From: Michael S. Tsirkin Date: Mon, 20 Jul 2026 05:26:42 +0000 (-0400) Subject: virtio: fix queue size validation against allocated maximum X-Git-Tag: v11.1.0-rc2~6^2~20 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d530f2dfbd2d973b17a6d0ffbfe2afb692bdd69c;p=thirdparty%2Fqemu.git virtio: fix queue size validation against allocated maximum virtio_add_queue() allocates used_elems for num_default entries, but virtio_queue_set_num() accepts larger guest-supplied queue sizes up to VIRTQUEUE_MAX_SIZE. With VIRTIO_F_IN_ORDER, this lets the guest drive used_elems accesses past the allocation and cause out-of-bounds reads and writes. Reject queue sizes larger than num_default in virtio_queue_set_num() and mark the device broken. Fixes: e63c0ba1bc ("virtio: Add support for guest setting of queue size") Fixes: CVE-2026-50626 Cc: Peter Maydell Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3882 Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3921 Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3923 Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3613 Reported-by: huntr bubble Reported-by: Jia Jia Reported-by: Miku Hatsune Signed-off-by: Michael S. Tsirkin Message-ID: --- diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c index cdc8ba76f1..4a6430c31c 100644 --- a/hw/virtio/virtio.c +++ b/hw/virtio/virtio.c @@ -2418,6 +2418,11 @@ void virtio_queue_set_num(VirtIODevice *vdev, int n, int num) num < 0) { return; } + if (num > vdev->vq[n].vring.num_default) { + virtio_error(vdev, "virtio: queue %d size %d exceeds max size %u", + n, num, vdev->vq[n].vring.num_default); + return; + } vdev->vq[n].vring.num = num; }