[PATCH] vhost: Reject oversized inflight migration buffers

[PATCH] vhost: Reject oversized inflight migration buffers

[김승중]

The inflight buffer size is migrated as a uint64_t, but vmstate_size()
reads VMS_VBUFFER sizes as int32_t. Values above INT32_MAX therefore
become negative and are converted to a very large size_t while loading
the buffer, allowing writes beyond the smaller memfd-backed mapping.

Reject sizes that cannot be represented by vmstate_size() before
allocating the destination buffer.

Fixes: CVE-2026-6426
Reported-by: Seungjung Kim <seungjung0711@gmail.com>
Signed-off-by: Seungjung Kim <seungjung0711@gmail.com>

diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
index af41841b52..82eb9407ae 100644
--- a/hw/virtio/vhost.c
+++ b/hw/virtio/vhost.c
@@ -2022,11 +2022,18 @@ void vhost_get_features_ex(struct vhost_dev *hdev,
 static bool vhost_inflight_buffer_pre_load(void *opaque, Error **errp)
 {
     struct vhost_inflight *inflight = opaque;
-
     int fd = -1;
-    void *addr = qemu_memfd_alloc("vhost-inflight", inflight->size,
-                                  F_SEAL_GROW | F_SEAL_SHRINK | F_SEAL_SEAL,
-                                  &fd, errp);
+    void *addr;
+
+    if (inflight->size > INT32_MAX) {
+        error_setg(errp, "inflight buffer size %" PRIu64
+                   " exceeds maximum %d", inflight->size, INT32_MAX);
+        return false;
+    }
+
+    addr = qemu_memfd_alloc("vhost-inflight", inflight->size,
+                            F_SEAL_GROW | F_SEAL_SHRINK | F_SEAL_SEAL,
+                            &fd, errp);
     if (!addr) {
         return false;
     }
-- 
2.50.1 (Apple Git-155)

Re: [PATCH] vhost: Reject oversized inflight migration buffers

[Michael S. Tsirkin]

On Mon, Jul 27, 2026 at 05:45:47AM -0700, 김승중 wrote:
> The inflight buffer size is migrated as a uint64_t, but vmstate_size()
> reads VMS_VBUFFER sizes as int32_t. Values above INT32_MAX therefore
> become negative and are converted to a very large size_t while loading
> the buffer, allowing writes beyond the smaller memfd-backed mapping.
> 
> Reject sizes that cannot be represented by vmstate_size() before
> allocating the destination buffer.
> 
> Fixes: CVE-2026-6426

This CVE really shouldn't be there.

> Reported-by: Seungjung Kim <seungjung0711@gmail.com>
> Signed-off-by: Seungjung Kim <seungjung0711@gmail.com>

This doen't fix it properly, it only fixes values 2g to 4g, but above 4g
is still wrong.

A better fix here:
https://lore.kernel.org/all/9e2d0b03a60642236e6df8edde7b3562f5f9849f.1785101237.git.mst@redhat.com/

> 
> diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
> index af41841b52..82eb9407ae 100644
> --- a/hw/virtio/vhost.c
> +++ b/hw/virtio/vhost.c
> @@ -2022,11 +2022,18 @@ void vhost_get_features_ex(struct vhost_dev *hdev,
>  static bool vhost_inflight_buffer_pre_load(void *opaque, Error **errp)
>  {
>      struct vhost_inflight *inflight = opaque;
> -
>      int fd = -1;

pls don't make unrelated changes like this.

> -    void *addr = qemu_memfd_alloc("vhost-inflight", inflight->size,
> -                                  F_SEAL_GROW | F_SEAL_SHRINK | F_SEAL_SEAL,
> -                                  &fd, errp);
> +    void *addr;
> +
> +    if (inflight->size > INT32_MAX) {
> +        error_setg(errp, "inflight buffer size %" PRIu64
> +                   " exceeds maximum %d", inflight->size, INT32_MAX);
> +        return false;
> +    }
> +
> +    addr = qemu_memfd_alloc("vhost-inflight", inflight->size,
> +                            F_SEAL_GROW | F_SEAL_SHRINK | F_SEAL_SEAL,
> +                            &fd, errp);
>      if (!addr) {
>          return false;
>      }
> -- 
> 2.50.1 (Apple Git-155)

Re: [PATCH] vhost: Reject oversized inflight migration buffers

[김승중]

Thanks Michael. Understood.

The pre_load check was intended as an immediate mitigation, but I see
that it does not address the VMSTATE_VBUFFER_UINT64 type confusion in
the common load and save paths. I will defer to the generic vmstate
fix and will not resend this patch.

I included "Fixes: CVE-2026-6426" because Mauro requested that exact
trailer when the CVE was assigned. I understand that under the current
QEMU security policy, vhost-user-backend-originated issues are treated
as hardening bugs rather than security flaws.

Could you please retain the following credit on the final fix?

Reported-by: Seungjung Kim <seungjung0711@gmail.com>

Sorry about the unrelated whitespace change.

Thanks,
Seungjung


On Mon, 27 Jul 2026 08:48:56 -0400, "Michael S. Tsirkin" <mst@redhat.com> wrote:
> On Mon, Jul 27, 2026 at 05:45:47AM -0700, 김승중 wrote:
> > The inflight buffer size is migrated as a uint64_t, but vmstate_size()
> > reads VMS_VBUFFER sizes as int32_t. Values above INT32_MAX therefore
> > become negative and are converted to a very large size_t while loading
> > the buffer, allowing writes beyond the smaller memfd-backed mapping.
> >
> > Reject sizes that cannot be represented by vmstate_size() before
> > allocating the destination buffer.
> >
> > Fixes: CVE-2026-6426
>
> This CVE really shouldn't be there.
>
> > Reported-by: Seungjung Kim <seungjung0711@gmail.com>
> > Signed-off-by: Seungjung Kim <seungjung0711@gmail.com>
>
> This doen't fix it properly, it only fixes values 2g to 4g, but above 4g
> is still wrong.
>
> A better fix here:
> https://lore.kernel.org/all/9e2d0b03a60642236e6df8edde7b3562f5f9849f.1785101237.git.mst@redhat.com/
>
> >
> > diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
> > index af41841b52..82eb9407ae 100644
> > --- a/hw/virtio/vhost.c
> > +++ b/hw/virtio/vhost.c
> > @@ -2022,11 +2022,18 @@ void vhost_get_features_ex(struct vhost_dev *hdev,
> > static bool vhost_inflight_buffer_pre_load(void *opaque, Error **errp)
> > {
> > struct vhost_inflight *inflight = opaque;
> > -
> > int fd = -1;
>
> pls don't make unrelated changes like this.
>
> > - void *addr = qemu_memfd_alloc("vhost-inflight", inflight->size,
> > - F_SEAL_GROW | F_SEAL_SHRINK | F_SEAL_SEAL,
> > - &fd, errp);
> > + void *addr;
> > +
> > + if (inflight->size > INT32_MAX) {
> > + error_setg(errp, "inflight buffer size %" PRIu64
> > + " exceeds maximum %d", inflight->size, INT32_MAX);
> > + return false;
> > + }
> > +
> > + addr = qemu_memfd_alloc("vhost-inflight", inflight->size,
> > + F_SEAL_GROW | F_SEAL_SHRINK | F_SEAL_SEAL,
> > + &fd, errp);
> > if (!addr) {
> > return false;
> > }
> > --
> > 2.50.1 (Apple Git-155)

Re: [PATCH] vhost: Reject oversized inflight migration buffers

[Michael S. Tsirkin]

On Mon, Jul 27, 2026 at 06:02:26AM -0700, 김승중 wrote:
> Thanks Michael. Understood.
> 
> The pre_load check was intended as an immediate mitigation, but I see
> that it does not address the VMSTATE_VBUFFER_UINT64 type confusion in
> the common load and save paths. I will defer to the generic vmstate
> fix and will not resend this patch.
> 
> I included "Fixes: CVE-2026-6426" because Mauro requested that exact
> trailer when the CVE was assigned. I understand that under the current
> QEMU security policy, vhost-user-backend-originated issues are treated
> as hardening bugs rather than security flaws.
> 
> Could you please retain the following credit on the final fix?
> 
> Reported-by: Seungjung Kim <seungjung0711@gmail.com>

Indeed, my apologies for missing that.

> Sorry about the unrelated whitespace change.
> 
> Thanks,
> Seungjung
> 
> 
> On Mon, 27 Jul 2026 08:48:56 -0400, "Michael S. Tsirkin" <mst@redhat.com> wrote:
> > On Mon, Jul 27, 2026 at 05:45:47AM -0700, 김승중 wrote:
> > > The inflight buffer size is migrated as a uint64_t, but vmstate_size()
> > > reads VMS_VBUFFER sizes as int32_t. Values above INT32_MAX therefore
> > > become negative and are converted to a very large size_t while loading
> > > the buffer, allowing writes beyond the smaller memfd-backed mapping.
> > >
> > > Reject sizes that cannot be represented by vmstate_size() before
> > > allocating the destination buffer.
> > >
> > > Fixes: CVE-2026-6426
> >
> > This CVE really shouldn't be there.
> >
> > > Reported-by: Seungjung Kim <seungjung0711@gmail.com>
> > > Signed-off-by: Seungjung Kim <seungjung0711@gmail.com>
> >
> > This doen't fix it properly, it only fixes values 2g to 4g, but above 4g
> > is still wrong.
> >
> > A better fix here:
> > https://lore.kernel.org/all/9e2d0b03a60642236e6df8edde7b3562f5f9849f.1785101237.git.mst@redhat.com/
> >
> > >
> > > diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
> > > index af41841b52..82eb9407ae 100644
> > > --- a/hw/virtio/vhost.c
> > > +++ b/hw/virtio/vhost.c
> > > @@ -2022,11 +2022,18 @@ void vhost_get_features_ex(struct vhost_dev *hdev,
> > > static bool vhost_inflight_buffer_pre_load(void *opaque, Error **errp)
> > > {
> > > struct vhost_inflight *inflight = opaque;
> > > -
> > > int fd = -1;
> >
> > pls don't make unrelated changes like this.
> >
> > > - void *addr = qemu_memfd_alloc("vhost-inflight", inflight->size,
> > > - F_SEAL_GROW | F_SEAL_SHRINK | F_SEAL_SEAL,
> > > - &fd, errp);
> > > + void *addr;
> > > +
> > > + if (inflight->size > INT32_MAX) {
> > > + error_setg(errp, "inflight buffer size %" PRIu64
> > > + " exceeds maximum %d", inflight->size, INT32_MAX);
> > > + return false;
> > > + }
> > > +
> > > + addr = qemu_memfd_alloc("vhost-inflight", inflight->size,
> > > + F_SEAL_GROW | F_SEAL_SHRINK | F_SEAL_SEAL,
> > > + &fd, errp);
> > > if (!addr) {
> > > return false;
> > > }
> > > --
> > > 2.50.1 (Apple Git-155)