From nobody Sun Jul 26 10:12:23 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1784899170; cv=none; d=zohomail.com; s=zohoarc; b=LJSLNsov25FGcYNIwSO8Il7oiZo4g/38EdUUPOciLXWIW4KcX6B/K+MdG4QNZLu3adNQTnxS+RXLAJtv/jK2pMNvRkYasWrZmv3l5JrxIhls3yMAM/kMSdRHHNXUmNG80XHCt3IVRSBK28NmNo1sp9J42BKRNRvkVvnrLdFPB9A= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1784899170; h=Content-Type:Cc:Cc:Date:Date:From:From:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=gbjiMjNIDI6DRF92WLkFrVuZmZ+VtU+ejaH28Rr8Nes=; b=D4HdrkM5AA6KYFdbsQXg+zga63tzAqj2KDlEdfWuIUvW0M12TXkRw911Nkde8+G92GFKlIShHLdyy0n4/mDDKUbIPRBV5nDpEQr1fYdTmuGS311ptNRvvkf7Y11mqb8CTkNNg1YlL9QfytZHDjAtNzQeLj+oFHmXUEZOz+Xwo7Y= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1784899170022148.12546375222144; Fri, 24 Jul 2026 06:19:30 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wnFo6-0000Hp-7z; Fri, 24 Jul 2026 09:19:18 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wnFny-00006w-IY for qemu-devel@nongnu.org; Fri, 24 Jul 2026 09:19:10 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wnFnw-00054v-QB for qemu-devel@nongnu.org; Fri, 24 Jul 2026 09:19:10 -0400 Received: from mail-wr1-f72.google.com (mail-wr1-f72.google.com [209.85.221.72]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-570-iGTmqT5xPpmhqVD5C6Ncqg-1; Fri, 24 Jul 2026 09:19:06 -0400 Received: by mail-wr1-f72.google.com with SMTP id ffacd0b85a97d-47f753a0aa0so316755f8f.3 for ; Fri, 24 Jul 2026 06:19:06 -0700 (PDT) Received: from redhat.com (IGLD-80-230-37-66.inter.net.il. [80.230.37.66]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4957af9128fsm66572425e9.13.2026.07.24.06.19.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 24 Jul 2026 06:19:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1784899148; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type; bh=gbjiMjNIDI6DRF92WLkFrVuZmZ+VtU+ejaH28Rr8Nes=; b=SjGEfqqOdfdR6MhjhEYVHkl4O4C73/awTxeGXyeUBLnTLWmG/IWQ5bKkzP1KdVB9WXsmqP BVZpVDKkvOf5oM8iP+J8v+IpnqMODlv4IvhBvjSY1frIuRZdo2WKlOqWXLTUe0Sd2/mpKV cokqwDOOBoeKl0l4/1dzY39ihSzrWoc= X-MC-Unique: iGTmqT5xPpmhqVD5C6Ncqg-1 X-Mimecast-MFC-AGG-ID: iGTmqT5xPpmhqVD5C6Ncqg_1784899145 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1784899145; x=1785503945; darn=nongnu.org; h=content-disposition:content-type:mime-version:message-id:subject:cc :to:from:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=gbjiMjNIDI6DRF92WLkFrVuZmZ+VtU+ejaH28Rr8Nes=; b=f+bLjDp1llucgE/UJQFTqXWO+8bFYqk0Mh0NEZ75mV6UDjs09U/VAKKdUVCIzJeg2S EYSfPOvfyEP3Q6q+vxEztbVYYEPRrduwAFbLBTcnanPakcYftsepdQYF1TDxpxaKV6ns RNOcxGN/Bn/5DTdMTozMBrWc+G+ShWu7sy28j3AUl6H+oHnn8gVzmM0VFWeT+tdFZ6w/ 5Dr7wWcu+Y+sSfvullXvV6iObXKQtoijJf3ed24S45XdcQLdFpTuuDUyKmyqmNBG5icO SyyOjvNqPFkaaNR3TCWoYtcfU+QqeCryYw4R4Fozvsobd9X+mEQwaQYBrNkx6d4HgILM 5RLg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784899145; x=1785503945; h=content-disposition:content-type:mime-version:message-id:subject:cc :to:from:date:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=gbjiMjNIDI6DRF92WLkFrVuZmZ+VtU+ejaH28Rr8Nes=; b=jINw6Lf6VbXyA46hjMKYZhEbjy9cbb/5Ubag6JLDEzun1X0qlZuXUwWxgs9AkdxUkd mm5nJbT6y/DeyxriU+yi1ZV3ruM+0XfwyzPmcic2Ij/ktMpq7ZvSVkNqp18KJYLCUdci cUwO+RrVNgbG0sUVZGeK8zP8HTuprKYFWLbSzpo1GhtFUjaoaS8lPKofFE2JUNFTKW0V e9bJC9lHkmLRL5EbLkdipJ1aEuA4904ZY7+zSBtrTayR6jKMF4l3AcamBmWpnxhSm8P3 IPoc9zaaOg0a222nUw7RIGNdBebUoFqp076DA2mCvqFFAzbOCHpYI/dNanlLxL6GWqgm nkEw== X-Gm-Message-State: AOJu0YwA8Dn8zf3hB55nnk2zSx22BUFuRrjHxXSRSpgxOU/oRY2wg/ij jWTvzQ9lSBqNNVrCudB/oCYoV2zWJjb8D7ezYQehQoH1+YWjU+PYbI11PG/pNf1E/OwYeeRJkTQ 2fvqlrUXwoYmHB7k7vxFaIf6ZBN76vMzFc6QjSh2PLDxN1iEq++5z7YzVqycZD0UYWjrxB87Rq3 zoBFRi9JnIrciZAIm+B9dS4RrGG3TfNI1MoA== X-Gm-Gg: AR+sD11aoSeYK6teEOW25HXJvvUzQxObJTyXtaHSgKhm0v4M1hsKGtbu99vLEX6fagS zTPPgLqIvlFSGOEvo4KzlPFv5iV5P3Y3ONGvtn7cVI0AbUtI0uZv0dqd3NEqFgBqFxw4CcHaH+z 3Fm5PtzeRD0aMi/ETY5G9e17335hoRKAMDqcsy69HVmPQVlf+/RPib75TY3C1t5sPhtkWnf4B9T l/wxFG62cyPlUwhkCmYme7Yg8pShAGMsljGp1FjkPxjxAeawi07aIQVrxXR3am1su96UoymnFXc KMObB9WyMTs5AAEzrGIclOAaPeum7TWXpRAF2DToqFu2DN6j7oDcu1N66sTNBWHv5soAKKPRhzx Y8d4zX5jBbCLwmPe2hL5FiA== X-Received: by 2002:a05:600c:1914:b0:495:5e86:4e59 with SMTP id 5b1f17b1804b1-49573cf6226mr87809755e9.22.1784899145155; Fri, 24 Jul 2026 06:19:05 -0700 (PDT) X-Received: by 2002:a05:600c:1914:b0:495:5e86:4e59 with SMTP id 5b1f17b1804b1-49573cf6226mr87809195e9.22.1784899144520; Fri, 24 Jul 2026 06:19:04 -0700 (PDT) Date: Fri, 24 Jul 2026 09:19:02 -0400 From: "Michael S. Tsirkin" To: qemu-devel@nongnu.org Cc: Stefano Garzarella Subject: [PATCH] libvhost-user: protect against OOB writes in vu_set_inflight_fd Message-ID: <23b3f12388c1035f208550df9de9944c22d8d534.1784899127.git.mst@redhat.com> MIME-Version: 1.0 Content-Disposition: inline X-Mailer: git-send-email 2.51.2.2891.g4157995a80.dirty X-Mutt-Fcc: =sent Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=mst@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -34 X-Spam_score: -3.5 X-Spam_bar: --- X-Spam_report: (-3.5 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-1.419, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-Zoho-Virus-Status: 1 X-Zoho-AV-Stamp: zmail-av-0.2.10.1.5.2/284.895.97 X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1784899172007158500 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" vu_set_inflight_fd() trusts the num_queues value from the VHOST_USER_SET_INFLIGHT_FD message without checking it against dev->max_queues, so an oversized value causes out-of-bounds writes to dev->vq. Front end is generally trusted so not a security problem, but OOB isn't a nice way to handle frontend bugs. Let's harden this a bit: check num_queues and panic if it's invalid. Fixes: 5f9ff1eff3 ("libvhost-user: Support tracking inflight I/O in shared = memory") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3740 Cc: Stefano Garzarella Signed-off-by: Michael S. Tsirkin --- subprojects/libvhost-user/libvhost-user.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/subprojects/libvhost-user/libvhost-user.c b/subprojects/libvho= st-user/libvhost-user.c index 2c35bddd6f..8208265588 100644 --- a/subprojects/libvhost-user/libvhost-user.c +++ b/subprojects/libvhost-user/libvhost-user.c @@ -1998,6 +1998,8 @@ vu_get_inflight_fd(VuDev *dev, VhostUserMsg *vmsg) =20 if (vmsg->size !=3D sizeof(vmsg->payload.inflight)) { vu_panic(dev, "Invalid get_inflight_fd message:%d", vmsg->size); + vmsg_close_fds(vmsg); + vmsg->fd_num =3D 0; vmsg->payload.inflight.mmap_size =3D 0; return true; } @@ -2005,6 +2007,15 @@ vu_get_inflight_fd(VuDev *dev, VhostUserMsg *vmsg) num_queues =3D vmsg->payload.inflight.num_queues; queue_size =3D vmsg->payload.inflight.queue_size; =20 + if (num_queues > dev->max_queues) { + vu_panic(dev, "Invalid get_inflight_fd num_queues: %"PRId16, + num_queues); + vmsg_close_fds(vmsg); + vmsg->fd_num =3D 0; + vmsg->payload.inflight.mmap_size =3D 0; + return true; + } + DPRINT("set_inflight_fd num_queues: %"PRId16"\n", num_queues); DPRINT("set_inflight_fd queue_size: %"PRId16"\n", queue_size); =20 @@ -2052,6 +2063,7 @@ vu_set_inflight_fd(VuDev *dev, VhostUserMsg *vmsg) vmsg->size !=3D sizeof(vmsg->payload.inflight)) { vu_panic(dev, "Invalid set_inflight_fd message size:%d fds:%d", vmsg->size, vmsg->fd_num); + vmsg_close_fds(vmsg); return false; } =20 @@ -2061,6 +2073,13 @@ vu_set_inflight_fd(VuDev *dev, VhostUserMsg *vmsg) num_queues =3D vmsg->payload.inflight.num_queues; queue_size =3D vmsg->payload.inflight.queue_size; =20 + if (num_queues > dev->max_queues) { + vu_panic(dev, "Invalid set_inflight_fd num_queues: %"PRId16, + num_queues); + close(fd); + return false; + } + DPRINT("set_inflight_fd mmap_size: %"PRId64"\n", mmap_size); DPRINT("set_inflight_fd mmap_offset: %"PRId64"\n", mmap_offset); DPRINT("set_inflight_fd num_queues: %"PRId16"\n", num_queues); @@ -2071,6 +2090,7 @@ vu_set_inflight_fd(VuDev *dev, VhostUserMsg *vmsg) =20 if (rc =3D=3D MAP_FAILED) { vu_panic(dev, "set_inflight_fd mmap error: %s", strerror(errno)); + close(fd); return false; } =20 --=20 MST