From: "Michael S. Tsirkin" <[email protected]> libvduse assumes that vq size (aka vq num) is below VIRTQUEUE_MAX_SIZE and maps logs large enough based on this assumption.
However, vduse_queue_enable() accepts the vq size returned through VDUSE_VQ_GET_INFO without validation, so a value above VIRTQUEUE_MAX_SIZE (1024) overruns the inflight log and causes out-of-bounds writes in vduse_queue_inflight_get(). According to the virtio spec, vq size can only be reduced, not increased, so vq size must not exceed the previously configured max_size, but the kernel vduse module does not validate this for us, and we should not trust another process to follow the spec. Validate and reject vq size values above VIRTQUEUE_MAX_SIZE. Fixes: CVE-2026-61402 Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3652 Reported-by: Jia Jia <[email protected]> Message-ID: <bf7e71b3139875e5e00fd53970c772d6c90dc2a1.1784888961.git....@redhat.com> Signed-off-by: Michael S. Tsirkin <[email protected]> (cherry picked from commit 733a98a552e4bd68932de1f58bd6ea39b57b261c) Signed-off-by: Michael Tokarev <[email protected]> diff --git a/subprojects/libvduse/libvduse.c b/subprojects/libvduse/libvduse.c index df9ca5e56f2..712b97b4c3b 100644 --- a/subprojects/libvduse/libvduse.c +++ b/subprojects/libvduse/libvduse.c @@ -902,6 +902,11 @@ static void vduse_queue_enable(VduseVirtq *vq) return; } + if (vq_info.num > VIRTQUEUE_MAX_SIZE) { + fprintf(stderr, "vq[%d] vring num %u exceeds max %u\n", + vq->index, vq_info.num, VIRTQUEUE_MAX_SIZE); + return; + } vq->vring.num = vq_info.num; vq->vring.desc_addr = vq_info.desc_addr; vq->vring.avail_addr = vq_info.driver_addr; -- 2.47.3
