Commit 761ac964a8 for qemu.org

commit 761ac964a8a42f3d8b92dca150754c0cc8cbc560
Author: Thanos Makatos <thanos.makatos@nutanix.com>
Date:   Tue Jul 21 12:26:59 2026 +0000

    vfio-user: vfio_user_device_io_device_feature: prevent excessive malloc

    This isn't in practise a problem since feature->argsz is not externally
    provided, it's a good hardening step nonetheless.

    Fixes: e2358af5838d ("vfio-user: support VFIO_USER_DEVICE_FEATURE")
    Signed-off-by: Thanos Makatos <thanos.makatos@nutanix.com>
    Reviewed-by: Cédric Le Goater <clg@redhat.com>
    Link: https://lore.kernel.org/qemu-devel/20260721122643.30985-8-thanos.makatos@nutanix.com
    Signed-off-by: Cédric Le Goater <clg@redhat.com>

diff --git a/hw/vfio-user/device.c b/hw/vfio-user/device.c
index 353fa5ee21..8feaa56875 100644
--- a/hw/vfio-user/device.c
+++ b/hw/vfio-user/device.c
@@ -87,6 +87,10 @@ vfio_user_device_io_device_feature(VFIODevice *vbasedev,
         error_printf("vfio_user_device_io_device_feature argsz too large\n");
         return -E2BIG;
     }
+    if (size > proxy->max_xfer_size) {
+        error_printf("vfio_user_device_io_device_feature argsz too large\n");
+        return -E2BIG;
+    }

     msgp = g_malloc0(size);