Commit d530f2dfbd for qemu.org

commit d530f2dfbd2d973b17a6d0ffbfe2afb692bdd69c
Author: Michael S. Tsirkin <mst@redhat.com>
Date:   Mon Jul 20 01:26:42 2026 -0400

    virtio: fix queue size validation against allocated maximum

    virtio_add_queue() allocates used_elems for num_default entries, but
    virtio_queue_set_num() accepts larger guest-supplied queue sizes up to
    VIRTQUEUE_MAX_SIZE. With VIRTIO_F_IN_ORDER, this lets the guest drive
    used_elems accesses past the allocation and cause out-of-bounds reads
    and writes.

    Reject queue sizes larger than num_default in virtio_queue_set_num()
    and mark the device broken.

    Fixes: e63c0ba1bc ("virtio: Add support for guest setting of queue size")
    Fixes: CVE-2026-50626
    Cc: Peter Maydell <peter.maydell@linaro.org>
    Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3882
    Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3921
    Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3923
    Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3613
    Reported-by: huntr bubble <bubblehuntr@gmail.com>
    Reported-by: Jia Jia <physicalmtea@gmail.com>
    Reported-by: Miku Hatsune <anznu1l@gmail.com>
    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
    Message-ID: <eb7cc3672a20db392f577edbece2300aa6754dd3.1784898967.git.mst@redhat.com>

diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index cdc8ba76f1..4a6430c31c 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -2418,6 +2418,11 @@ void virtio_queue_set_num(VirtIODevice *vdev, int n, int num)
         num < 0) {
         return;
     }
+    if (num > vdev->vq[n].vring.num_default) {
+        virtio_error(vdev, "virtio: queue %d size %d exceeds max size %u",
+                     n, num, vdev->vq[n].vring.num_default);
+        return;
+    }
     vdev->vq[n].vring.num = num;
 }