@samitouri / QOSamiQemu / commits / 497b5c5b05

vfio-user: reject zero migration page size capability

check_migr_pgsize() validates that no page-size bits smaller than VFIO_USER_DEF_PGSIZE are set, but it still accepts pgsize=0. This can replace the default migration page size with an unusable value. Reject a zero migration page size during version capability parsing, matching the lower-bound check used for the DMA page-size capability. Fixes: 36227628d824 (vfio-user: implement message send infrastructure) Signed-off-by: GuoHan Zhao <zhaoguohan@kylinos.cn> Link: https://lore.kernel.org/qemu-devel/20260522081306.4186242-2-zhaoguohan@kylinos.cn Signed-off-by: Cédric Le Goater <clg@redhat.com>

GuoHan Zhao committed May 22, 2026 at 16:13 UTC 497b5c5b05ac2be00ae16c723e2445ebbc486cb2
1 file changed +5 -3
hw/vfio-user/proxy.c
+5 -3
@@ -1081,9 +1081,11 @@ static bool check_migr_pgsize(VFIOUserProxy *proxy, QObject *qobj, Error **errp)
1081 return false;
1082 }
1083
1084 - /* must be larger than default */
1085 - if (pgsize & (VFIO_USER_DEF_PGSIZE - 1)) {
1086 - error_setg(errp, "pgsize 0x%"PRIx64" too small", pgsize);
1084 + /* must not be zero or smaller than default */
1085 + if (pgsize < VFIO_USER_DEF_PGSIZE ||
1086 + (pgsize & (VFIO_USER_DEF_PGSIZE - 1))) {
1087 + error_setg(errp, "%s 0x%"PRIx64" too small",
1088 + VFIO_USER_CAP_PGSIZE, pgsize);
1089 return false;
1090 }
1091