vfio-user: reject zero migration page size capability
check_migr_pgsize() validates that no page-size bits smaller than VFIO_USER_DEF_PGSIZE are set, but it still accepts pgsize=0. This can replace the default migration page size with an unusable value. Reject a zero migration page size during version capability parsing, matching the lower-bound check used for the DMA page-size capability. Fixes: 36227628d824 (vfio-user: implement message send infrastructure) Signed-off-by: GuoHan Zhao <zhaoguohan@kylinos.cn> Link: https://lore.kernel.org/qemu-devel/20260522081306.4186242-2-zhaoguohan@kylinos.cn Signed-off-by: Cédric Le Goater <clg@redhat.com>
GuoHan Zhao committed
May 22, 2026 at 16:13 UTC
497b5c5b05ac2be00ae16c723e2445ebbc486cb2
1 file changed
+5
-3
hw/vfio-user/proxy.c
+5
-3
@@ -1081,9 +1081,11 @@ static bool check_migr_pgsize(VFIOUserProxy *proxy, QObject *qobj, Error **errp)
1081
return false;
1082
}
1083
1084
- /* must be larger than default */
1085
- if (pgsize & (VFIO_USER_DEF_PGSIZE - 1)) {
1086
- error_setg(errp, "pgsize 0x%"PRIx64" too small", pgsize);
1084
+ /* must not be zero or smaller than default */
1085
+ if (pgsize < VFIO_USER_DEF_PGSIZE ||
1086
+ (pgsize & (VFIO_USER_DEF_PGSIZE - 1))) {
1087
+ error_setg(errp, "%s 0x%"PRIx64" too small",
1088
+ VFIO_USER_CAP_PGSIZE, pgsize);
1089
return false;
1090
}
1091