Commit 2fba8b2298 for qemu.org

commit 2fba8b2298bf989d908a0f0e35db57c4eed92140
Author: Marc-André Lureau <marcandre.lureau@redhat.com>
Date:   Sun Oct 4 14:23:34 2026 +0400

    chardev/char-ringbuf: reject zero size with is_power_of_2

    The power-of-two validation did not reject size=0, since
    (0 & (0-1)) == 0. With a zero size, the ring buffer mask wraps
    to SIZE_MAX, causing out-of-bounds memory access. Use
    is_power_of_2() which handles zero correctly.

    Reported-by: Hui Peng <benquike@gmail.com>
    Fixes: bf51f62869f4 ("char: move ringbuf/memory to its own file")
    Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
    Message-ID: <20261004-issue-4560-v1-20-ccbef537cbeb@redhat.com>

diff --git a/chardev/char-ringbuf.c b/chardev/char-ringbuf.c
index 8f998d26a4..a80519f8d6 100644
--- a/chardev/char-ringbuf.c
+++ b/chardev/char-ringbuf.c
@@ -27,6 +27,7 @@
 #include "qapi/error.h"
 #include "qapi/qapi-commands-char.h"
 #include "qemu/base64.h"
+#include "qemu/host-utils.h"
 #include "qemu/module.h"
 #include "qemu/option.h"
 #include "qom/object.h"
@@ -102,7 +103,7 @@ static bool ringbuf_chr_open(Chardev *chr,
     d->size = opts->has_size ? opts->size : 65536;

     /* The size must be power of 2 */
-    if (d->size & (d->size - 1)) {
+    if (!is_power_of_2(d->size)) {
         error_setg(errp, "size of ringbuf chardev must be power of two");
         return false;
     }