vfio-user: vfio_user_device_io_get_region_info: fix capability check
The existing check for PCI capabilities misses the case where info->cap_offset == info->argsz, which results in accessing unallocated memory. Fix the comparison. Fixes: 667866d66620 ("vfio-user: implement VFIO_USER_DEVICE_GET_REGION_INFO") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3865 Signed-off-by: Thanos Makatos <thanos.makatos@nutanix.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20260721122643.30985-6-thanos.makatos@nutanix.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
Thanos Makatos committed
Jul 21, 2026 at 12:26 UTC
20b3a363fa8c9a83715d7241ec21e2d516359a1b
1 file changed
+2
-1
hw/vfio-user/device.c
+2
-1
@@ -214,7 +214,8 @@ static int vfio_user_device_io_get_region_info(VFIODevice *vbasedev,
214
215
/* cap_offset in valid area */
216
if ((info->flags & VFIO_REGION_INFO_FLAG_CAPS) &&
217
- (info->cap_offset < sizeof(*info) || info->cap_offset > info->argsz)) {
217
+ (info->cap_offset < sizeof(*info)
218
+ || info->cap_offset + sizeof(struct vfio_info_cap_header) > info->argsz)) {
219
return -EINVAL;
220
}
221