@samitouri / QOSamiQemu / commits / 810bf31a1b

migration/multifd: fix off-by-one in recv channel ID validation

multifd_recv_initial_packet() validates the channel ID received from the source against the configured number of channels. The current check uses '>' which allows msg.id == N to pass through. This ID is then used to index multifd_recv_state->params[msg.id], which was allocated with g_new0(MultiFDRecvParams, N) -- an out-of-bounds access. A malicious or buggy source could send id == N and cause heap corruption on the destination. Fix by changing '>' to '>='. Also fix the error message to say "exceeds channel count" for accuracy. Signed-off-by: Bin Guo <guobin@linux.alibaba.com> Reviewed-by: Fabiano Rosas <farosas@suse.de> Link: https://lore.kernel.org/r/20260518110112.21395-6-guobin@linux.alibaba.com Signed-off-by: Peter Xu <peterx@redhat.com>

Bin Guo committed May 18, 2026 at 19:01 UTC 810bf31a1b692e9bcf1494f9cd5c40392f832cfc

1 file changed +3 -3

migration/multifd.c

+3 -3

@@ -210,9 +210,9 @@ static int multifd_recv_initial_packet(QIOChannel *c, Error **errp)

210 return -1;

211 }

212

213 - if (msg.id > migrate_multifd_channels()) {

214 - error_setg(errp, "multifd: received channel id %u is greater than "

215 - "number of channels %u", msg.id, migrate_multifd_channels());

213 + if (msg.id >= migrate_multifd_channels()) {

214 + error_setg(errp, "multifd: received channel id %u exceeds "

215 + "channel count %u", msg.id, migrate_multifd_channels());

216 return -1;

217 }

218