uefi-ref/qemu
1
0
Fork 0
mirror of https://gitlab.com/qemu-project/qemu.git synced 2026-08-26 22:23:12 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

libvduse: validate vq size

Browse source 
libvduse assumes that vq size (aka vq num) is below VIRTQUEUE_MAX_SIZE
and maps logs large enough based on this assumption.

However, vduse_queue_enable() accepts the vq size returned through
VDUSE_VQ_GET_INFO without validation, so a value above
VIRTQUEUE_MAX_SIZE (1024) overruns the inflight log and causes
out-of-bounds writes in vduse_queue_inflight_get().

According to the virtio spec, vq size can only be reduced, not
increased, so vq size must not exceed the previously configured
max_size, but the kernel vduse module does not validate this for us, and
we should not trust another process to follow the spec.

Validate and reject vq size values above VIRTQUEUE_MAX_SIZE.

Fixes: CVE-2026-61402
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3652
Reported-by: Jia Jia <physicalmtea@gmail.com>
Message-ID: <bf7e71b3139875e5e00fd53970c772d6c90dc2a1.1784888961.git.mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
This commit is contained in:
Michael S. Tsirkin 2026-06-24 10:43:46 -04:00
parent b9d248dfac
commit 733a98a552
1 changed files with 5 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
subprojects/libvduse/libvduse.c
View file

@ -902,6 +902,11 @@ static void vduse_queue_enable(VduseVirtq *vq)
return;
}
if (vq_info.num > VIRTQUEUE_MAX_SIZE) {
fprintf(stderr, "vq[%d] vring num %u exceeds max %u\n",
vq->index, vq_info.num, VIRTQUEUE_MAX_SIZE);
return;
}
vq->vring.num = vq_info.num;
vq->vring.desc_addr = vq_info.desc_addr;
vq->vring.avail_addr = vq_info.driver_addr;