vfio-user: vfio_user_get_region_info: prevent excessive malloc
If the vfio-user server responds with a value larger than max_xfer_size vfio_device_get_region_info() blindly uses it in the next loop in g_realloc. An value larger than max_xfer_size is anyway rejected by the check at the beginning of vfio_user_get_region_info(), however that only happens _after_ the g_realloc, and if that value is excessively large it can cause g_realloc to fail, so check it here. Signed-off-by: Thanos Makatos <thanos.makatos@nutanix.com> Fixes: 667866d66620 ("vfio-user: implement VFIO_USER_DEVICE_GET_REGION_INFO") Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20260721122643.30985-5-thanos.makatos@nutanix.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
Thanos Makatos committed
Jul 21, 2026 at 12:26 UTC
6a51aab908e0f043387b91ad6a198b0eae5f2b58
1 file changed
+10
hw/vfio-user/device.c
+10
@@ -170,6 +170,16 @@ static int vfio_user_get_region_info(VFIOUserProxy *proxy,
170
return -EINVAL;
171
}
172
173
+ /*
174
+ * The server can respond with a larger argsz in the reply to request a
175
+ * larger buffer on the next iteration via vfio_device_get_region_info().
176
+ * Reject values that would trigger an oversized realloc.
177
+ */
178
+ if (msgp->argsz > proxy->max_xfer_size) {
179
+ error_printf("vfio_user_get_region_info reply argsz too large\n");
180
+ return -E2BIG;
181
+ }
182
+
183
memcpy(info, &msgp->argsz, info->argsz);
184
185
/*