vhost-user: assert nregions within limit
scrub_shadow_regions() and vhost_user_add_remove_regions() use fixed-size stack arrays sized to VHOST_USER_MAX_RAM_SLOTS and index them with dev->mem->nregions. nregions is calculated to never overrun these, but let's add an assert to make sure we don't get a stack overflow if there's a bug. Fixes: f1aeb14b08 ("Transmit vhost-user memory regions individually") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3910 Cc: Stefano Garzarella <sgarzare@redhat.com> Cc: Raphael Norwitz <raphael.norwitz@nutanix.com> Reported-by: Feifan Qian <bea1e@proton.me> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Message-ID: <48fb8411f67e525872fb19618a886e52b670ab7f.1784896199.git.mst@redhat.com>
Michael S. Tsirkin committed
Jul 8, 2026 at 11:38 UTC
cf89b769cdd1933796099706387d3b2a9a865cae
1 file changed
+3
hw/virtio/vhost-user.c
+3
@@ -946,6 +946,9 @@ static int vhost_user_add_remove_regions(struct vhost_dev *dev,
946
947
msg->hdr.size = sizeof(msg->payload.mem_reg);
948
949
+ /* Ensure nregions fits the fixed-size arrays used below. */
950
+ assert(dev->mem->nregions <= VHOST_USER_MAX_RAM_SLOTS);
951
+
952
/* Find the regions which need to be removed or added. */
953
scrub_shadow_regions(dev, add_reg, &nr_add_reg, rem_reg, &nr_rem_reg,
954
shadow_pcb, track_ramblocks);