@samitouri / QOSamiQemu / commits / d530f2dfbd

virtio: fix queue size validation against allocated maximum

virtio_add_queue() allocates used_elems for num_default entries, but virtio_queue_set_num() accepts larger guest-supplied queue sizes up to VIRTQUEUE_MAX_SIZE. With VIRTIO_F_IN_ORDER, this lets the guest drive used_elems accesses past the allocation and cause out-of-bounds reads and writes. Reject queue sizes larger than num_default in virtio_queue_set_num() and mark the device broken. Fixes: e63c0ba1bc ("virtio: Add support for guest setting of queue size") Fixes: CVE-2026-50626 Cc: Peter Maydell <peter.maydell@linaro.org> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3882 Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3921 Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3923 Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3613 Reported-by: huntr bubble <bubblehuntr@gmail.com> Reported-by: Jia Jia <physicalmtea@gmail.com> Reported-by: Miku Hatsune <anznu1l@gmail.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Message-ID: <eb7cc3672a20db392f577edbece2300aa6754dd3.1784898967.git.mst@redhat.com>

Michael S. Tsirkin committed Jul 20, 2026 at 01:26 UTC d530f2dfbd2d973b17a6d0ffbfe2afb692bdd69c
1 file changed +5
hw/virtio/virtio.c
+5
@@ -2418,6 +2418,11 @@ void virtio_queue_set_num(VirtIODevice *vdev, int n, int num)
2418 num < 0) {
2419 return;
2420 }
2421 + if (num > vdev->vq[n].vring.num_default) {
2422 + virtio_error(vdev, "virtio: queue %d size %d exceeds max size %u",
2423 + n, num, vdev->vq[n].vring.num_default);
2424 + return;
2425 + }
2426 vdev->vq[n].vring.num = num;
2427 }
2428