A malicious guest could send a VHOST_USER_SET_MEM_TABLE message with a memory_size larger than the actual backing file size. The mmap() call would succeed, but subsequent access to addresses beyond the real file size would cause SIGBUS, crashing the DPDK host process.
Add validation to check that mmap_size does not exceed the backing file's st_size before calling mmap(). CVE-2026-86561 Bugzilla ID: 2002 Cc: [email protected] Acked-by: Kevin Traynor <[email protected]> Signed-off-by: Maxime Coquelin <[email protected]> --- lib/vhost/vhost_user.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/lib/vhost/vhost_user.c b/lib/vhost/vhost_user.c index 020c993b29..ce3420ae90 100644 --- a/lib/vhost/vhost_user.c +++ b/lib/vhost/vhost_user.c @@ -1345,6 +1345,7 @@ vhost_user_mmap_region(struct virtio_net *dev, void *mmap_addr; uint64_t mmap_size; uint64_t alignment; + struct stat file_stat; int populate; /* Check for memory_size + mmap_offset overflow */ @@ -1384,6 +1385,19 @@ vhost_user_mmap_region(struct virtio_net *dev, return -1; } + /* Validate mmap_size does not exceed backing file size */ + if (fstat(region->fd, &file_stat) == -1) { + VHOST_CONFIG_LOG(dev->ifname, ERR, + "failed to get backing file size: %s", strerror(errno)); + return -1; + } + if (mmap_size > (uint64_t)file_stat.st_size) { + VHOST_CONFIG_LOG(dev->ifname, ERR, + "mmap size (0x%" PRIx64 ") exceeds backing file size (0x%" PRIx64 ")", + mmap_size, (uint64_t)file_stat.st_size); + return -1; + } + populate = dev->async_copy ? MAP_POPULATE : 0; mmap_addr = mmap(NULL, mmap_size, PROT_READ | PROT_WRITE, MAP_SHARED | populate, region->fd, 0); -- 2.56.0
