Commit 497b5c5b05 for qemu.org

commit 497b5c5b05ac2be00ae16c723e2445ebbc486cb2
Author: GuoHan Zhao <zhaoguohan@kylinos.cn>
Date:   Fri May 22 16:13:06 2026 +0800

    vfio-user: reject zero migration page size capability

    check_migr_pgsize() validates that no page-size bits smaller than
    VFIO_USER_DEF_PGSIZE are set, but it still accepts pgsize=0. This can replace
    the default migration page size with an unusable value.

    Reject a zero migration page size during version capability parsing, matching
    the lower-bound check used for the DMA page-size capability.

    Fixes: 36227628d824 (vfio-user: implement message send infrastructure)
    Signed-off-by: GuoHan Zhao <zhaoguohan@kylinos.cn>
    Link: https://lore.kernel.org/qemu-devel/20260522081306.4186242-2-zhaoguohan@kylinos.cn
    Signed-off-by: Cédric Le Goater <clg@redhat.com>

diff --git a/hw/vfio-user/proxy.c b/hw/vfio-user/proxy.c
index be2601d5ec..0f7d8425d6 100644
--- a/hw/vfio-user/proxy.c
+++ b/hw/vfio-user/proxy.c
@@ -1081,9 +1081,11 @@ static bool check_migr_pgsize(VFIOUserProxy *proxy, QObject *qobj, Error **errp)
         return false;
     }

-    /* must be larger than default */
-    if (pgsize & (VFIO_USER_DEF_PGSIZE - 1)) {
-        error_setg(errp, "pgsize 0x%"PRIx64" too small", pgsize);
+    /* must not be zero or smaller than default */
+    if (pgsize < VFIO_USER_DEF_PGSIZE ||
+        (pgsize & (VFIO_USER_DEF_PGSIZE - 1))) {
+        error_setg(errp, "%s 0x%"PRIx64" too small",
+                   VFIO_USER_CAP_PGSIZE, pgsize);
         return false;
     }