@samitouri / QOSamiQemu / commits / 6dbdc271f5

hw/virtio: reject zero-length packed indirect descriptor table

The split-ring path already rejects a zero-length indirect descriptor table since commit 7423192912af ("virtio: add checks for the size of the indirect table"). The packed-ring path is missing the same check, allowing a guest to trigger an assertion in address_space_cache_init() with a packed indirect descriptor that has len=0. Add the same !desc.len check to the packed-ring indirect validation in both virtqueue_packed_get_avail_bytes() and virtqueue_packed_pop(). Fixes: 86044b24e865 ("virtio: basic packed virtqueue support") Cc: jasowangio@gmail.com Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3984 Reported-by: dong ling <dongling226655@outlook.com> Signed-off-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Message-ID: <20260715115040.2186274-1-lvivier@redhat.com>

Laurent Vivier committed Jul 15, 2026 at 13:50 UTC 6dbdc271f56b42e921a662b65a862f503eb4448e

1 file changed +2 -2

hw/virtio/virtio.c

+2 -2

@@ -1475,7 +1475,7 @@ static void virtqueue_packed_get_avail_bytes(VirtQueue *vq,

1475 }

1476

1477 if (desc.flags & VRING_DESC_F_INDIRECT) {

1478 - if (desc.len % sizeof(VRingPackedDesc)) {

1478 + if (!desc.len || (desc.len % sizeof(VRingPackedDesc))) {

1479 virtio_error(vdev, "Invalid size for indirect buffer table");

1480 goto err;

1481 }

@@ -1927,7 +1927,7 @@ static void *virtqueue_packed_pop(VirtQueue *vq, size_t sz)

1927 vring_packed_desc_read(vdev, &desc, desc_cache, i, true);

1928 id = desc.id;

1929 if (desc.flags & VRING_DESC_F_INDIRECT) {

1930 - if (desc.len % sizeof(VRingPackedDesc)) {

1930 + if (!desc.len || (desc.len % sizeof(VRingPackedDesc))) {

1931 virtio_error(vdev, "Invalid size for indirect buffer table");

1932 goto done;

1933 }