462.namprd02.prod.outlook.com ([fe80::c493:aabb:b834:f53d]) by IA0PR02MB9462.namprd02.prod.outlook.com ([fe80::c493:aabb:b834:f53d%7]) with mapi id 15.21.0245.009; Tue, 21 Jul 2026 12:27:02 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s= proofpoint20171006; bh=800TbBM7CSnykyjkOLAbVq2c53OfVHHyUJiDplMTn E0=; b=OGPjsAJOj4QjNWO9CrsAV0pIiZavgyXj4gQXxeY9ge9K2xspFj23utvO2 0uyLz3WCctAfbWyuaFSC2PPctQqXT6xfejRJs6QX3fdfCzEDaA+/dtVM7u9vWa5y F4/zJA+OnQab/dWQtm44ZWQJ2/Gb4ItVctxv5NIvhBA9cWAG5Cjw+TonVTtn9whF /Mp2je6M0JeucJRbLK8ZlaTzvM00gHMN/k4FzS0maTv8DewnKR3V192ToU7LmQZx zsAiflK0Fw9akJin1HdfbFqJWZzu29rRQRBJi6q/cwJRc+YucP0wSliPMT6PPVWv jP5biOaITLeZ7GSOvE3mXV3v1uX1w== ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=dyH63oNKTpMzeoJ3oX/jo9Bb5lkm832yQpkOFBbMWkqZQuBLgt0s8S1E7I+srdfQDHym2hyZVDhw3d1t3aew8AXOa9O/bj/Ge80cetU0WIB791GFTNMYT/tNZa2nx48bqj+JKsIp2QJpBQxotQnsSFg6rq5oZXk8dWYsUC3HBvM0zrDOIa8D5n81YigfFyvFn+ZjMM4q7ls9rSyXEZ9ia7xhc7S+Rn8a2kc222JzAnuxJVhbUCz2Mdh/dDOSuwmovTjsIlaWKHObOk5HMQIx7uK8HBeL2lxSRKbP+UUoM4UGZh5BbyALvK/aWJx0X3gIiRcJvrNY8novbRIkwyb+qg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=800TbBM7CSnykyjkOLAbVq2c53OfVHHyUJiDplMTnE0=; b=GRRIMYkQGvbgAGLVsxFcKLjyBqKNs1UmrkDwSf7xgPLeV9MBvAfp+aiBrx4rDl2l4xUSNaf6gCDMwSWQ3yMHm/dcxObyfLSHF9tg11a4NjPemz0SkOL/pJix1YNmIq1Var0ArDIRMOo6mHmcs3LSnsvZa1+QqzF1JyWZ5134sBsZpDpShBpQTlz09X+J8cR0W3rEbw3i2OXDyZ6xQiG+xtTz4mQubmIG0t+Z7+AXwKTSKBGU+CncRADrhKcAkWk1s7PMJF7KeCnv6KuxbnA/W8eyvH8xOd5E8y0mJHiOuobGutD9D1/P7Af2JBg43mwEe1Kf5HVshb4O+yyQqTtSuw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nutanix.com; dmarc=pass action=none header.from=nutanix.com; dkim=pass header.d=nutanix.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=800TbBM7CSnykyjkOLAbVq2c53OfVHHyUJiDplMTnE0=; b=jgJlYuNTOb5jxpIx+01Wavfuszc2ovUtjxnRuhrCX9vWVsqHwfH44nBkCrmQbXZ/FN1BsHk/hY04h8+Gp/FMlwRj9VP/j/8UC4CRnUfGVUNIp+P7NR8A+GYN5mCpUftCpIzwAAV8YVu424pFuM0WUO7DJGAzhIPHUv6FJ5IJNVSu5dCFjNuuN/l2XxBbnsvmxbO74yRRAzW3tiWbRWEwSR3NQtiR1BhAEmIcWCdhV+thwlwwCNqB+jhjvzxktbdmZ1oRxPWScynJ9tYzZn80qme++TO3SEwJ5SMs1JqK+iavzcf2ZK/yjk+7w0Y91DtXCkJ041G5lNfVla1/Lsl6xA== From: Thanos Makatos To: "qemu-devel@nongnu.org" CC: John Levon , "clg@redhat.com" , Thanos Makatos Subject: [PATCH v3 9/9] vfio-user: vfio_user_device_io_set_irqs: prevent excessive malloc Thread-Topic: [PATCH v3 9/9] vfio-user: vfio_user_device_io_set_irqs: prevent excessive malloc Thread-Index: AQHdGQw7F4mwznNxzkKj/3V1FBz9yg== Date: Tue, 21 Jul 2026 12:27:02 +0000 Message-ID: <20260721122643.30985-10-thanos.makatos@nutanix.com> References: <20260720135823.21070-1-thanos.makatos@nutanix.com> <20260721122643.30985-1-thanos.makatos@nutanix.com> In-Reply-To: <20260721122643.30985-1-thanos.makatos@nutanix.com> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-publictraffictype: Email x-ms-traffictypediagnostic: IA0PR02MB9462:EE_|DS0PR02MB10249:EE_ x-ms-office365-filtering-correlation-id: 0c7ed4e9-f192-4146-248e-08dee7235e5a x-proofpoint-crosstenant: true x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; ARA:13230040|376014|23010399003|366016|1800799024|38070700021|22082099003|18002099003|56012099006|4143699003|10067099003; x-microsoft-antispam-message-info: O5g79+rpsNyvod5YKJEDmQuqQGQJxAdybCQKwEJInVwvrPa5oN0RspP4nz7mtwCoHnL6RHPXcstIT3YJ7J8kZ/1rZ18R3hF8bZnM2SqZ2DtFMBcj6ov3kwvRboCNjRp466kbQo9igv62Skew89oanVZk4rMoJ79MJiBcyDEk7Wy3ay1fKSq9IdxSH+rJ64xAbs7xIUrqXKgvBqBpC8LMGr5uCAmHBLsaC/5PGnTEO58TZMDd0tiOCvgpn1eVEzLe2oCtnUZIVNhGx+pF4YqgxnWvmYM15+QaX5U5BPQzIltWh4YfczBF8B5NT/Nl40Dn5kU17w231MwP0y/I9RvSf8wLP+utSoqUXCv5ieAcqMtBgwpa1lAg0/6TEyoKviRv0r82MDQ5YBPl+zEvTBChaLaFGcwauh9jpGHnfV/7w4845MtDPLtj1DP3YKzLk1+9ky+HbAzpH9+B5y3DzGcX1YwJC5O0ApMY5wyejr57/TiEov/Vr6Iafae4jiaC61IqD4lvrJHQg2+EINcZvKJtZTaQnDbKUtBExVuHzv98rrofHWUGHsGf7Crk0Py0O0QEPCuOWVp6CakGA8XOS/fvlLBZB8efk40rTdDieMoAJMWVG564xwp9riByPd5e0OydoHrKAsDr5YdZTqTnPmkWNu8svC9+CFe7XnSl/uHOBAec1IoIgIvN/1cVRpqTFngmwzwhsjwrmhFx6j0A6cFL1RAb2PoL1MYkVXiVWiKv6Fw= x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:IA0PR02MB9462.namprd02.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230040)(376014)(23010399003)(366016)(1800799024)(38070700021)(22082099003)(18002099003)(56012099006)(4143699003)(10067099003); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?iso-8859-1?Q?rN/og+D12bVujjQcE5xkgHzQAKMaCJZ4wUj5/EGTxYqwiyNMcyetnEABwJ?= =?iso-8859-1?Q?v3MOB9bRgr5x3mzLd3XjWwsGi9srMklQEAnTRX3W6GbkrN0IclHnSQqavG?= =?iso-8859-1?Q?vSueV0XXmDMOgsphHIWOeUwQJs0xxxDgz9sSoRF513RHjxp6byGZanAcNU?= =?iso-8859-1?Q?ERF3My87RRWTb/FiGXXWmuQpMK/UBD+jp0pZkgiScFSH9jvayP4eU4zM29?= =?iso-8859-1?Q?hYZk1Wt0tJPgjvfvQYVzNkw0f4VDV2hK9P/cwNG+HGmD5NntFyFj5q+w0R?= =?iso-8859-1?Q?83jyXZnY5pjfarhX1qkl5KgLJhOjZEWC46WM42AfAFkITdJHv5GseLreQk?= =?iso-8859-1?Q?/Lmqd57He1CIcnqwTWoX722V4oaYGYUwCmwxQ0AOezhRlSOdd28dGk9cjW?= =?iso-8859-1?Q?nv3zCqausGYuimAr5fy8iXKCLmTi889HB/7ew+YMIXDZdvQVZIZ2o0TKEV?= =?iso-8859-1?Q?1gqDZkx0Ah9mb7dd+Evwyd9KBhTD30J7XwFsLzeRIzovu1MwnDKVuP1kuq?= =?iso-8859-1?Q?sgVu8OESFkn//p56AKgoPCeQDHpnxKe7OIJx81t7tFoaS6DVpOAbRv7cB1?= =?iso-8859-1?Q?dql8oWAp8potqE4vSaPP6XOflQ/KWrGmcQTUwdcnZ1lwQ3gh/oYLhgj7U4?= =?iso-8859-1?Q?HWG6OTGFFrEPNjFiaRc84vbftZG4al3/1uSVxT+WcCqsqTac3tnyW4FrE9?= =?iso-8859-1?Q?oeuMGjlfcFuCED0BtlYHUO1omeO5m7kLkXVfXLEfxygRt69eVPtzgsnHnm?= =?iso-8859-1?Q?GsFoXRAxS434dQQdOZVfaP3MQrk9doGNEAHwVOjEZ4SuC+hBFKnIKRyAYs?= =?iso-8859-1?Q?c5HJd3/IVb7F9eurC1SL3Ts0w/lJIlolWYwdiXRU6FFJhsv9pP826UHjVt?= =?iso-8859-1?Q?e5//XLmMnnyxRg0Qt/q4N04f2sicsYgJUi4Dh2NVn6G6GMY4o1k4werPOK?= =?iso-8859-1?Q?mFhDFhEiYgmK2/voZzygzDvARWBrzR/m2xB4QkuzjzgCaQDvNE3uRokYqz?= =?iso-8859-1?Q?IXM06fg2qBvhh43aL6se2AeFbHkEXrRfpWffqlcwXpMYtirNg/35GFpB/1?= =?iso-8859-1?Q?nXxGi3kCoPBQVEipl1y+WDuhGHU5TMj9y/FpbyITccqfmmbwVCfI0AGePe?= =?iso-8859-1?Q?MbTjj9zuREeSMitV8/1dNajxb0gSYD2RWon8FYVWsbnqY1QIEWx4BhlF3V?= =?iso-8859-1?Q?rRqG6iYz9Pc2vaK0LOj9+N7HTKtDs45hhz6ve79x9afJYeXwY/Sx2ywYof?= =?iso-8859-1?Q?/kovJvR+BqqKl3ZWbxOkaMSjN6sRewCUsmK8Ia7rYWhLhillElvtmPHt72?= =?iso-8859-1?Q?qCh4tJ2aWnvYa2dCD60/XdyiRLSonm4ePTcTQlDQcuZ3NSznISO0Xq+eTh?= =?iso-8859-1?Q?gBgVx4KqQs7s7R4AtNdNlLsOOTBpGqWxqpqs8crlxeoj1Jb7MwATVu8+CK?= =?iso-8859-1?Q?9qNV+I3Bkk/4La1zHwv5i9ip9Va+HarvfAK/pyv4fKypNBQnWRGqVmbrjo?= =?iso-8859-1?Q?YuXje8eZxZATIRyJd/HYYPr86prBLn/fSOZgsv1q8Rnkk0pJ3NZJ8cwic/?= =?iso-8859-1?Q?xX3c+UV8Ff4+ybN56VOSx2b/zIxVFRe9CE4F6+5KrP5R4tWxRxc1OeVFqJ?= =?iso-8859-1?Q?94FFzNxaFYvo9VaMWK96H7g2cZoFYtcmGLykNupblulWMHDoQJv6x5hAUX?= =?iso-8859-1?Q?pq61bUvEDcWaOWiRL9pG4bsHEO/UqVg8THrtxi+0qx0hSsxuRZRnI+ivgz?= =?iso-8859-1?Q?C+X7J47NhBIyFoTt6zE0klJGtmgk86KTknPIHVEWBBtZPfY4gsa+d+o1J9?= =?iso-8859-1?Q?jgsdib9smfNbhdRSm+yW3pHVm20Veek=3D?= Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Exchange-RoutingPolicyChecked: LU//bgMLk0VFgUO3YE2unUM8aSqi1EMFVYox2ucTdaxa78u8B3BLp72ZbBR/1r5YDX1SsCAdVF8TC9mpXuqMAoTo5t5YUv5AL/TvbciweECyQwJvoNDluiiZWGPQyp8pKzj4lFZ29L/FUpsXFhXw6CHX1BsSUYOteho5GZC/49ha/4etxvxD+GzwhMB14kPDJimLQCpS+tTIUOVQa8OotfyyuXAEsrWRBPhnJp/9hRQcW6EwGAFxOjKNHKVJfszXjtkJTZ3cLe8eptQ1nRmw1RMWzUDUrk209veZxjGFu9SChrFrDiGRyAAUgOq3kzb1GPWxk/3Zsz+YGFiKuBgYEg== X-OriginatorOrg: nutanix.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: IA0PR02MB9462.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 0c7ed4e9-f192-4146-248e-08dee7235e5a X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Jul 2026 12:27:02.4889 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: bb047546-786f-4de1-bd75-24e5b6f79043 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: WdWCSlommNx1fwwOZEEcqipNr0EHQEFFQizUGAnAyjo/Qb28HLs3c5DNLChFfjbc0mrGyaDCo9ah76kaEQWqW5YqCE1Uden+PkOUCP8lkqI= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS0PR02MB10249 X-Proofpoint-GUID: uHF8CsQA_rj3MCYmtrpWq69aM5wJOc7d X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIxMDEzMiBTYWx0ZWRfX5v9t8L+7SCbM SWcSnwYjEQ77p+3fHHgPEYaR9j33fO3fIXAlN3W/7IMawez+APpKBpuQx6cie0GL1PM/ieVo0Mh FaRhTjp6jdkuw++vk7GFfQaIWhZKAlA= X-Proofpoint-ORIG-GUID: uHF8CsQA_rj3MCYmtrpWq69aM5wJOc7d X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIxMDEzMiBTYWx0ZWRfX7JQmUcaY41Yw Gv8IAzp/InAAXQYFSf1rRReBUnDm/39L6wC8zSY3CTDE05yHu2GuKtYWSWvkol+Tmo4pGK9/Pii eT6AcUwJ0F3+OzM1HwoQVC4R6mdvMlP8GZUbCDkXW8ELNq6s++dHv01MmbC0jPV9XDRb0+US4r2 /P9+M9zfhja2jrxXNrB+n31VP9jqInHzQDMh6Sir1OszaxhhKXLjigfbndxt+GIRmvoi/elzCRB 2odZF8u/mB+aQFrkl8UcibEqksg54URntD3wUYYrKA6saUE2VdHSumkafhpV2H1Iy6d0/4rkhML 0zU/9OK9MEC9uNkaAcT708MeSTbzxRLdM+L7IZKed9FC68gfMX5TsFAD+lX9cmWihKQKEcdgQM9 7oGHOCtMZd1d6Him321KuIzFEl+RzAABsquS0iNmv+d460ZbeqrHV1C8wzrdPqwUXCtl136nSRM 6giGRt12H4oJdzbnUfQ== X-Authority-Analysis: v=2.4 cv=Itgutr/g c=1 sm=1 tr=0 ts=6a5f6598 cx=c_pps a=b2ykEmuCBAXBKoHv9pAjeQ==:117 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=8nJEP1OIZ-IA:10 a=RAioF0-LDSMA:10 a=0kUYKlekyDsA:10 a=VkNPw1HP01LnGYTKEx00:22 a=VofLwUrZ8Iiv6rRUPXIb:22 a=jxMXjlTPpCISP5mWtjnE:22 a=64Cc0HZtAAAA:8 a=QaGxouVv4pGw2sT49KQA:9 a=wPNLvfGTeEIA:10 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-21_01,2026-07-20_03,2025-10-01_01 X-Proofpoint-Spam-Reason: safe Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.155.12; envelope-from=thanos.makatos@nutanix.com; helo=mx0b-002c1b01.pphosted.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @nutanix.com) X-ZM-MESSAGEID: 1784636851555158500 Content-Type: text/plain; charset="utf-8" This isn't in practise a problem since irq->argsz is not externally provided, it's a good hardening step nonetheless. Fixes: ca1add1696 ("vfio-user: implement VFIO_USER_DEVICE_GET/SET_IRQ*") Signed-off-by: Thanos Makatos Reviewed-by: C=C3=A9dric Le Goater --- hw/vfio-user/device.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/hw/vfio-user/device.c b/hw/vfio-user/device.c index daac0e21b6..1a01e748cd 100644 --- a/hw/vfio-user/device.c +++ b/hw/vfio-user/device.c @@ -297,6 +297,11 @@ static int vfio_user_device_io_set_irqs(VFIODevice *vb= asedev, error_printf("vfio_user_set_irqs argsz too large\n"); return -E2BIG; } + if (size > proxy->max_xfer_size) { + error_printf("vfio_user_device_io_set_irqs argsz too large\n"); + return -E2BIG; + } + msgp =3D g_malloc0(size); =20 vfio_user_request_msg(&msgp->hdr, VFIO_USER_DEVICE_SET_IRQS, size,= 0); --=20 2.34.1