From: GuoHan Zhao <[email protected]> check_migr_pgsize() validates that no page-size bits smaller than VFIO_USER_DEF_PGSIZE are set, but it still accepts pgsize=0. This can replace the default migration page size with an unusable value.
Reject a zero migration page size during version capability parsing, matching the lower-bound check used for the DMA page-size capability. Fixes: 36227628d824 (vfio-user: implement message send infrastructure) Signed-off-by: GuoHan Zhao <[email protected]> Link: https://lore.kernel.org/qemu-devel/[email protected] Signed-off-by: Cédric Le Goater <[email protected]> --- hw/vfio-user/proxy.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/hw/vfio-user/proxy.c b/hw/vfio-user/proxy.c index be2601d5ecc496af8951179ac4da211f89a008a3..0f7d8425d61488f6af3747db4b9f5c774f3fc717 100644 --- a/hw/vfio-user/proxy.c +++ b/hw/vfio-user/proxy.c @@ -1081,9 +1081,11 @@ static bool check_migr_pgsize(VFIOUserProxy *proxy, QObject *qobj, Error **errp) return false; } - /* must be larger than default */ - if (pgsize & (VFIO_USER_DEF_PGSIZE - 1)) { - error_setg(errp, "pgsize 0x%"PRIx64" too small", pgsize); + /* must not be zero or smaller than default */ + if (pgsize < VFIO_USER_DEF_PGSIZE || + (pgsize & (VFIO_USER_DEF_PGSIZE - 1))) { + error_setg(errp, "%s 0x%"PRIx64" too small", + VFIO_USER_CAP_PGSIZE, pgsize); return false; } -- 2.54.0
