Commit f6a321c94b for qemu.org

commit f6a321c94b21f4c4e65de96078d04bd62df08b23
Author: Thanos Makatos <thanos.makatos@nutanix.com>
Date:   Tue Jul 21 12:26:51 2026 +0000

    vfio-user: vfio_user_get_region_info: prevent buffer overflow

    If the vfio-user responds with a value large enough such that adding
    the header size to it overflows, a smaller buffer would be
    inadvertently allocated, leading to buffer overflow.

    Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3867
    Signed-off-by: Thanos Makatos <thanos.makatos@nutanix.com>
    Fixes: 667866d66620 ("vfio-user: implement VFIO_USER_DEVICE_GET_REGION_INFO")
    Reviewed-by: Cédric Le Goater <clg@redhat.com>
    Link: https://lore.kernel.org/qemu-devel/20260721122643.30985-2-thanos.makatos@nutanix.com
    Signed-off-by: Cédric Le Goater <clg@redhat.com>

diff --git a/hw/vfio-user/device.c b/hw/vfio-user/device.c
index b8d2b7c1a8..e58167a818 100644
--- a/hw/vfio-user/device.c
+++ b/hw/vfio-user/device.c
@@ -128,12 +128,21 @@ static int vfio_user_get_region_info(VFIOUserProxy *proxy,
         error_printf("vfio_user_get_region_info argsz too small\n");
         return -E2BIG;
     }
+
+    /*
+     * Ensure that size doesn't overflow, otherwise we'll allocate a much
+     * smaller buffer than we need.
+     */
+    if (__builtin_add_overflow(info->argsz, sizeof(VFIOUserHdr), &size)) {
+        error_printf("vfio_user_get_region_info argsz too large\n");
+        return -E2BIG;
+    }
+
     if (fds != NULL && fds->send_fds != 0) {
         error_printf("vfio_user_get_region_info can't send FDs\n");
         return -EINVAL;
     }

-    size = info->argsz + sizeof(VFIOUserHdr);
     msgp = g_malloc0(size);

     vfio_user_request_msg(&msgp->hdr, VFIO_USER_DEVICE_GET_REGION_INFO,