@samitouri / QOSamiQemu / commits / 70074cc48f

backends/rng: cap request size to avoid oversized allocation

rng_backend_request_entropy() uses the requested size to allocate a buffer with g_malloc(). With virtio-rng, this size comes from guest-supplied descriptor lengths. A malicious guest can set a very large descriptor length, causing QEMU to attempt a multi-gigabyte allocation and abort. Cap the allocation to 64 KiB. The virtio-rng queue size is hardcoded to 8 entries, the EGD backend protocol limits requests to 255 bytes, the Linux kernel hwrng framework requests at most SMP_CACHE_BYTES per call (64 bytes on x86_64), and the Windows viorng driver uses a 4 KiB buffer. The worst legitimate case is 8 x 4 KiB = 32 KiB, so 64 KiB is well above any legitimate use. Fixes: 14417039653d ("virtio-rng: use virtqueue_get_avail_bytes, fix migration") Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3983 Reported-by: dong ling <dongling226655@outlook.com> Signed-off-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Message-ID: <20260715141300.2295392-1-lvivier@redhat.com>

Laurent Vivier committed Jul 15, 2026 at 16:13 UTC 70074cc48f450e6c95881ac534e67013c8773cb2

1 file changed +4 -1

backends/rng.c

+4 -1

@@ -11,11 +11,14 @@

11 */

13 #include "qemu/osdep.h"

14 +#include "qemu/units.h"

15 #include "system/rng.h"

16 #include "qapi/error.h"

17 #include "qemu/module.h"

18 #include "qom/object_interfaces.h"

20 +#define RNG_MAX_REQUEST_SIZE (64 * KiB)

21 +

22 void rng_backend_request_entropy(RngBackend *s, size_t size,

23 EntropyReceiveFunc *receive_entropy,

24 void *opaque)

@@ -27,7 +30,7 @@ void rng_backend_request_entropy(RngBackend *s, size_t size,

30 req = g_malloc(sizeof(*req));

32 req->offset = 0;

30 - req->size = size;

33 + req->size = MIN(size, RNG_MAX_REQUEST_SIZE);

34 req->receive_entropy = receive_entropy;

35 req->opaque = opaque;

36 req->data = g_malloc(req->size);