@samitouri / QOSamiQemu / commits / 665c854390

virtio: fail early on bad config_len in migration

virtio_load() attempts to load config_len bytes from the migration stream. If that's huge (e.g. 4g) this will uselessly spin beyond the end of the stream for seconds. Not nice. Check qemu_file_get_error() and bail out early, instead. Also note that config_len is int32_t but is coerced to unsigned when used. Switch it to uint32_t to make this clearer. Fixes: 2f5732e964 ("Allow mismatched virtio config-len") Cc: Dr. David Alan Gilbert <dave@treblig.org> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3891 Reported-by: Feifan Qian <bea1e@proton.me> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Message-ID: <cfbefa358af5885eb386637216552bfeba5e7bbc.1784898922.git.mst@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dave@treblig.org>

Michael S. Tsirkin committed Jul 8, 2026 at 11:38 UTC 665c854390e0db15ed55b985ca850c36b28b0e57
1 file changed +4 -1
hw/virtio/virtio.c
+4 -1
@@ -3505,7 +3505,7 @@ int coroutine_mixed_fn
3505 virtio_load(VirtIODevice *vdev, QEMUFile *f, int version_id)
3506 {
3507 int i, ret;
3508 - int32_t config_len;
3508 + uint32_t config_len;
3509 uint32_t num;
3510 uint32_t features;
3511 BusState *qbus = qdev_get_parent_bus(DEVICE(vdev));
@@ -3553,6 +3553,9 @@ virtio_load(VirtIODevice *vdev, QEMUFile *f, int version_id)
3553 qemu_get_buffer(f, vdev->config, MIN(config_len, vdev->config_len));
3554
3555 while (config_len > vdev->config_len) {
3556 + if (qemu_file_get_error(f)) {
3557 + return -1;
3558 + }
3559 qemu_get_byte(f);
3560 config_len--;
3561 }