> -----Original Message-----
> From: Cédric Le Goater <clg@redhat.com>
> Sent: 21 July 2026 08:04
> To: Thanos Makatos <thanos.makatos@nutanix.com>; qemu-
> devel@nongnu.org
> Cc: John Levon <john.levon@nutanix.com>
> Subject: Re: [PATCH v2 0/6] vfio-user: validate server responses
> 
> !-------------------------------------------------------------------|
>   CAUTION: External Email
> 
> |-------------------------------------------------------------------!
> 
> On 7/20/26 17:55, Cédric Le Goater wrote:
> > Hello Thanos,
> >
> > On 7/20/26 15:58, Thanos Makatos wrote:
> >> This patch series fixes some bugs where the vfio-user client doesn't
> >> properly validate information returned by the vfio-user server.
> >>
> >> Thanos Makatos (6):
> >>    vfio-user: vfio_user_get_region_info: prevent buffer overflow
> >>    vfio-user: vfio_user_get_region_info: respect max_xfer_size
> >>    vfio-user: vfio_user_get_region_info: reject unreasonably short struct
> >>    vfio-user: vfio_user_get_region_info: prevent excessive malloc
> >>    vfio-user: vfio_user_device_io_get_region_info: fix capability check
> >>    vfio-user: vfio_user_device_io_device_feature: prevent buffer overflow
> >>
> >>   hw/vfio-user/device.c | 40
> +++++++++++++++++++++++++++++++++++++---
> >>   1 file changed, 37 insertions(+), 3 deletions(-)
> >>
> >> Changes since v1:
> >> - added 'Resolves:' in patches 1 and 5
> >> - added missing SOB from patch 1
> >> - removed reassignment in patch 1
> >> - added a new patch to address the same issue as in patch 1
> >>
> >
> > Could you please add 'Fixes:' tags ? No need to resend, just
> > reply to the email you sent.
> 
> 
> Patches 1-5 address issues introduced by:
>    667866d66620 ("vfio-user: implement
> VFIO_USER_DEVICE_GET_REGION_INFO")
> 
> Patch 6 addresses an issue introduced by:
>    e2358af5838d ("vfio-user: support VFIO_USER_DEVICE_FEATURE")
> 
> Also, in patch 6, the vfio_user_device_io_device_feature() code does
> 
>    memcpy(feature, &msgp->argsz, feature->argsz)
> 
> without the hardening as done in region_info. That would be a good
> addition.

Added a patch.

> 
> vfio_user_device_io_set_irqs() is vulnerable.

Added two patches.
> 
> I should to send a PR this week. Please tell me if you want plan
> to respin soon. Or I will send v2 and we will address the rest
> later.

No worries I've just sent v3. I can fold all the buffer overflow patches into a single patch and all the excessive malloc patches into a single patch if you prefer, I don't mind either way.

> 
> Thanks,
> 
> C.
>