vfio-user: vfio_user_get_region_info: reject unreasonably short struct
While this isn't technically a bug, it's highly unlikely that the server wouldn't be writing an entire struct. Signed-off-by: Thanos Makatos <thanos.makatos@nutanix.com> Fixes: 667866d66620 ("vfio-user: implement VFIO_USER_DEVICE_GET_REGION_INFO") Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20260721122643.30985-4-thanos.makatos@nutanix.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
Thanos Makatos committed
Jul 21, 2026 at 12:26 UTC
3966a4258b597c7e1a86a65d6a0d15f28a09dca8
1 file changed
+5
hw/vfio-user/device.c
+5
@@ -165,6 +165,11 @@ static int vfio_user_get_region_info(VFIOUserProxy *proxy,
165
}
166
trace_vfio_user_get_region_info(msgp->index, msgp->flags, msgp->size);
167
168
+ if (msgp->argsz < sizeof(*info)) {
169
+ error_printf("vfio_user_get_region_info reply argsz too small\n");
170
+ return -EINVAL;
171
+ }
172
+
173
memcpy(info, &msgp->argsz, info->argsz);
174
175
/*