Commit 3966a4258b for qemu.org

commit 3966a4258b597c7e1a86a65d6a0d15f28a09dca8
Author: Thanos Makatos <thanos.makatos@nutanix.com>
Date:   Tue Jul 21 12:26:53 2026 +0000

    vfio-user: vfio_user_get_region_info: reject unreasonably short struct

    While this isn't technically a bug, it's highly unlikely that the
    server wouldn't be writing an entire struct.

    Signed-off-by: Thanos Makatos <thanos.makatos@nutanix.com>
    Fixes: 667866d66620 ("vfio-user: implement VFIO_USER_DEVICE_GET_REGION_INFO")
    Reviewed-by: Cédric Le Goater <clg@redhat.com>
    Link: https://lore.kernel.org/qemu-devel/20260721122643.30985-4-thanos.makatos@nutanix.com
    Signed-off-by: Cédric Le Goater <clg@redhat.com>

diff --git a/hw/vfio-user/device.c b/hw/vfio-user/device.c
index 8350bb2c01..3d12e8b2a2 100644
--- a/hw/vfio-user/device.c
+++ b/hw/vfio-user/device.c
@@ -165,6 +165,11 @@ static int vfio_user_get_region_info(VFIOUserProxy *proxy,
     }
     trace_vfio_user_get_region_info(msgp->index, msgp->flags, msgp->size);

+    if (msgp->argsz < sizeof(*info)) {
+        error_printf("vfio_user_get_region_info reply argsz too small\n");
+        return -EINVAL;
+    }
+
     memcpy(info, &msgp->argsz, info->argsz);

     /*