Commit 20b3a363fa for qemu.org

commit 20b3a363fa8c9a83715d7241ec21e2d516359a1b
Author: Thanos Makatos <thanos.makatos@nutanix.com>
Date:   Tue Jul 21 12:26:56 2026 +0000

    vfio-user: vfio_user_device_io_get_region_info: fix capability check

    The existing check for PCI capabilities misses the case where
    info->cap_offset == info->argsz, which results in accessing unallocated
    memory. Fix the comparison.

    Fixes: 667866d66620 ("vfio-user: implement VFIO_USER_DEVICE_GET_REGION_INFO")
    Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3865
    Signed-off-by: Thanos Makatos <thanos.makatos@nutanix.com>
    Reviewed-by: Cédric Le Goater <clg@redhat.com>
    Link: https://lore.kernel.org/qemu-devel/20260721122643.30985-6-thanos.makatos@nutanix.com
    Signed-off-by: Cédric Le Goater <clg@redhat.com>

diff --git a/hw/vfio-user/device.c b/hw/vfio-user/device.c
index 008e5cf687..3d0dbe8406 100644
--- a/hw/vfio-user/device.c
+++ b/hw/vfio-user/device.c
@@ -214,7 +214,8 @@ static int vfio_user_device_io_get_region_info(VFIODevice *vbasedev,

     /* cap_offset in valid area */
     if ((info->flags & VFIO_REGION_INFO_FLAG_CAPS) &&
-        (info->cap_offset < sizeof(*info) || info->cap_offset > info->argsz)) {
+        (info->cap_offset < sizeof(*info)
+         || info->cap_offset + sizeof(struct vfio_info_cap_header) > info->argsz)) {
         return -EINVAL;
     }