[PATCH] libvhost-user: protect against OOB memory table access

[PATCH] libvhost-user: protect against OOB memory table access

[Michael S. Tsirkin]

SET_MEM_TABLE handler uses nregions from the message as a loop
bound without checking that it is below VHOST_MEMORY_BASELINE_NREGIONS,
so a malformed message causes an out-of-bounds access to the
regions[] and fds[] arrays.

Frontend is trusted so not a security problem, but
an OOB access is not a nice way to handle errors.
Check, and panic.

Fixes: 7b2e5c65f4 ("contrib: add libvhost-user")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4403
Cc: Stefano Garzarella <sgarzare@redhat.com>
Reported-by: Omer Can Vural <can.omer.5306@outlook.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 subprojects/libvhost-user/libvhost-user.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/subprojects/libvhost-user/libvhost-user.c b/subprojects/libvhost-user/libvhost-user.c
index 2fed792e85..c17765110c 100644
--- a/subprojects/libvhost-user/libvhost-user.c
+++ b/subprojects/libvhost-user/libvhost-user.c
@@ -1105,6 +1105,12 @@ vu_set_mem_table_exec(VuDev *dev, VhostUserMsg *vmsg)
     vu_remove_all_mem_regs(dev);
 
     DPRINT("Nregions: %u\n", memory->nregions);
+
+    if (memory->nregions > VHOST_MEMORY_BASELINE_NREGIONS) {
+        vu_panic(dev, "Invalid nregions: %u", memory->nregions);
+        return false;
+    }
+
     for (i = 0; i < memory->nregions; i++) {
         _vu_add_mem_reg(dev, &memory->regions[i], vmsg->fds[i]);
         close(vmsg->fds[i]);
-- 
MST

Re: [PATCH] libvhost-user: protect against OOB memory table access

[Michael S. Tsirkin]

On Tue, Sep 15, 2026 at 06:45:00AM -0400, Michael S. Tsirkin wrote:
> SET_MEM_TABLE handler uses nregions from the message as a loop
> bound without checking that it is below VHOST_MEMORY_BASELINE_NREGIONS,
> so a malformed message causes an out-of-bounds access to the
> regions[] and fds[] arrays.
> 
> Frontend is trusted so not a security problem, but
> an OOB access is not a nice way to handle errors.
> Check, and panic.
> 
> Fixes: 7b2e5c65f4 ("contrib: add libvhost-user")
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4403
> Cc: Stefano Garzarella <sgarzare@redhat.com>
> Reported-by: Omer Can Vural <can.omer.5306@outlook.com>
> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

Sorry pls disregard.

> ---
>  subprojects/libvhost-user/libvhost-user.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/subprojects/libvhost-user/libvhost-user.c b/subprojects/libvhost-user/libvhost-user.c
> index 2fed792e85..c17765110c 100644
> --- a/subprojects/libvhost-user/libvhost-user.c
> +++ b/subprojects/libvhost-user/libvhost-user.c
> @@ -1105,6 +1105,12 @@ vu_set_mem_table_exec(VuDev *dev, VhostUserMsg *vmsg)
>      vu_remove_all_mem_regs(dev);
>  
>      DPRINT("Nregions: %u\n", memory->nregions);
> +
> +    if (memory->nregions > VHOST_MEMORY_BASELINE_NREGIONS) {
> +        vu_panic(dev, "Invalid nregions: %u", memory->nregions);
> +        return false;
> +    }
> +
>      for (i = 0; i < memory->nregions; i++) {
>          _vu_add_mem_reg(dev, &memory->regions[i], vmsg->fds[i]);
>          close(vmsg->fds[i]);
> -- 
> MST