On Mon, Jul 27, 2026 at 06:02:26AM -0700, 김승중 wrote: > Thanks Michael. Understood. > > The pre_load check was intended as an immediate mitigation, but I see > that it does not address the VMSTATE_VBUFFER_UINT64 type confusion in > the common load and save paths. I will defer to the generic vmstate > fix and will not resend this patch. > > I included "Fixes: CVE-2026-6426" because Mauro requested that exact > trailer when the CVE was assigned. I understand that under the current > QEMU security policy, vhost-user-backend-originated issues are treated > as hardening bugs rather than security flaws. > > Could you please retain the following credit on the final fix? > > Reported-by: Seungjung Kim <[email protected]>
Indeed, my apologies for missing that. > Sorry about the unrelated whitespace change. > > Thanks, > Seungjung > > > On Mon, 27 Jul 2026 08:48:56 -0400, "Michael S. Tsirkin" <[email protected]> > wrote: > > On Mon, Jul 27, 2026 at 05:45:47AM -0700, 김승중 wrote: > > > The inflight buffer size is migrated as a uint64_t, but vmstate_size() > > > reads VMS_VBUFFER sizes as int32_t. Values above INT32_MAX therefore > > > become negative and are converted to a very large size_t while loading > > > the buffer, allowing writes beyond the smaller memfd-backed mapping. > > > > > > Reject sizes that cannot be represented by vmstate_size() before > > > allocating the destination buffer. > > > > > > Fixes: CVE-2026-6426 > > > > This CVE really shouldn't be there. > > > > > Reported-by: Seungjung Kim <[email protected]> > > > Signed-off-by: Seungjung Kim <[email protected]> > > > > This doen't fix it properly, it only fixes values 2g to 4g, but above 4g > > is still wrong. > > > > A better fix here: > > https://lore.kernel.org/all/9e2d0b03a60642236e6df8edde7b3562f5f9849f.1785101237.git....@redhat.com/ > > > > > > > > diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c > > > index af41841b52..82eb9407ae 100644 > > > --- a/hw/virtio/vhost.c > > > +++ b/hw/virtio/vhost.c > > > @@ -2022,11 +2022,18 @@ void vhost_get_features_ex(struct vhost_dev *hdev, > > > static bool vhost_inflight_buffer_pre_load(void *opaque, Error **errp) > > > { > > > struct vhost_inflight *inflight = opaque; > > > - > > > int fd = -1; > > > > pls don't make unrelated changes like this. > > > > > - void *addr = qemu_memfd_alloc("vhost-inflight", inflight->size, > > > - F_SEAL_GROW | F_SEAL_SHRINK | F_SEAL_SEAL, > > > - &fd, errp); > > > + void *addr; > > > + > > > + if (inflight->size > INT32_MAX) { > > > + error_setg(errp, "inflight buffer size %" PRIu64 > > > + " exceeds maximum %d", inflight->size, INT32_MAX); > > > + return false; > > > + } > > > + > > > + addr = qemu_memfd_alloc("vhost-inflight", inflight->size, > > > + F_SEAL_GROW | F_SEAL_SHRINK | F_SEAL_SEAL, > > > + &fd, errp); > > > if (!addr) { > > > return false; > > > } > > > -- > > > 2.50.1 (Apple Git-155)
