Commit 733a98a552 for qemu.org

commit 733a98a552e4bd68932de1f58bd6ea39b57b261c
Author: Michael S. Tsirkin <mst@redhat.com>
Date:   Wed Jun 24 10:43:46 2026 -0400

    libvduse: validate vq size

    libvduse assumes that vq size (aka vq num) is below VIRTQUEUE_MAX_SIZE
    and maps logs large enough based on this assumption.

    However, vduse_queue_enable() accepts the vq size returned through
    VDUSE_VQ_GET_INFO without validation, so a value above
    VIRTQUEUE_MAX_SIZE (1024) overruns the inflight log and causes
    out-of-bounds writes in vduse_queue_inflight_get().

    According to the virtio spec, vq size can only be reduced, not
    increased, so vq size must not exceed the previously configured
    max_size, but the kernel vduse module does not validate this for us, and
    we should not trust another process to follow the spec.

    Validate and reject vq size values above VIRTQUEUE_MAX_SIZE.

    Fixes: CVE-2026-61402
    Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3652
    Reported-by: Jia Jia <physicalmtea@gmail.com>
    Message-ID: <bf7e71b3139875e5e00fd53970c772d6c90dc2a1.1784888961.git.mst@redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

diff --git a/subprojects/libvduse/libvduse.c b/subprojects/libvduse/libvduse.c
index df9ca5e56f..712b97b4c3 100644
--- a/subprojects/libvduse/libvduse.c
+++ b/subprojects/libvduse/libvduse.c
@@ -902,6 +902,11 @@ static void vduse_queue_enable(VduseVirtq *vq)
         return;
     }

+    if (vq_info.num > VIRTQUEUE_MAX_SIZE) {
+        fprintf(stderr, "vq[%d] vring num %u exceeds max %u\n",
+                vq->index, vq_info.num, VIRTQUEUE_MAX_SIZE);
+        return;
+    }
     vq->vring.num = vq_info.num;
     vq->vring.desc_addr = vq_info.desc_addr;
     vq->vring.avail_addr = vq_info.driver_addr;