Commit bdac94e9cf for qemu.org

commit bdac94e9cfdff4d9d3c1a6f7cd995e4e4f04d7a9
Author: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Date:   Mon Apr 20 08:07:05 2026 +0300

    virtio-snd: check rx buffer descriptor size

    It must be at least sizeof(virtio_snd_pcm_status).

    I haven't verified if it's possible to get an underflow, but coverity
    points it out in CID 1547527 so add a check.

    Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
    Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
    Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
    Message-ID: <20260420-virtio-fixups-v3-1-07aef1eff9d2@linaro.org>

diff --git a/hw/audio/virtio-snd.c b/hw/audio/virtio-snd.c
index fb5cff3866..93fbcfb43f 100644
--- a/hw/audio/virtio-snd.c
+++ b/hw/audio/virtio-snd.c
@@ -970,12 +970,14 @@ static void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)
         }

         stream = vsnd->pcm.streams[stream_id];
-        if (stream == NULL || stream->info.direction != VIRTIO_SND_D_INPUT) {
+        size = iov_size(elem->in_sg, elem->in_num);
+        if (stream == NULL
+            || stream->info.direction != VIRTIO_SND_D_INPUT
+            || size < sizeof(virtio_snd_pcm_status)) {
             goto rx_err;
         }
+        size -= sizeof(virtio_snd_pcm_status);
         WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {
-            size = iov_size(elem->in_sg, elem->in_num) -
-                sizeof(virtio_snd_pcm_status);
             buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size);
             buffer->elem = elem;
             buffer->vq = vq;