@samitouri / QOSamiQemu / commits / bf21298c08

libvhost-user: validate last_batch_head in vu_check_queue_inflights

vu_check_queue_inflights uses last_batch_head from the frontend-controlled inflight shared memory as an index into desc[] without bounds checking. A malicious or buggy frontend can set last_batch_head >= desc_num, causing an out-of-bounds write. Validate last_batch_head before using it. Note: the value is not guest-accessible so not a security vulnerability. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3974 Fixes: 5f9ff1eff3 ("libvhost-user: Support tracking inflight I/O in shared memory") Cc: Xie Yongji <xieyongji@bytedance.com> Cc: Stefano Garzarella <sgarzare@redhat.com> Reported-by: BB CC <wywwzjj@gmail.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Message-Id: <8133770c75c9907578dd551f4d468140a0a75cd2.1784892981.git.mst@redhat.com>

Michael S. Tsirkin committed Jul 24, 2026 at 07:26 UTC bf21298c082cc5561072bbfd79216d478861a5cd

1 file changed +6

subprojects/libvhost-user/libvhost-user.c

@@ -1379,6 +1379,12 @@ vu_check_queue_inflights(VuDev *dev, VuVirtq *vq)

1379 vq->counter = 0;

1380

1381 if (unlikely(vq->inflight->used_idx != vq->used_idx)) {

1382 + if (vq->inflight->last_batch_head >= vq->inflight->desc_num) {

1383 + vu_panic(dev, "vu_check_queue_inflights: last_batch_head %u "

1384 + "out of range (desc_num %u)",

1385 + vq->inflight->last_batch_head, vq->inflight->desc_num);

1386 + return -1;

1387 + }

1388 vq->inflight->desc[vq->inflight->last_batch_head].inflight = 0;

1389

1390 barrier();