Commit aef1e7c5ec for qemu.org

commit aef1e7c5ec80ee7a4484e4903c9e4c47d80535de
Author: Thanos Makatos <thanos.makatos@nutanix.com>
Date:   Tue Jul 21 12:27:02 2026 +0000

    vfio-user: vfio_user_device_io_set_irqs: prevent excessive malloc

    This isn't in practise a problem since irq->argsz is not externally
    provided, it's a good hardening step nonetheless.

    Fixes: ca1add1696 ("vfio-user: implement VFIO_USER_DEVICE_GET/SET_IRQ*")
    Signed-off-by: Thanos Makatos <thanos.makatos@nutanix.com>
    Reviewed-by: Cédric Le Goater <clg@redhat.com>
    Link: https://lore.kernel.org/qemu-devel/20260721122643.30985-10-thanos.makatos@nutanix.com
    Signed-off-by: Cédric Le Goater <clg@redhat.com>

diff --git a/hw/vfio-user/device.c b/hw/vfio-user/device.c
index daac0e21b6..1a01e748cd 100644
--- a/hw/vfio-user/device.c
+++ b/hw/vfio-user/device.c
@@ -297,6 +297,11 @@ static int vfio_user_device_io_set_irqs(VFIODevice *vbasedev,
             error_printf("vfio_user_set_irqs argsz too large\n");
             return -E2BIG;
         }
+        if (size > proxy->max_xfer_size) {
+            error_printf("vfio_user_device_io_set_irqs argsz too large\n");
+            return -E2BIG;
+        }
+
         msgp = g_malloc0(size);

         vfio_user_request_msg(&msgp->hdr, VFIO_USER_DEVICE_SET_IRQS, size, 0);