pci, vhost, virtio, iommu: bugfixes

vhost user currently saves the inflight buffer to the migration stream using VMSTATE_VBUFFER_UINT64. The size is controlled by the vhost-user backend.

But the implementation of that is broken if size is >2G: it stores the buffer size in a uint64_t field, but vmstate_size() always reads the size field as int32_t regardless of the macro used. This, in turn, causes negative or truncated lengths on load, leading to undersized allocations and down the road out-of-bounds buffer access.

There's no practical reason to support such large sizes, so it's enough to validate: read the field as uint64_t when VMS_VBUFFER_UINT64 is set, reject negative or oversized values, and propagate errors to vmstate_load_vmsd().

Note: the large value is coming from the backend, not guest, so this shouldn't be considered a security issue. The CVE was assigned before the qemu security policy was updated to exclude this class of bugs.

Fixes CVE-2026-6426

Fixes f6fdd8b2bd ("vmstate: introduce VMSTATE_VBUFFER_UINT64")

Cc Alexandr Moshkov <[email protected]>

Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3675

Signed-off-by Michael S. Tsirkin <[email protected]>

Message-ID: < 801b1501ee10241f7ac49a10570d548352b36347.1784890517.git.mst@redhat.com>

---
 include/migration/vmstate.h |  5 ++++-
 migration/vmstate.c         | 31 ++++++++++++++++++++++++++++---
 2 files changed, 32 insertions(+), 4 deletions(-)

include/migration/vmstate.h +4 -1

index 1b7f295417..e7095cd977 100644
@@ -168,6 +168,9 @@ enum VMStateFlags {
      */
     VMS_ARRAY_OF_POINTER_AUTO_ALLOC = 0x10000,
 
+    /* Use a uint64_t size field for VMS_VBUFFER instead of int32_t. */
+    VMS_VBUFFER_UINT64              = 0x40000,
+
     /* Marker for end of list */
     VMS_END                         = 0x20000,
 };

@@ -788,7 +791,7 @@ extern const VMStateInfo vmstate_info_g_byte_array;
     .field_exists = (_test),                                         \
     .size_offset  = vmstate_offset_value(_state, _field_size, uint64_t),\
     .info         = &vmstate_info_buffer,                            \
-    .flags        = VMS_VBUFFER | VMS_POINTER,                       \
+    .flags        = VMS_VBUFFER | VMS_VBUFFER_UINT64 | VMS_POINTER,  \
     .offset       = offsetof(_state, _field),                        \
 }
 

migration/vmstate.c +17 -3

index 50ebe37845..d7f03a9f5b 100644
@@ -103,10 +103,24 @@ static int vmstate_size(void *opaque, const
 VMStateField *field)
     int size;
 
     if (field->flags & VMS_VBUFFER) {
-        size = *(int32_t *)(opaque + field->size_offset);
-        if (field->flags & VMS_MULTIPLY) {
-            size *= field->size;
+        uint64_t usize64;
+
+        if (field->flags & VMS_VBUFFER_UINT64) {
+            usize64 = *(uint64_t *)(opaque + field->size_offset);
+        } else {
+            int32_t ssize32 = *(int32_t *)(opaque + field->size_offset);
+            if (ssize32 < 0) {
+                return -1;
+            }
+            usize64 = ssize32;
         }
+        if (field->flags & VMS_MULTIPLY) {
+            usize64 *= field->size;
+        }
+        if (usize64 > INT_MAX) {
+            return -1;
+        }
+        size = usize64;
     } else if (field->flags & VMS_ARRAY_OF_POINTER) {
         /*

* For an array of pointer, the each element is always size of a

migration/vmstate.c +5 -0

@@ -337,6 +351,11 @@ bool vmstate_load_vmsd(QEMUFile *f, const
 VMStateDescription *vmsd,
             void *first_elem = opaque + field->offset;
             int i, n_elems = vmstate_n_elems(opaque, field);
             int size = vmstate_size(opaque, field);
+            if (size < 0) {
+                error_setg(errp, "VMState field '%s': invalid size",
+                           field->name);
+                return false;
+            }
 
             vmstate_handle_alloc(first_elem, field, opaque);

             if (field->flags & VMS_POINTER) {

migration/vmstate.c +6 -0

@@ -661,6 +680,12 @@ static bool vmstate_save_vmsd_v(QEMUFile *f, const
 VMStateDescription *vmsd,
             bool use_dynamic_array =
                 field->flags & VMS_ARRAY_OF_POINTER_AUTO_ALLOC;
 
+            if (size < 0) {
+                error_setg(errp, "VMState field '%s': invalid size",
+                           field->name);
+                ok = false;
+                goto out;
+            }
             trace_vmstate_save_state_loop(vmsd->name, field->name,
 n_elems);

             if (field->flags & VMS_POINTER) {
                 first_elem = *(void **)first_elem;

--
MST

This patch is migration only change and hasn't been reviewed.  Give us a few days to review it?
Can't do it now because it is on cellphone and I just bathed my son.

Please hold off merging.

Thanks.

    vhost user currently saves the inflight buffer to the migration stream
    using VMSTATE_VBUFFER_UINT64. The size is controlled by the vhost-user
    backend.

    But the implementation of that is broken if size is >2G: it stores the
    buffer size in a uint64_t field, but vmstate_size() always reads the
    size field as int32_t regardless of the macro used. This, in turn,
    causes negative or truncated lengths on load, leading to undersized
    allocations and down the road out-of-bounds buffer access.

    There's no practical reason to support such large sizes, so it's enough
    to validate: read the field as uint64_t when VMS_VBUFFER_UINT64 is set,
    reject negative or oversized values, and propagate errors to
    vmstate_load_vmsd().

    Note: the large value is coming from the backend, not guest, so this
    shouldn't be considered a security issue. The CVE was assigned before
    the qemu security policy was updated to exclude this class of bugs.

    Fixes: CVE-2026-6426
    Fixes: f6fdd8b2bd ("vmstate: introduce VMSTATE_VBUFFER_UINT64")
    Cc: Alexandr Moshkov <[email protected]>
    Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3675
    Signed-off-by: Michael S. Tsirkin <[email protected]>
    Message-ID: <
    801b1501ee10241f7ac49a10570d548352b36347.1784890517.git.mst@redhat.com>
    ---
     include/migration/vmstate.h |  5 ++++-
     migration/vmstate.c         | 31 ++++++++++++++++++++++++++++---
     2 files changed, 32 insertions(+), 4 deletions(-)

    diff --git a/include/migration/vmstate.h b/include/migration/vmstate.h
    index 1b7f295417..e7095cd977 100644
    --- a/include/migration/vmstate.h
    +++ b/include/migration/vmstate.h
    @@ -168,6 +168,9 @@ enum VMStateFlags {
          */
         VMS_ARRAY_OF_POINTER_AUTO_ALLOC = 0x10000,

    +    /* Use a uint64_t size field for VMS_VBUFFER instead of int32_t. */
    +    VMS_VBUFFER_UINT64              = 0x40000,
    +
         /* Marker for end of list */
         VMS_END                         = 0x20000,
     };
    @@ -788,7 +791,7 @@ extern const VMStateInfo vmstate_info_g_byte_array;
         .field_exists = (_test),                                         \
         .size_offset  = vmstate_offset_value(_state, _field_size, uint64_t),\
         .info         = &vmstate_info_buffer,                            \
    -    .flags        = VMS_VBUFFER | VMS_POINTER,                       \
    +    .flags        = VMS_VBUFFER | VMS_VBUFFER_UINT64 | VMS_POINTER,  \
         .offset       = offsetof(_state, _field),                        \
     }

    diff --git a/migration/vmstate.c b/migration/vmstate.c
    index 50ebe37845..d7f03a9f5b 100644
    --- a/migration/vmstate.c
    +++ b/migration/vmstate.c
    @@ -103,10 +103,24 @@ static int vmstate_size(void *opaque, const
    VMStateField *field)
         int size;

         if (field->flags & VMS_VBUFFER) {
    -        size = *(int32_t *)(opaque + field->size_offset);
    -        if (field->flags & VMS_MULTIPLY) {
    -            size *= field->size;
    +        uint64_t usize64;
    +
    +        if (field->flags & VMS_VBUFFER_UINT64) {
    +            usize64 = *(uint64_t *)(opaque + field->size_offset);
    +        } else {
    +            int32_t ssize32 = *(int32_t *)(opaque + field->size_offset);
    +            if (ssize32 < 0) {
    +                return -1;
    +            }
    +            usize64 = ssize32;
             }
    +        if (field->flags & VMS_MULTIPLY) {
    +            usize64 *= field->size;
    +        }
    +        if (usize64 > INT_MAX) {
    +            return -1;
    +        }
    +        size = usize64;
         } else if (field->flags & VMS_ARRAY_OF_POINTER) {
             /*
              * For an array of pointer, the each element is always size of a
    @@ -337,6 +351,11 @@ bool vmstate_load_vmsd(QEMUFile *f, const
    VMStateDescription *vmsd,
                 void *first_elem = opaque + field->offset;
                 int i, n_elems = vmstate_n_elems(opaque, field);
                 int size = vmstate_size(opaque, field);
    +            if (size < 0) {
    +                error_setg(errp, "VMState field '%s': invalid size",
    +                           field->name);
    +                return false;
    +            }

                 vmstate_handle_alloc(first_elem, field, opaque);
                 if (field->flags & VMS_POINTER) {
    @@ -661,6 +680,12 @@ static bool vmstate_save_vmsd_v(QEMUFile *f, const
    VMStateDescription *vmsd,
                 bool use_dynamic_array =
                     field->flags & VMS_ARRAY_OF_POINTER_AUTO_ALLOC;

    +            if (size < 0) {
    +                error_setg(errp, "VMState field '%s': invalid size",
    +                           field->name);
    +                ok = false;
    +                goto out;
    +            }
                 trace_vmstate_save_state_loop(vmsd->name, field->name,
    n_elems);
                 if (field->flags & VMS_POINTER) {
                     first_elem = *(void **)first_elem;
    --
    MST

Quoted 7 lines · Peter Xu

This patch is migration only change and hasn't been reviewed.  Give us a few days to review it?
Can't do it now because it is on cellphone and I just bathed my son.

Please hold off merging.

Thanks.

OK. I'll drop this and you will merge it through the migration tree as appropriate?

Quoted 7 lines · On Sun, Jul 26, 2026, 5:29 p.m. Michael S. Tsirkin <[email protected]> wrote:

vhost user currently saves the inflight buffer to the migration stream using VMSTATE_VBUFFER_UINT64. The size is controlled by the vhost-user backend.

Quoted 7 lines

But the implementation of that is broken if size is >2G: it stores the buffer size in a uint64_t field, but vmstate_size() always reads the size field as int32_t regardless of the macro used. This, in turn, causes negative or truncated lengths on load, leading to undersized allocations and down the road out-of-bounds buffer access.

There's no practical reason to support such large sizes, so it's enough

Quoted 108 lines

    to validate: read the field as uint64_t when VMS_VBUFFER_UINT64 is set,
    reject negative or oversized values, and propagate errors to
    vmstate_load_vmsd().

    Note: the large value is coming from the backend, not guest, so this
    shouldn't be considered a security issue. The CVE was assigned before
    the qemu security policy was updated to exclude this class of bugs.

    Fixes: CVE-2026-6426
    Fixes: f6fdd8b2bd ("vmstate: introduce VMSTATE_VBUFFER_UINT64")
    Cc: Alexandr Moshkov <[email protected]>
    Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3675
    Signed-off-by: Michael S. Tsirkin <[email protected]>
    Message-ID: <
    801b1501ee10241f7ac49a10570d548352b36347.1784890517.git.mst@redhat.com>
    ---
     include/migration/vmstate.h |  5 ++++-
     migration/vmstate.c         | 31 ++++++++++++++++++++++++++++---
     2 files changed, 32 insertions(+), 4 deletions(-)

    diff --git a/include/migration/vmstate.h b/include/migration/vmstate.h
    index 1b7f295417..e7095cd977 100644
    --- a/include/migration/vmstate.h
    +++ b/include/migration/vmstate.h
    @@ -168,6 +168,9 @@ enum VMStateFlags {
          */
         VMS_ARRAY_OF_POINTER_AUTO_ALLOC = 0x10000,

    +    /* Use a uint64_t size field for VMS_VBUFFER instead of int32_t. */
    +    VMS_VBUFFER_UINT64              = 0x40000,
    +
         /* Marker for end of list */
         VMS_END                         = 0x20000,
     };
    @@ -788,7 +791,7 @@ extern const VMStateInfo vmstate_info_g_byte_array;
         .field_exists = (_test),                                         \
         .size_offset  = vmstate_offset_value(_state, _field_size, uint64_t),\
         .info         = &vmstate_info_buffer,                            \
    -    .flags        = VMS_VBUFFER | VMS_POINTER,                       \
    +    .flags        = VMS_VBUFFER | VMS_VBUFFER_UINT64 | VMS_POINTER,  \
         .offset       = offsetof(_state, _field),                        \
     }

    diff --git a/migration/vmstate.c b/migration/vmstate.c
    index 50ebe37845..d7f03a9f5b 100644
    --- a/migration/vmstate.c
    +++ b/migration/vmstate.c
    @@ -103,10 +103,24 @@ static int vmstate_size(void *opaque, const
    VMStateField *field)
         int size;

         if (field->flags & VMS_VBUFFER) {
    -        size = *(int32_t *)(opaque + field->size_offset);
    -        if (field->flags & VMS_MULTIPLY) {
    -            size *= field->size;
    +        uint64_t usize64;
    +
    +        if (field->flags & VMS_VBUFFER_UINT64) {
    +            usize64 = *(uint64_t *)(opaque + field->size_offset);
    +        } else {
    +            int32_t ssize32 = *(int32_t *)(opaque + field->size_offset);
    +            if (ssize32 < 0) {
    +                return -1;
    +            }
    +            usize64 = ssize32;
             }
    +        if (field->flags & VMS_MULTIPLY) {
    +            usize64 *= field->size;
    +        }
    +        if (usize64 > INT_MAX) {
    +            return -1;
    +        }
    +        size = usize64;
         } else if (field->flags & VMS_ARRAY_OF_POINTER) {
             /*
              * For an array of pointer, the each element is always size of a
    @@ -337,6 +351,11 @@ bool vmstate_load_vmsd(QEMUFile *f, const
    VMStateDescription *vmsd,
                 void *first_elem = opaque + field->offset;
                 int i, n_elems = vmstate_n_elems(opaque, field);
                 int size = vmstate_size(opaque, field);
    +            if (size < 0) {
    +                error_setg(errp, "VMState field '%s': invalid size",
    +                           field->name);
    +                return false;
    +            }

                 vmstate_handle_alloc(first_elem, field, opaque);
                 if (field->flags & VMS_POINTER) {
    @@ -661,6 +680,12 @@ static bool vmstate_save_vmsd_v(QEMUFile *f, const
    VMStateDescription *vmsd,
                 bool use_dynamic_array =
                     field->flags & VMS_ARRAY_OF_POINTER_AUTO_ALLOC;

    +            if (size < 0) {
    +                error_setg(errp, "VMState field '%s': invalid size",
    +                           field->name);
    +                ok = false;
    +                goto out;
    +            }
                 trace_vmstate_save_state_loop(vmsd->name, field->name,
    n_elems);
                 if (field->flags & VMS_POINTER) {
                     first_elem = *(void **)first_elem;
    --
    MST

Quoted 7 lines · Michael S. Tsirkin

Quoted 6 lines · Peter Xu

This patch is migration only change and hasn't been reviewed.  Give us a few days to review it?
Can't do it now because it is on cellphone and I just bathed my son.

Please hold off merging.

Quoted 4 lines

Quoted 1 line

Thanks.

OK. I'll drop this and you will merge it through the migration tree as appropriate?

Let's drop it first so it won't block this pull. I can definitely pick it up when ready, but I want to discuss on how to fix first. Which tree to pick it up isn't a huge matter to me, but the review.

We found a bunch of randomly introduced VMSTATE flags in the past, I used to remove some, at least my plan is in the future each time we introduce a new one (by request from other modules) we better justify it before landing too easily, in case it needs a revert again.

This vhost regression started 11.0 so IIUC we don't need to rush in 11.1. I just noticed I read that patch and didn't notice this, my bad to not have noticed..

For this one specifically..

Quoted 7 lines

Quoted 7 lines · On Sun, Jul 26, 2026, 5:29 p.m. Michael S. Tsirkin <[email protected]> wrote:

vhost user currently saves the inflight buffer to the migration stream using VMSTATE_VBUFFER_UINT64. The size is controlled by the vhost-user backend.

Quoted 7 lines

Quoted 7 lines

But the implementation of that is broken if size is >2G: it stores the buffer size in a uint64_t field, but vmstate_size() always reads the size field as int32_t regardless of the macro used. This, in turn, causes negative or truncated lengths on load, leading to undersized allocations and down the road out-of-bounds buffer access.

There's no practical reason to support such large sizes, so it's enough

If there's no real demand to use 2G or more, I suggest we change size to int32_t instead on the user, and revert f6fdd8b2 VMSTATE_VBUFFER_UINT64().

Fabiano and I were looking at rest 20+ possible security related bugs in the past 1-2 weeks, I've some patches to be posted for 11.2 too when we went through all of them. One relevant patch I haven't sent but will do soon:

https://gitlab.com/peterx/qemu/-/commit/afd2cb25defdf78a4ab5279cc16634884792c57a

We encountered quite a few of possible over-allocation on destionation side by manipulating on-wire length field like this one, I believe Fabiano is looking at how to further limit that from 2G if ever possible per-user.

I'm not sure if that idea will fly, but I think anything bigger than 2G definitely is not suggested for now when it's only for a type match not real demand..

I believe VMSTATE_VBUFFER_UINT32 is problematic on its own too, I'll see how to fix that. That one is slightly easier, worst case is we bail out for 2G (hence ignore bit 31, which shouldn't be used in reality for legit users), but I'll think about it.

Thanks,

Quoted 109 lines

Quoted 108 lines

    to validate: read the field as uint64_t when VMS_VBUFFER_UINT64 is set,
    reject negative or oversized values, and propagate errors to
    vmstate_load_vmsd().

    Note: the large value is coming from the backend, not guest, so this
    shouldn't be considered a security issue. The CVE was assigned before
    the qemu security policy was updated to exclude this class of bugs.

    Fixes: CVE-2026-6426
    Fixes: f6fdd8b2bd ("vmstate: introduce VMSTATE_VBUFFER_UINT64")
    Cc: Alexandr Moshkov <[email protected]>
    Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3675
    Signed-off-by: Michael S. Tsirkin <[email protected]>
    Message-ID: <
    801b1501ee10241f7ac49a10570d548352b36347.1784890517.git.mst@redhat.com>
    ---
     include/migration/vmstate.h |  5 ++++-
     migration/vmstate.c         | 31 ++++++++++++++++++++++++++++---
     2 files changed, 32 insertions(+), 4 deletions(-)

    diff --git a/include/migration/vmstate.h b/include/migration/vmstate.h
    index 1b7f295417..e7095cd977 100644
    --- a/include/migration/vmstate.h
    +++ b/include/migration/vmstate.h
    @@ -168,6 +168,9 @@ enum VMStateFlags {
          */
         VMS_ARRAY_OF_POINTER_AUTO_ALLOC = 0x10000,

    +    /* Use a uint64_t size field for VMS_VBUFFER instead of int32_t. */
    +    VMS_VBUFFER_UINT64              = 0x40000,
    +
         /* Marker for end of list */
         VMS_END                         = 0x20000,
     };
    @@ -788,7 +791,7 @@ extern const VMStateInfo vmstate_info_g_byte_array;
         .field_exists = (_test),                                         \
         .size_offset  = vmstate_offset_value(_state, _field_size, uint64_t),\
         .info         = &vmstate_info_buffer,                            \
    -    .flags        = VMS_VBUFFER | VMS_POINTER,                       \
    +    .flags        = VMS_VBUFFER | VMS_VBUFFER_UINT64 | VMS_POINTER,  \
         .offset       = offsetof(_state, _field),                        \
     }

    diff --git a/migration/vmstate.c b/migration/vmstate.c
    index 50ebe37845..d7f03a9f5b 100644
    --- a/migration/vmstate.c
    +++ b/migration/vmstate.c
    @@ -103,10 +103,24 @@ static int vmstate_size(void *opaque, const
    VMStateField *field)
         int size;

         if (field->flags & VMS_VBUFFER) {
    -        size = *(int32_t *)(opaque + field->size_offset);
    -        if (field->flags & VMS_MULTIPLY) {
    -            size *= field->size;
    +        uint64_t usize64;
    +
    +        if (field->flags & VMS_VBUFFER_UINT64) {
    +            usize64 = *(uint64_t *)(opaque + field->size_offset);
    +        } else {
    +            int32_t ssize32 = *(int32_t *)(opaque + field->size_offset);
    +            if (ssize32 < 0) {
    +                return -1;
    +            }
    +            usize64 = ssize32;
             }
    +        if (field->flags & VMS_MULTIPLY) {
    +            usize64 *= field->size;
    +        }
    +        if (usize64 > INT_MAX) {
    +            return -1;
    +        }
    +        size = usize64;
         } else if (field->flags & VMS_ARRAY_OF_POINTER) {
             /*
              * For an array of pointer, the each element is always size of a
    @@ -337,6 +351,11 @@ bool vmstate_load_vmsd(QEMUFile *f, const
    VMStateDescription *vmsd,
                 void *first_elem = opaque + field->offset;
                 int i, n_elems = vmstate_n_elems(opaque, field);
                 int size = vmstate_size(opaque, field);
    +            if (size < 0) {
    +                error_setg(errp, "VMState field '%s': invalid size",
    +                           field->name);
    +                return false;
    +            }

                 vmstate_handle_alloc(first_elem, field, opaque);
                 if (field->flags & VMS_POINTER) {
    @@ -661,6 +680,12 @@ static bool vmstate_save_vmsd_v(QEMUFile *f, const
    VMStateDescription *vmsd,
                 bool use_dynamic_array =
                     field->flags & VMS_ARRAY_OF_POINTER_AUTO_ALLOC;

    +            if (size < 0) {
    +                error_setg(errp, "VMState field '%s': invalid size",
    +                           field->name);
    +                ok = false;
    +                goto out;
    +            }
                 trace_vmstate_save_state_loop(vmsd->name, field->name,
    n_elems);
                 if (field->flags & VMS_POINTER) {
                     first_elem = *(void **)first_elem;
    --
    MST

Signature · 1 line

Peter Xu

Quoted 8 lines · Peter Xu

Quoted 7 lines · Michael S. Tsirkin

Quoted 6 lines · Peter Xu

This patch is migration only change and hasn't been reviewed.  Give us a few days to review it?
Can't do it now because it is on cellphone and I just bathed my son.

Please hold off merging.

Quoted 8 lines

Quoted 4 lines

Quoted 1 line

Thanks.

OK. I'll drop this and you will merge it through the migration tree as appropriate?

Let's drop it first so it won't block this pull. I can definitely pick it up when ready, but I want to discuss on how to fix first. Which tree to pick it up isn't a huge matter to me, but the review.

Done.
Pls include:

Reported-by Seungjung Kim <[email protected]>

when you are merging this.

Quoted 25 lines

We found a bunch of randomly introduced VMSTATE flags in the past, I used to remove some, at least my plan is in the future each time we introduce a new one (by request from other modules) we better justify it before landing too easily, in case it needs a revert again.

This vhost regression started 11.0 so IIUC we don't need to rush in 11.1. I just noticed I read that patch and didn't notice this, my bad to not have noticed..

For this one specifically..

Quoted 13 lines

Quoted 13 lines · On Sun, Jul 26, 2026, 5:29 p.m. Michael S. Tsirkin <[email protected]> wrote:

vhost user currently saves the inflight buffer to the migration stream using VMSTATE_VBUFFER_UINT64. The size is controlled by the vhost-user backend.

But the implementation of that is broken if size is >2G: it stores the buffer size in a uint64_t field, but vmstate_size() always reads the size field as int32_t regardless of the macro used. This, in turn, causes negative or truncated lengths on load, leading to undersized allocations and down the road out-of-bounds buffer access.

Quoted 4 lines

Quoted 1 line

Quoted 1 line

There's no practical reason to support such large sizes, so it's enough

If there's no real demand to use 2G or more, I suggest we change size to int32_t instead on the user, and revert f6fdd8b2 VMSTATE_VBUFFER_UINT64().

Quoted 135 lines

Fabiano and I were looking at rest 20+ possible security related bugs in the past 1-2 weeks, I've some patches to be posted for 11.2 too when we went through all of them. One relevant patch I haven't sent but will do soon:

https://gitlab.com/peterx/qemu/-/commit/afd2cb25defdf78a4ab5279cc16634884792c57a

We encountered quite a few of possible over-allocation on destionation side by manipulating on-wire length field like this one, I believe Fabiano is looking at how to further limit that from 2G if ever possible per-user.

I'm not sure if that idea will fly, but I think anything bigger than 2G definitely is not suggested for now when it's only for a type match not real demand..

I believe VMSTATE_VBUFFER_UINT32 is problematic on its own too, I'll see how to fix that. That one is slightly easier, worst case is we bail out for 2G (hence ignore bit 31, which shouldn't be used in reality for legit users), but I'll think about it.

Thanks,

Quoted 109 lines

Quoted 108 lines

    to validate: read the field as uint64_t when VMS_VBUFFER_UINT64 is set,
    reject negative or oversized values, and propagate errors to
    vmstate_load_vmsd().

    Note: the large value is coming from the backend, not guest, so this
    shouldn't be considered a security issue. The CVE was assigned before
    the qemu security policy was updated to exclude this class of bugs.

    Fixes: CVE-2026-6426
    Fixes: f6fdd8b2bd ("vmstate: introduce VMSTATE_VBUFFER_UINT64")
    Cc: Alexandr Moshkov <[email protected]>
    Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3675
    Signed-off-by: Michael S. Tsirkin <[email protected]>
    Message-ID: <
    801b1501ee10241f7ac49a10570d548352b36347.1784890517.git.mst@redhat.com>
    ---
     include/migration/vmstate.h |  5 ++++-
     migration/vmstate.c         | 31 ++++++++++++++++++++++++++++---
     2 files changed, 32 insertions(+), 4 deletions(-)

    diff --git a/include/migration/vmstate.h b/include/migration/vmstate.h
    index 1b7f295417..e7095cd977 100644
    --- a/include/migration/vmstate.h
    +++ b/include/migration/vmstate.h
    @@ -168,6 +168,9 @@ enum VMStateFlags {
          */
         VMS_ARRAY_OF_POINTER_AUTO_ALLOC = 0x10000,

    +    /* Use a uint64_t size field for VMS_VBUFFER instead of int32_t. */
    +    VMS_VBUFFER_UINT64              = 0x40000,
    +
         /* Marker for end of list */
         VMS_END                         = 0x20000,
     };
    @@ -788,7 +791,7 @@ extern const VMStateInfo vmstate_info_g_byte_array;
         .field_exists = (_test),                                         \
         .size_offset  = vmstate_offset_value(_state, _field_size, uint64_t),\
         .info         = &vmstate_info_buffer,                            \
    -    .flags        = VMS_VBUFFER | VMS_POINTER,                       \
    +    .flags        = VMS_VBUFFER | VMS_VBUFFER_UINT64 | VMS_POINTER,  \
         .offset       = offsetof(_state, _field),                        \
     }

    diff --git a/migration/vmstate.c b/migration/vmstate.c
    index 50ebe37845..d7f03a9f5b 100644
    --- a/migration/vmstate.c
    +++ b/migration/vmstate.c
    @@ -103,10 +103,24 @@ static int vmstate_size(void *opaque, const
    VMStateField *field)
         int size;

         if (field->flags & VMS_VBUFFER) {
    -        size = *(int32_t *)(opaque + field->size_offset);
    -        if (field->flags & VMS_MULTIPLY) {
    -            size *= field->size;
    +        uint64_t usize64;
    +
    +        if (field->flags & VMS_VBUFFER_UINT64) {
    +            usize64 = *(uint64_t *)(opaque + field->size_offset);
    +        } else {
    +            int32_t ssize32 = *(int32_t *)(opaque + field->size_offset);
    +            if (ssize32 < 0) {
    +                return -1;
    +            }
    +            usize64 = ssize32;
             }
    +        if (field->flags & VMS_MULTIPLY) {
    +            usize64 *= field->size;
    +        }
    +        if (usize64 > INT_MAX) {
    +            return -1;
    +        }
    +        size = usize64;
         } else if (field->flags & VMS_ARRAY_OF_POINTER) {
             /*
              * For an array of pointer, the each element is always size of a
    @@ -337,6 +351,11 @@ bool vmstate_load_vmsd(QEMUFile *f, const
    VMStateDescription *vmsd,
                 void *first_elem = opaque + field->offset;
                 int i, n_elems = vmstate_n_elems(opaque, field);
                 int size = vmstate_size(opaque, field);
    +            if (size < 0) {
    +                error_setg(errp, "VMState field '%s': invalid size",
    +                           field->name);
    +                return false;
    +            }

                 vmstate_handle_alloc(first_elem, field, opaque);
                 if (field->flags & VMS_POINTER) {
    @@ -661,6 +680,12 @@ static bool vmstate_save_vmsd_v(QEMUFile *f, const
    VMStateDescription *vmsd,
                 bool use_dynamic_array =
                     field->flags & VMS_ARRAY_OF_POINTER_AUTO_ALLOC;

    +            if (size < 0) {
    +                error_setg(errp, "VMState field '%s': invalid size",
    +                           field->name);
    +                ok = false;
    +                goto out;
    +            }
                 trace_vmstate_save_state_loop(vmsd->name, field->name,
    n_elems);
                 if (field->flags & VMS_POINTER) {
                     first_elem = *(void **)first_elem;
    --
    MST

Signature · 1 line

Peter Xu

Quoted 11 lines · Michael S. Tsirkin

Quoted 7 lines · Peter Xu

This patch is migration only change and hasn't been reviewed.  Give us a few days to review it?
Can't do it now because it is on cellphone and I just bathed my son.

Please hold off merging.

Thanks.

OK. I'll drop this and you will merge it through the migration tree as appropriate?

Let's drop it first so it won't block this pull. I can definitely pick it up when ready, but I want to discuss on how to fix first. Which tree to pick it up isn't a huge matter to me, but the review.

We found a bunch of randomly introduced VMSTATE flags in the past, I used to remove some, at least my plan is in the future each time we introduce a new one (by request from other modules) we better justify it before landing too easily, in case it needs a revert again.

This vhost regression started 11.0 so IIUC we don't need to rush in 11.1. I just noticed I read that patch and didn't notice this, my bad to not have noticed..

For this one specifically..

Quoted 13 lines

Quoted 13 lines · On Sun, Jul 26, 2026, 5:29 p.m. Michael S. Tsirkin <[email protected]> wrote:

vhost user currently saves the inflight buffer to the migration stream using VMSTATE_VBUFFER_UINT64. The size is controlled by the vhost-user backend.

But the implementation of that is broken if size is >2G: it stores the buffer size in a uint64_t field, but vmstate_size() always reads the size field as int32_t regardless of the macro used. This, in turn, causes negative or truncated lengths on load, leading to undersized allocations and down the road out-of-bounds buffer access.

Quoted 1 line

Quoted 1 line

There's no practical reason to support such large sizes, so it's enough

If there's no real demand to use 2G or more, I suggest we change size to int32_t instead on the user, and revert f6fdd8b2 VMSTATE_VBUFFER_UINT64().

Fabiano and I were looking at rest 20+ possible security related bugs in the past 1-2 weeks, I've some patches to be posted for 11.2 too when we went through all of them. One relevant patch I haven't sent but will do soon:

https://gitlab.com/peterx/qemu/-/commit/afd2cb25defdf78a4ab5279cc16634884792c57a

We encountered quite a few of possible over-allocation on destionation side by manipulating on-wire length field like this one, I believe Fabiano is looking at how to further limit that from 2G if ever possible per-user.

I'm not sure if that idea will fly, but I think anything bigger than 2G definitely is not suggested for now when it's only for a type match not real demand..

I believe VMSTATE_VBUFFER_UINT32 is problematic on its own too, I'll see how to fix that. That one is slightly easier, worst case is we bail out for 2G (hence ignore bit 31, which shouldn't be used in reality for legit users), but I'll think about it.

Thanks,

Quoted 109 lines

Quoted 108 lines

    to validate: read the field as uint64_t when VMS_VBUFFER_UINT64 is set,
    reject negative or oversized values, and propagate errors to
    vmstate_load_vmsd().

    Note: the large value is coming from the backend, not guest, so this
    shouldn't be considered a security issue. The CVE was assigned before
    the qemu security policy was updated to exclude this class of bugs.

    Fixes: CVE-2026-6426
    Fixes: f6fdd8b2bd ("vmstate: introduce VMSTATE_VBUFFER_UINT64")
    Cc: Alexandr Moshkov <[email protected]>
    Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3675
    Signed-off-by: Michael S. Tsirkin <[email protected]>
    Message-ID: <
    801b1501ee10241f7ac49a10570d548352b36347.1784890517.git.mst@redhat.com>
    ---
     include/migration/vmstate.h |  5 ++++-
     migration/vmstate.c         | 31 ++++++++++++++++++++++++++++---
     2 files changed, 32 insertions(+), 4 deletions(-)

    diff --git a/include/migration/vmstate.h b/include/migration/vmstate.h
    index 1b7f295417..e7095cd977 100644
    --- a/include/migration/vmstate.h
    +++ b/include/migration/vmstate.h
    @@ -168,6 +168,9 @@ enum VMStateFlags {
          */
         VMS_ARRAY_OF_POINTER_AUTO_ALLOC = 0x10000,

    +    /* Use a uint64_t size field for VMS_VBUFFER instead of int32_t. */
    +    VMS_VBUFFER_UINT64              = 0x40000,
    +
         /* Marker for end of list */
         VMS_END                         = 0x20000,
     };
    @@ -788,7 +791,7 @@ extern const VMStateInfo vmstate_info_g_byte_array;
         .field_exists = (_test),                                         \
         .size_offset  = vmstate_offset_value(_state, _field_size, uint64_t),\
         .info         = &vmstate_info_buffer,                            \
    -    .flags        = VMS_VBUFFER | VMS_POINTER,                       \
    +    .flags        = VMS_VBUFFER | VMS_VBUFFER_UINT64 | VMS_POINTER,  \
         .offset       = offsetof(_state, _field),                        \
     }

    diff --git a/migration/vmstate.c b/migration/vmstate.c
    index 50ebe37845..d7f03a9f5b 100644
    --- a/migration/vmstate.c
    +++ b/migration/vmstate.c
    @@ -103,10 +103,24 @@ static int vmstate_size(void *opaque, const
    VMStateField *field)
         int size;

         if (field->flags & VMS_VBUFFER) {
    -        size = *(int32_t *)(opaque + field->size_offset);
    -        if (field->flags & VMS_MULTIPLY) {
    -            size *= field->size;
    +        uint64_t usize64;
    +
    +        if (field->flags & VMS_VBUFFER_UINT64) {
    +            usize64 = *(uint64_t *)(opaque + field->size_offset);
    +        } else {
    +            int32_t ssize32 = *(int32_t *)(opaque + field->size_offset);
    +            if (ssize32 < 0) {
    +                return -1;
    +            }
    +            usize64 = ssize32;
             }
    +        if (field->flags & VMS_MULTIPLY) {
    +            usize64 *= field->size;
    +        }
    +        if (usize64 > INT_MAX) {
    +            return -1;
    +        }
    +        size = usize64;
         } else if (field->flags & VMS_ARRAY_OF_POINTER) {
             /*
              * For an array of pointer, the each element is always size of a
    @@ -337,6 +351,11 @@ bool vmstate_load_vmsd(QEMUFile *f, const
    VMStateDescription *vmsd,
                 void *first_elem = opaque + field->offset;
                 int i, n_elems = vmstate_n_elems(opaque, field);
                 int size = vmstate_size(opaque, field);
    +            if (size < 0) {
    +                error_setg(errp, "VMState field '%s': invalid size",
    +                           field->name);
    +                return false;
    +            }

                 vmstate_handle_alloc(first_elem, field, opaque);
                 if (field->flags & VMS_POINTER) {
    @@ -661,6 +680,12 @@ static bool vmstate_save_vmsd_v(QEMUFile *f, const
    VMStateDescription *vmsd,
                 bool use_dynamic_array =
                     field->flags & VMS_ARRAY_OF_POINTER_AUTO_ALLOC;

    +            if (size < 0) {
    +                error_setg(errp, "VMState field '%s': invalid size",
    +                           field->name);
    +                ok = false;
    +                goto out;
    +            }
                 trace_vmstate_save_state_loop(vmsd->name, field->name,
    n_elems);
                 if (field->flags & VMS_POINTER) {
                     first_elem = *(void **)first_elem;
    --
    MST

Signature · 1 line

Peter Xu

Quoted 41 lines · Peter Xu

Quoted 11 lines · Michael S. Tsirkin

Quoted 7 lines · Peter Xu

This patch is migration only change and hasn't been reviewed.  Give us a few days to review it?
Can't do it now because it is on cellphone and I just bathed my son.

Please hold off merging.

Thanks.

OK. I'll drop this and you will merge it through the migration tree as appropriate?

Let's drop it first so it won't block this pull. I can definitely pick it up when ready, but I want to discuss on how to fix first. Which tree to pick it up isn't a huge matter to me, but the review.

We found a bunch of randomly introduced VMSTATE flags in the past, I used to remove some, at least my plan is in the future each time we introduce a new one (by request from other modules) we better justify it before landing too easily, in case it needs a revert again.

This vhost regression started 11.0 so IIUC we don't need to rush in 11.1. I just noticed I read that patch and didn't notice this, my bad to not have noticed..

For this one specifically..

Quoted 13 lines

Quoted 13 lines · On Sun, Jul 26, 2026, 5:29 p.m. Michael S. Tsirkin <[email protected]> wrote:

vhost user currently saves the inflight buffer to the migration stream using VMSTATE_VBUFFER_UINT64. The size is controlled by the vhost-user backend.

But the implementation of that is broken if size is >2G: it stores the buffer size in a uint64_t field, but vmstate_size() always reads the size field as int32_t regardless of the macro used. This, in turn, causes negative or truncated lengths on load, leading to undersized allocations and down the road out-of-bounds buffer access.

Quoted 4 lines

Quoted 1 line

Quoted 1 line

There's no practical reason to support such large sizes, so it's enough

If there's no real demand to use 2G or more, I suggest we change size to int32_t instead on the user, and revert f6fdd8b2 VMSTATE_VBUFFER_UINT64().

We can't just change it we'll need some tricks to avoid breaking existing migration format. I don't see how it will be much simpler if you take that into account.

Quoted 12 lines

Fabiano and I were looking at rest 20+ possible security related bugs in the past 1-2 weeks, I've some patches to be posted for 11.2 too when we went through all of them. One relevant patch I haven't sent but will do soon:

https://gitlab.com/peterx/qemu/-/commit/afd2cb25defdf78a4ab5279cc16634884792c57a

We encountered quite a few of possible over-allocation on destionation side by manipulating on-wire length field like this one, I believe Fabiano is looking at how to further limit that from 2G if ever possible per-user.

Quoted 3 lines

I'm not sure if that idea will fly, but I think anything bigger than 2G definitely is not suggested for now when it's only for a type match not real demand..

Frankly 2G is crazy too. I see little reason to focus specifically on >2G.

Quoted 7 lines

I believe VMSTATE_VBUFFER_UINT32 is problematic on its own too, I'll see how to fix that. That one is slightly easier, worst case is we bail out for 2G (hence ignore bit 31, which shouldn't be used in reality for legit users), but I'll think about it.

Quoted 1 line

Thanks,

I just do not see (almost) any case where migration destination does not know the actual size needed, or at least
an upper bound on such.

Quoted 114 lines

Quoted 111 lines

Quoted 110 lines

    to validate: read the field as uint64_t when VMS_VBUFFER_UINT64 is set,
    reject negative or oversized values, and propagate errors to
    vmstate_load_vmsd().

    Note: the large value is coming from the backend, not guest, so this
    shouldn't be considered a security issue. The CVE was assigned before
    the qemu security policy was updated to exclude this class of bugs.

    Fixes: CVE-2026-6426
    Fixes: f6fdd8b2bd ("vmstate: introduce VMSTATE_VBUFFER_UINT64")
    Cc: Alexandr Moshkov <[email protected]>
    Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3675
    Signed-off-by: Michael S. Tsirkin <[email protected]>
    Message-ID: <
    801b1501ee10241f7ac49a10570d548352b36347.1784890517.git.mst@redhat.com>
    ---
     include/migration/vmstate.h |  5 ++++-
     migration/vmstate.c         | 31 ++++++++++++++++++++++++++++---
     2 files changed, 32 insertions(+), 4 deletions(-)

    diff --git a/include/migration/vmstate.h b/include/migration/vmstate.h
    index 1b7f295417..e7095cd977 100644
    --- a/include/migration/vmstate.h
    +++ b/include/migration/vmstate.h
    @@ -168,6 +168,9 @@ enum VMStateFlags {
          */
         VMS_ARRAY_OF_POINTER_AUTO_ALLOC = 0x10000,

    +    /* Use a uint64_t size field for VMS_VBUFFER instead of int32_t. */
    +    VMS_VBUFFER_UINT64              = 0x40000,
    +
         /* Marker for end of list */
         VMS_END                         = 0x20000,
     };
    @@ -788,7 +791,7 @@ extern const VMStateInfo vmstate_info_g_byte_array;
         .field_exists = (_test),                                         \
         .size_offset  = vmstate_offset_value(_state, _field_size, uint64_t),\
         .info         = &vmstate_info_buffer,                            \
    -    .flags        = VMS_VBUFFER | VMS_POINTER,                       \
    +    .flags        = VMS_VBUFFER | VMS_VBUFFER_UINT64 | VMS_POINTER,  \
         .offset       = offsetof(_state, _field),                        \
     }

    diff --git a/migration/vmstate.c b/migration/vmstate.c
    index 50ebe37845..d7f03a9f5b 100644
    --- a/migration/vmstate.c
    +++ b/migration/vmstate.c
    @@ -103,10 +103,24 @@ static int vmstate_size(void *opaque, const
    VMStateField *field)
         int size;

         if (field->flags & VMS_VBUFFER) {
    -        size = *(int32_t *)(opaque + field->size_offset);
    -        if (field->flags & VMS_MULTIPLY) {
    -            size *= field->size;
    +        uint64_t usize64;
    +
    +        if (field->flags & VMS_VBUFFER_UINT64) {
    +            usize64 = *(uint64_t *)(opaque + field->size_offset);
    +        } else {
    +            int32_t ssize32 = *(int32_t *)(opaque + field->size_offset);
    +            if (ssize32 < 0) {
    +                return -1;
    +            }
    +            usize64 = ssize32;
             }
    +        if (field->flags & VMS_MULTIPLY) {
    +            usize64 *= field->size;
    +        }
    +        if (usize64 > INT_MAX) {
    +            return -1;
    +        }
    +        size = usize64;
         } else if (field->flags & VMS_ARRAY_OF_POINTER) {
             /*
              * For an array of pointer, the each element is always size of a
    @@ -337,6 +351,11 @@ bool vmstate_load_vmsd(QEMUFile *f, const
    VMStateDescription *vmsd,
                 void *first_elem = opaque + field->offset;
                 int i, n_elems = vmstate_n_elems(opaque, field);
                 int size = vmstate_size(opaque, field);
    +            if (size < 0) {
    +                error_setg(errp, "VMState field '%s': invalid size",
    +                           field->name);
    +                return false;
    +            }

                 vmstate_handle_alloc(first_elem, field, opaque);
                 if (field->flags & VMS_POINTER) {
    @@ -661,6 +680,12 @@ static bool vmstate_save_vmsd_v(QEMUFile *f, const
    VMStateDescription *vmsd,
                 bool use_dynamic_array =
                     field->flags & VMS_ARRAY_OF_POINTER_AUTO_ALLOC;

    +            if (size < 0) {
    +                error_setg(errp, "VMState field '%s': invalid size",
    +                           field->name);
    +                ok = false;
    +                goto out;
    +            }
                 trace_vmstate_save_state_loop(vmsd->name, field->name,
    n_elems);
                 if (field->flags & VMS_POINTER) {
                     first_elem = *(void **)first_elem;
    --
    MST

Signature · 1 line

Peter Xu

Quoted 44 lines · Michael S. Tsirkin

Quoted 43 lines · Peter Xu

Quoted 11 lines · Michael S. Tsirkin

Quoted 7 lines · Peter Xu

This patch is migration only change and hasn't been reviewed.  Give us a few days to review it?
Can't do it now because it is on cellphone and I just bathed my son.

Please hold off merging.

Thanks.

OK. I'll drop this and you will merge it through the migration tree as appropriate?

Let's drop it first so it won't block this pull. I can definitely pick it up when ready, but I want to discuss on how to fix first. Which tree to pick it up isn't a huge matter to me, but the review.

We found a bunch of randomly introduced VMSTATE flags in the past, I used to remove some, at least my plan is in the future each time we introduce a new one (by request from other modules) we better justify it before landing too easily, in case it needs a revert again.

This vhost regression started 11.0 so IIUC we don't need to rush in 11.1. I just noticed I read that patch and didn't notice this, my bad to not have noticed..

For this one specifically..

Quoted 14 lines

Quoted 14 lines · On Sun, Jul 26, 2026, 5:29 p.m. Michael S. Tsirkin <[email protected]> wrote:

vhost user currently saves the inflight buffer to the migration stream using VMSTATE_VBUFFER_UINT64. The size is controlled by the vhost-user backend.

But the implementation of that is broken if size is >2G: it stores the buffer size in a uint64_t field, but vmstate_size() always reads the size field as int32_t regardless of the macro used. This, in turn, causes negative or truncated lengths on load, leading to undersized allocations and down the road out-of-bounds buffer access.

There's no practical reason to support such large sizes, so it's enough

Quoted 6 lines

Quoted 2 lines

If there's no real demand to use 2G or more, I suggest we change size to int32_t instead on the user, and revert f6fdd8b2 VMSTATE_VBUFFER_UINT64().

We can't just change it we'll need some tricks to avoid breaking existing migration format. I don't see how it will be much simpler if you take that into account.

It's not part of the stream, right?

Here IIUC the VMSD field "size" only hard-coded the binary offset to fetch the int32_t from the object* pointer. IIUC we can simply change it to int32_t and IIUC it will be able to recv stream from src with uint64_t. The stream shouldn't be affected when e.g. we migrate from an older QEMU.

Quoted 12 lines

Quoted 12 lines

Fabiano and I were looking at rest 20+ possible security related bugs in the past 1-2 weeks, I've some patches to be posted for 11.2 too when we went through all of them. One relevant patch I haven't sent but will do soon:

https://gitlab.com/peterx/qemu/-/commit/afd2cb25defdf78a4ab5279cc16634884792c57a

We encountered quite a few of possible over-allocation on destionation side by manipulating on-wire length field like this one, I believe Fabiano is looking at how to further limit that from 2G if ever possible per-user.

Quoted 5 lines

Quoted 3 lines

I'm not sure if that idea will fly, but I think anything bigger than 2G definitely is not suggested for now when it's only for a type match not real demand..

Frankly 2G is crazy too. I see little reason to focus specifically on >2G.

Yeah..

Quoted 7 lines

Quoted 7 lines

I believe VMSTATE_VBUFFER_UINT32 is problematic on its own too, I'll see how to fix that. That one is slightly easier, worst case is we bail out for 2G (hence ignore bit 31, which shouldn't be used in reality for legit users), but I'll think about it.

Quoted 5 lines

Quoted 1 line

Thanks,

I just do not see (almost) any case where migration destination does not know the actual size needed, or at least
an upper bound on such.

In many cases we transfer the length first then the array following that with the length. That's a common trick we played like vhost here.

The upper bound is indeed a challenge, I confess I don't know an answer, and we will need to be careful on adding anything that might break a legit user. I believe Fabiano might have some better clue there, so I'd leave it to him until I can read his patches.

Thanks,

Quoted 115 lines

Quoted 114 lines

Quoted 111 lines

Quoted 110 lines

    to validate: read the field as uint64_t when VMS_VBUFFER_UINT64 is set,
    reject negative or oversized values, and propagate errors to
    vmstate_load_vmsd().

    Note: the large value is coming from the backend, not guest, so this
    shouldn't be considered a security issue. The CVE was assigned before
    the qemu security policy was updated to exclude this class of bugs.

    Fixes: CVE-2026-6426
    Fixes: f6fdd8b2bd ("vmstate: introduce VMSTATE_VBUFFER_UINT64")
    Cc: Alexandr Moshkov <[email protected]>
    Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3675
    Signed-off-by: Michael S. Tsirkin <[email protected]>
    Message-ID: <
    801b1501ee10241f7ac49a10570d548352b36347.1784890517.git.mst@redhat.com>
    ---
     include/migration/vmstate.h |  5 ++++-
     migration/vmstate.c         | 31 ++++++++++++++++++++++++++++---
     2 files changed, 32 insertions(+), 4 deletions(-)

    diff --git a/include/migration/vmstate.h b/include/migration/vmstate.h
    index 1b7f295417..e7095cd977 100644
    --- a/include/migration/vmstate.h
    +++ b/include/migration/vmstate.h
    @@ -168,6 +168,9 @@ enum VMStateFlags {
          */
         VMS_ARRAY_OF_POINTER_AUTO_ALLOC = 0x10000,

    +    /* Use a uint64_t size field for VMS_VBUFFER instead of int32_t. */
    +    VMS_VBUFFER_UINT64              = 0x40000,
    +
         /* Marker for end of list */
         VMS_END                         = 0x20000,
     };
    @@ -788,7 +791,7 @@ extern const VMStateInfo vmstate_info_g_byte_array;
         .field_exists = (_test),                                         \
         .size_offset  = vmstate_offset_value(_state, _field_size, uint64_t),\
         .info         = &vmstate_info_buffer,                            \
    -    .flags        = VMS_VBUFFER | VMS_POINTER,                       \
    +    .flags        = VMS_VBUFFER | VMS_VBUFFER_UINT64 | VMS_POINTER,  \
         .offset       = offsetof(_state, _field),                        \
     }

    diff --git a/migration/vmstate.c b/migration/vmstate.c
    index 50ebe37845..d7f03a9f5b 100644
    --- a/migration/vmstate.c
    +++ b/migration/vmstate.c
    @@ -103,10 +103,24 @@ static int vmstate_size(void *opaque, const
    VMStateField *field)
         int size;

         if (field->flags & VMS_VBUFFER) {
    -        size = *(int32_t *)(opaque + field->size_offset);
    -        if (field->flags & VMS_MULTIPLY) {
    -            size *= field->size;
    +        uint64_t usize64;
    +
    +        if (field->flags & VMS_VBUFFER_UINT64) {
    +            usize64 = *(uint64_t *)(opaque + field->size_offset);
    +        } else {
    +            int32_t ssize32 = *(int32_t *)(opaque + field->size_offset);
    +            if (ssize32 < 0) {
    +                return -1;
    +            }
    +            usize64 = ssize32;
             }
    +        if (field->flags & VMS_MULTIPLY) {
    +            usize64 *= field->size;
    +        }
    +        if (usize64 > INT_MAX) {
    +            return -1;
    +        }
    +        size = usize64;
         } else if (field->flags & VMS_ARRAY_OF_POINTER) {
             /*
              * For an array of pointer, the each element is always size of a
    @@ -337,6 +351,11 @@ bool vmstate_load_vmsd(QEMUFile *f, const
    VMStateDescription *vmsd,
                 void *first_elem = opaque + field->offset;
                 int i, n_elems = vmstate_n_elems(opaque, field);
                 int size = vmstate_size(opaque, field);
    +            if (size < 0) {
    +                error_setg(errp, "VMState field '%s': invalid size",
    +                           field->name);
    +                return false;
    +            }

                 vmstate_handle_alloc(first_elem, field, opaque);
                 if (field->flags & VMS_POINTER) {
    @@ -661,6 +680,12 @@ static bool vmstate_save_vmsd_v(QEMUFile *f, const
    VMStateDescription *vmsd,
                 bool use_dynamic_array =
                     field->flags & VMS_ARRAY_OF_POINTER_AUTO_ALLOC;

    +            if (size < 0) {
    +                error_setg(errp, "VMState field '%s': invalid size",
    +                           field->name);
    +                ok = false;
    +                goto out;
    +            }
                 trace_vmstate_save_state_loop(vmsd->name, field->name,
    n_elems);
                 if (field->flags & VMS_POINTER) {
                     first_elem = *(void **)first_elem;
    --
    MST

Signature · 1 line

Peter Xu

Signature · 1 line

Peter Xu

Quoted 52 lines · Peter Xu

Quoted 50 lines · Michael S. Tsirkin

Quoted 41 lines · Peter Xu

Quoted 11 lines · Michael S. Tsirkin

Quoted 7 lines · Peter Xu

This patch is migration only change and hasn't been reviewed.  Give us a few days to review it?
Can't do it now because it is on cellphone and I just bathed my son.

Please hold off merging.

Thanks.

OK. I'll drop this and you will merge it through the migration tree as appropriate?

Let's drop it first so it won't block this pull. I can definitely pick it up when ready, but I want to discuss on how to fix first. Which tree to pick it up isn't a huge matter to me, but the review.

We found a bunch of randomly introduced VMSTATE flags in the past, I used to remove some, at least my plan is in the future each time we introduce a new one (by request from other modules) we better justify it before landing too easily, in case it needs a revert again.

This vhost regression started 11.0 so IIUC we don't need to rush in 11.1. I just noticed I read that patch and didn't notice this, my bad to not have noticed..

For this one specifically..

Quoted 13 lines

Quoted 13 lines · On Sun, Jul 26, 2026, 5:29 p.m. Michael S. Tsirkin <[email protected]> wrote:

vhost user currently saves the inflight buffer to the migration stream using VMSTATE_VBUFFER_UINT64. The size is controlled by the vhost-user backend.

But the implementation of that is broken if size is >2G: it stores the buffer size in a uint64_t field, but vmstate_size() always reads the size field as int32_t regardless of the macro used. This, in turn, causes negative or truncated lengths on load, leading to undersized allocations and down the road out-of-bounds buffer access.

Quoted 4 lines

Quoted 1 line

Quoted 1 line

There's no practical reason to support such large sizes, so it's enough

If there's no real demand to use 2G or more, I suggest we change size to int32_t instead on the user, and revert f6fdd8b2 VMSTATE_VBUFFER_UINT64().

We can't just change it we'll need some tricks to avoid breaking existing migration format. I don't see how it will be much simpler if you take that into account.

Quoted 1 line

It's not part of the stream, right?

I think it is?

VMSTATE_UINT64(size, struct vhost_inflight) at hw/virtio/vhost.c eventually leads to qemu_put_be64s / qemu_get_be64s in migration/vmstate-types.c

Quoted 4 lines

Here IIUC the VMSD field "size" only hard-coded the binary offset to fetch the int32_t from the object* pointer. IIUC we can simply change it to int32_t and IIUC it will be able to recv stream from src with uint64_t. The stream shouldn't be affected when e.g. we migrate from an older QEMU.

I don't really know what you mean. Yes vmsd macros tie migration stream and the storage format. it kinda makes it easy to add one but the cost is issues like this.

Quoted 29 lines

Quoted 12 lines

Quoted 12 lines

Fabiano and I were looking at rest 20+ possible security related bugs in the past 1-2 weeks, I've some patches to be posted for 11.2 too when we went through all of them. One relevant patch I haven't sent but will do soon:

https://gitlab.com/peterx/qemu/-/commit/afd2cb25defdf78a4ab5279cc16634884792c57a

We encountered quite a few of possible over-allocation on destionation side by manipulating on-wire length field like this one, I believe Fabiano is looking at how to further limit that from 2G if ever possible per-user.

Quoted 5 lines

Quoted 3 lines

I'm not sure if that idea will fly, but I think anything bigger than 2G definitely is not suggested for now when it's only for a type match not real demand..

Frankly 2G is crazy too. I see little reason to focus specifically on >2G.

Yeah..

Quoted 9 lines

Quoted 8 lines

I believe VMSTATE_VBUFFER_UINT32 is problematic on its own too, I'll see how to fix that. That one is slightly easier, worst case is we bail out for 2G (hence ignore bit 31, which shouldn't be used in reality for legit users), but I'll think about it.

Thanks,

Quoted 6 lines

Quoted 3 lines

I just do not see (almost) any case where migration destination does not know the actual size needed, or at least
an upper bound on such.

In many cases we transfer the length first then the array following that with the length. That's a common trick we played like vhost here.

we need to start specifying the cap for these.

The upper bound is indeed a challenge, I confess I don't know an answer, and we will need to be careful on adding anything that might break a legit user. I believe Fabiano might have some better clue there, so I'd leave it to him until I can read his patches.

Quoted 120 lines

Thanks,

Quoted 115 lines

Quoted 114 lines

Quoted 111 lines

Quoted 110 lines

    to validate: read the field as uint64_t when VMS_VBUFFER_UINT64 is set,
    reject negative or oversized values, and propagate errors to
    vmstate_load_vmsd().

    Note: the large value is coming from the backend, not guest, so this
    shouldn't be considered a security issue. The CVE was assigned before
    the qemu security policy was updated to exclude this class of bugs.

    Fixes: CVE-2026-6426
    Fixes: f6fdd8b2bd ("vmstate: introduce VMSTATE_VBUFFER_UINT64")
    Cc: Alexandr Moshkov <[email protected]>
    Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3675
    Signed-off-by: Michael S. Tsirkin <[email protected]>
    Message-ID: <
    801b1501ee10241f7ac49a10570d548352b36347.1784890517.git.mst@redhat.com>
    ---
     include/migration/vmstate.h |  5 ++++-
     migration/vmstate.c         | 31 ++++++++++++++++++++++++++++---
     2 files changed, 32 insertions(+), 4 deletions(-)

    diff --git a/include/migration/vmstate.h b/include/migration/vmstate.h
    index 1b7f295417..e7095cd977 100644
    --- a/include/migration/vmstate.h
    +++ b/include/migration/vmstate.h
    @@ -168,6 +168,9 @@ enum VMStateFlags {
          */
         VMS_ARRAY_OF_POINTER_AUTO_ALLOC = 0x10000,

    +    /* Use a uint64_t size field for VMS_VBUFFER instead of int32_t. */
    +    VMS_VBUFFER_UINT64              = 0x40000,
    +
         /* Marker for end of list */
         VMS_END                         = 0x20000,
     };
    @@ -788,7 +791,7 @@ extern const VMStateInfo vmstate_info_g_byte_array;
         .field_exists = (_test),                                         \
         .size_offset  = vmstate_offset_value(_state, _field_size, uint64_t),\
         .info         = &vmstate_info_buffer,                            \
    -    .flags        = VMS_VBUFFER | VMS_POINTER,                       \
    +    .flags        = VMS_VBUFFER | VMS_VBUFFER_UINT64 | VMS_POINTER,  \
         .offset       = offsetof(_state, _field),                        \
     }

    diff --git a/migration/vmstate.c b/migration/vmstate.c
    index 50ebe37845..d7f03a9f5b 100644
    --- a/migration/vmstate.c
    +++ b/migration/vmstate.c
    @@ -103,10 +103,24 @@ static int vmstate_size(void *opaque, const
    VMStateField *field)
         int size;

         if (field->flags & VMS_VBUFFER) {
    -        size = *(int32_t *)(opaque + field->size_offset);
    -        if (field->flags & VMS_MULTIPLY) {
    -            size *= field->size;
    +        uint64_t usize64;
    +
    +        if (field->flags & VMS_VBUFFER_UINT64) {
    +            usize64 = *(uint64_t *)(opaque + field->size_offset);
    +        } else {
    +            int32_t ssize32 = *(int32_t *)(opaque + field->size_offset);
    +            if (ssize32 < 0) {
    +                return -1;
    +            }
    +            usize64 = ssize32;
             }
    +        if (field->flags & VMS_MULTIPLY) {
    +            usize64 *= field->size;
    +        }
    +        if (usize64 > INT_MAX) {
    +            return -1;
    +        }
    +        size = usize64;
         } else if (field->flags & VMS_ARRAY_OF_POINTER) {
             /*
              * For an array of pointer, the each element is always size of a
    @@ -337,6 +351,11 @@ bool vmstate_load_vmsd(QEMUFile *f, const
    VMStateDescription *vmsd,
                 void *first_elem = opaque + field->offset;
                 int i, n_elems = vmstate_n_elems(opaque, field);
                 int size = vmstate_size(opaque, field);
    +            if (size < 0) {
    +                error_setg(errp, "VMState field '%s': invalid size",
    +                           field->name);
    +                return false;
    +            }

                 vmstate_handle_alloc(first_elem, field, opaque);
                 if (field->flags & VMS_POINTER) {
    @@ -661,6 +680,12 @@ static bool vmstate_save_vmsd_v(QEMUFile *f, const
    VMStateDescription *vmsd,
                 bool use_dynamic_array =
                     field->flags & VMS_ARRAY_OF_POINTER_AUTO_ALLOC;

    +            if (size < 0) {
    +                error_setg(errp, "VMState field '%s': invalid size",
    +                           field->name);
    +                ok = false;
    +                goto out;
    +            }
                 trace_vmstate_save_state_loop(vmsd->name, field->name,
    n_elems);
                 if (field->flags & VMS_POINTER) {
                     first_elem = *(void **)first_elem;
    --
    MST

Signature · 1 line

Peter Xu

Signature · 1 line

Peter Xu

Quoted 57 lines · Michael S. Tsirkin

Quoted 45 lines · Peter Xu

Quoted 44 lines · Michael S. Tsirkin

Quoted 43 lines · Peter Xu

Quoted 11 lines · Michael S. Tsirkin

Quoted 7 lines · Peter Xu

This patch is migration only change and hasn't been reviewed.  Give us a few days to review it?
Can't do it now because it is on cellphone and I just bathed my son.

Please hold off merging.

Thanks.

OK. I'll drop this and you will merge it through the migration tree as appropriate?

Let's drop it first so it won't block this pull. I can definitely pick it up when ready, but I want to discuss on how to fix first. Which tree to pick it up isn't a huge matter to me, but the review.

We found a bunch of randomly introduced VMSTATE flags in the past, I used to remove some, at least my plan is in the future each time we introduce a new one (by request from other modules) we better justify it before landing too easily, in case it needs a revert again.

This vhost regression started 11.0 so IIUC we don't need to rush in 11.1. I just noticed I read that patch and didn't notice this, my bad to not have noticed..

For this one specifically..

Quoted 14 lines

Quoted 14 lines · On Sun, Jul 26, 2026, 5:29 p.m. Michael S. Tsirkin <[email protected]> wrote:

vhost user currently saves the inflight buffer to the migration stream using VMSTATE_VBUFFER_UINT64. The size is controlled by the vhost-user backend.

But the implementation of that is broken if size is >2G: it stores the buffer size in a uint64_t field, but vmstate_size() always reads the size field as int32_t regardless of the macro used. This, in turn, causes negative or truncated lengths on load, leading to undersized allocations and down the road out-of-bounds buffer access.

There's no practical reason to support such large sizes, so it's enough

Quoted 8 lines

Quoted 6 lines

Quoted 2 lines

If there's no real demand to use 2G or more, I suggest we change size to int32_t instead on the user, and revert f6fdd8b2 VMSTATE_VBUFFER_UINT64().

We can't just change it we'll need some tricks to avoid breaking existing migration format. I don't see how it will be much simpler if you take that into account.

It's not part of the stream, right?

I think it is?

Quoted 3 lines

VMSTATE_UINT64(size, struct vhost_inflight) at hw/virtio/vhost.c eventually leads to qemu_put_be64s / qemu_get_be64s in migration/vmstate-types.c

The point is that this "size" is already included on the stream by itself, changing the VMSTATE_VBUFFER_UINT64 to int32 doesn't affect it.

There's a type_check that will complain during save that type(inflight->size) != INT32 (from the macro), but we can change that.

#define vmstate_offset_value(_state, _field, _type) \
(offsetof(_state, _field) + \
type_check(_type, typeof_field(_state, _field)))

Quoted 42 lines

Quoted 4 lines

Here IIUC the VMSD field "size" only hard-coded the binary offset to fetch the int32_t from the object* pointer. IIUC we can simply change it to int32_t and IIUC it will be able to recv stream from src with uint64_t. The stream shouldn't be affected when e.g. we migrate from an older QEMU.

I don't really know what you mean. Yes vmsd macros tie migration stream and the storage format. it kinda makes it easy to add one but the cost is issues like this.

Quoted 29 lines

Quoted 12 lines

Quoted 12 lines

Fabiano and I were looking at rest 20+ possible security related bugs in the past 1-2 weeks, I've some patches to be posted for 11.2 too when we went through all of them. One relevant patch I haven't sent but will do soon:

https://gitlab.com/peterx/qemu/-/commit/afd2cb25defdf78a4ab5279cc16634884792c57a

We encountered quite a few of possible over-allocation on destionation side by manipulating on-wire length field like this one, I believe Fabiano is looking at how to further limit that from 2G if ever possible per-user.

Quoted 5 lines

Quoted 3 lines

I'm not sure if that idea will fly, but I think anything bigger than 2G definitely is not suggested for now when it's only for a type match not real demand..

Frankly 2G is crazy too. I see little reason to focus specifically on >2G.

Yeah..

Quoted 9 lines

Quoted 8 lines

I believe VMSTATE_VBUFFER_UINT32 is problematic on its own too, I'll see how to fix that. That one is slightly easier, worst case is we bail out for 2G (hence ignore bit 31, which shouldn't be used in reality for legit users), but I'll think about it.

Thanks,

Quoted 9 lines

Quoted 6 lines

Quoted 3 lines

I just do not see (almost) any case where migration destination does not know the actual size needed, or at least
an upper bound on such.

In many cases we transfer the length first then the array following that with the length. That's a common trick we played like vhost here.

we need to start specifying the cap for these.

I agree. Most things will have a sane cap once you think hard enough. Of course, there's a risk of selecting a limit too low, but currently we can't even do that.

I think the first step is defining new macros so that every len/size/etc gets properly identified. The VMSTATE_VBUFFER_* are already a start, we can add an aditional member that doesn't go on the stream and check against it when loading.

Quoted 5 lines

The upper bound is indeed a challenge, I confess I don't know an answer, and we will need to be careful on adding anything that might break a legit user. I believe Fabiano might have some better clue there, so I'd leave it to him until I can read his patches.

I'm also trying to look ahead into how we'll apply whatever fix we come up with here to the pile of unstructured qemu_put|get_byte we have all over the place. I'm experimenting with how much code we can convert into VMStateDescription/VMStateField. The QEMU_VM_* flags themselves seem to be easy to do (then we version the vmstate, deprecate, etc).

Quoted 120 lines

Quoted 120 lines

Thanks,

Quoted 115 lines

Quoted 114 lines

Quoted 111 lines

Quoted 110 lines

    to validate: read the field as uint64_t when VMS_VBUFFER_UINT64 is set,
    reject negative or oversized values, and propagate errors to
    vmstate_load_vmsd().

    Note: the large value is coming from the backend, not guest, so this
    shouldn't be considered a security issue. The CVE was assigned before
    the qemu security policy was updated to exclude this class of bugs.

    Fixes: CVE-2026-6426
    Fixes: f6fdd8b2bd ("vmstate: introduce VMSTATE_VBUFFER_UINT64")
    Cc: Alexandr Moshkov <[email protected]>
    Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3675
    Signed-off-by: Michael S. Tsirkin <[email protected]>
    Message-ID: <
    801b1501ee10241f7ac49a10570d548352b36347.1784890517.git.mst@redhat.com>
    ---
     include/migration/vmstate.h |  5 ++++-
     migration/vmstate.c         | 31 ++++++++++++++++++++++++++++---
     2 files changed, 32 insertions(+), 4 deletions(-)

    diff --git a/include/migration/vmstate.h b/include/migration/vmstate.h
    index 1b7f295417..e7095cd977 100644
    --- a/include/migration/vmstate.h
    +++ b/include/migration/vmstate.h
    @@ -168,6 +168,9 @@ enum VMStateFlags {
          */
         VMS_ARRAY_OF_POINTER_AUTO_ALLOC = 0x10000,

    +    /* Use a uint64_t size field for VMS_VBUFFER instead of int32_t. */
    +    VMS_VBUFFER_UINT64              = 0x40000,
    +
         /* Marker for end of list */
         VMS_END                         = 0x20000,
     };
    @@ -788,7 +791,7 @@ extern const VMStateInfo vmstate_info_g_byte_array;
         .field_exists = (_test),                                         \
         .size_offset  = vmstate_offset_value(_state, _field_size, uint64_t),\
         .info         = &vmstate_info_buffer,                            \
    -    .flags        = VMS_VBUFFER | VMS_POINTER,                       \
    +    .flags        = VMS_VBUFFER | VMS_VBUFFER_UINT64 | VMS_POINTER,  \
         .offset       = offsetof(_state, _field),                        \
     }

    diff --git a/migration/vmstate.c b/migration/vmstate.c
    index 50ebe37845..d7f03a9f5b 100644
    --- a/migration/vmstate.c
    +++ b/migration/vmstate.c
    @@ -103,10 +103,24 @@ static int vmstate_size(void *opaque, const
    VMStateField *field)
         int size;

         if (field->flags & VMS_VBUFFER) {
    -        size = *(int32_t *)(opaque + field->size_offset);
    -        if (field->flags & VMS_MULTIPLY) {
    -            size *= field->size;
    +        uint64_t usize64;
    +
    +        if (field->flags & VMS_VBUFFER_UINT64) {
    +            usize64 = *(uint64_t *)(opaque + field->size_offset);
    +        } else {
    +            int32_t ssize32 = *(int32_t *)(opaque + field->size_offset);
    +            if (ssize32 < 0) {
    +                return -1;
    +            }
    +            usize64 = ssize32;
             }
    +        if (field->flags & VMS_MULTIPLY) {
    +            usize64 *= field->size;
    +        }
    +        if (usize64 > INT_MAX) {
    +            return -1;
    +        }
    +        size = usize64;
         } else if (field->flags & VMS_ARRAY_OF_POINTER) {
             /*
              * For an array of pointer, the each element is always size of a
    @@ -337,6 +351,11 @@ bool vmstate_load_vmsd(QEMUFile *f, const
    VMStateDescription *vmsd,
                 void *first_elem = opaque + field->offset;
                 int i, n_elems = vmstate_n_elems(opaque, field);
                 int size = vmstate_size(opaque, field);
    +            if (size < 0) {
    +                error_setg(errp, "VMState field '%s': invalid size",
    +                           field->name);
    +                return false;
    +            }

                 vmstate_handle_alloc(first_elem, field, opaque);
                 if (field->flags & VMS_POINTER) {
    @@ -661,6 +680,12 @@ static bool vmstate_save_vmsd_v(QEMUFile *f, const
    VMStateDescription *vmsd,
                 bool use_dynamic_array =
                     field->flags & VMS_ARRAY_OF_POINTER_AUTO_ALLOC;

    +            if (size < 0) {
    +                error_setg(errp, "VMState field '%s': invalid size",
    +                           field->name);
    +                ok = false;
    +                goto out;
    +            }
                 trace_vmstate_save_state_loop(vmsd->name, field->name,
    n_elems);
                 if (field->flags & VMS_POINTER) {
                     first_elem = *(void **)first_elem;
    --
    MST

Signature · 1 line

Peter Xu

Signature · 1 line

Peter Xu

Quoted 63 lines · Fabiano Rosas

Quoted 60 lines · Michael S. Tsirkin

Quoted 45 lines · Peter Xu

Quoted 44 lines · Michael S. Tsirkin

Quoted 43 lines · Peter Xu

Quoted 11 lines · Michael S. Tsirkin

Quoted 7 lines · Peter Xu

This patch is migration only change and hasn't been reviewed.  Give us a few days to review it?
Can't do it now because it is on cellphone and I just bathed my son.

Please hold off merging.

Thanks.

OK. I'll drop this and you will merge it through the migration tree as appropriate?

Let's drop it first so it won't block this pull. I can definitely pick it up when ready, but I want to discuss on how to fix first. Which tree to pick it up isn't a huge matter to me, but the review.

We found a bunch of randomly introduced VMSTATE flags in the past, I used to remove some, at least my plan is in the future each time we introduce a new one (by request from other modules) we better justify it before landing too easily, in case it needs a revert again.

This vhost regression started 11.0 so IIUC we don't need to rush in 11.1. I just noticed I read that patch and didn't notice this, my bad to not have noticed..

For this one specifically..

Quoted 14 lines

Quoted 14 lines · On Sun, Jul 26, 2026, 5:29 p.m. Michael S. Tsirkin <[email protected]> wrote:

vhost user currently saves the inflight buffer to the migration stream using VMSTATE_VBUFFER_UINT64. The size is controlled by the vhost-user backend.

But the implementation of that is broken if size is >2G: it stores the buffer size in a uint64_t field, but vmstate_size() always reads the size field as int32_t regardless of the macro used. This, in turn, causes negative or truncated lengths on load, leading to undersized allocations and down the road out-of-bounds buffer access.

There's no practical reason to support such large sizes, so it's enough

Quoted 8 lines

Quoted 6 lines

Quoted 2 lines

If there's no real demand to use 2G or more, I suggest we change size to int32_t instead on the user, and revert f6fdd8b2 VMSTATE_VBUFFER_UINT64().

We can't just change it we'll need some tricks to avoid breaking existing migration format. I don't see how it will be much simpler if you take that into account.

It's not part of the stream, right?

I think it is?

VMSTATE_UINT64(size, struct vhost_inflight) at hw/virtio/vhost.c eventually leads to qemu_put_be64s / qemu_get_be64s in migration/vmstate-types.c

Quoted 3 lines

The point is that this "size" is already included on the stream by itself, changing the VMSTATE_VBUFFER_UINT64 to int32 doesn't affect it.

I'd use uint32_t there is no reason to use signed.

Quoted 10 lines

There's a type_check that will complain during save that type(inflight->size) != INT32 (from the macro), but we can change that.

#define vmstate_offset_value(_state, _field, _type) \
(offsetof(_state, _field) + \
type_check(_type, typeof_field(_state, _field)))

All i am saying we need to keep some special macro we can not just change virtio to replace VMSTATE_VBUFFER_UINT64 with VMSTATE_VBUFFER_UINT32

whether it's a flag or whatever, I don't much care.

I assigned the bug in question to Peter and you guys decide how to handle it.

Quoted 54 lines

Quoted 44 lines

Quoted 6 lines

Here IIUC the VMSD field "size" only hard-coded the binary offset to fetch the int32_t from the object* pointer. IIUC we can simply change it to int32_t and IIUC it will be able to recv stream from src with uint64_t. The stream shouldn't be affected when e.g. we migrate from an older QEMU.

I don't really know what you mean. Yes vmsd macros tie migration stream and the storage format. it kinda makes it easy to add one but the cost is issues like this.

Quoted 29 lines

Quoted 12 lines

Quoted 12 lines

Fabiano and I were looking at rest 20+ possible security related bugs in the past 1-2 weeks, I've some patches to be posted for 11.2 too when we went through all of them. One relevant patch I haven't sent but will do soon:

https://gitlab.com/peterx/qemu/-/commit/afd2cb25defdf78a4ab5279cc16634884792c57a

We encountered quite a few of possible over-allocation on destionation side by manipulating on-wire length field like this one, I believe Fabiano is looking at how to further limit that from 2G if ever possible per-user.

Quoted 5 lines

Quoted 3 lines

I'm not sure if that idea will fly, but I think anything bigger than 2G definitely is not suggested for now when it's only for a type match not real demand..

Frankly 2G is crazy too. I see little reason to focus specifically on >2G.

Yeah..

Quoted 9 lines

Quoted 8 lines

I believe VMSTATE_VBUFFER_UINT32 is problematic on its own too, I'll see how to fix that. That one is slightly easier, worst case is we bail out for 2G (hence ignore bit 31, which shouldn't be used in reality for legit users), but I'll think about it.

Thanks,

Quoted 9 lines

Quoted 6 lines

Quoted 3 lines

I just do not see (almost) any case where migration destination does not know the actual size needed, or at least
an upper bound on such.

In many cases we transfer the length first then the array following that with the length. That's a common trick we played like vhost here.

we need to start specifying the cap for these.

Quoted 8 lines

I agree. Most things will have a sane cap once you think hard enough. Of course, there's a risk of selecting a limit too low, but currently we can't even do that.

I think the first step is defining new macros so that every len/size/etc gets properly identified. The VMSTATE_VBUFFER_* are already a start, we can add an aditional member that doesn't go on the stream and check against it when loading.

right

Quoted 11 lines

Quoted 5 lines

The upper bound is indeed a challenge, I confess I don't know an answer, and we will need to be careful on adding anything that might break a legit user. I believe Fabiano might have some better clue there, so I'd leave it to him until I can read his patches.

I'm also trying to look ahead into how we'll apply whatever fix we come up with here to the pile of unstructured qemu_put|get_byte we have all over the place. I'm experimenting with how much code we can convert into VMStateDescription/VMStateField. The QEMU_VM_* flags themselves seem to be easy to do (then we version the vmstate, deprecate, etc).

Frankly if you are bothering with tree wide changes, can we please finally do something forward compatible that will allow us to add extra information without breaking compat?
Or ideally just self delimiting format, one can dream...

Quoted 122 lines

Quoted 122 lines

Quoted 122 lines

Thanks,

Quoted 115 lines

Quoted 114 lines

Quoted 111 lines

Quoted 110 lines

    to validate: read the field as uint64_t when VMS_VBUFFER_UINT64 is set,
    reject negative or oversized values, and propagate errors to
    vmstate_load_vmsd().

    Note: the large value is coming from the backend, not guest, so this
    shouldn't be considered a security issue. The CVE was assigned before
    the qemu security policy was updated to exclude this class of bugs.

    Fixes: CVE-2026-6426
    Fixes: f6fdd8b2bd ("vmstate: introduce VMSTATE_VBUFFER_UINT64")
    Cc: Alexandr Moshkov <[email protected]>
    Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3675
    Signed-off-by: Michael S. Tsirkin <[email protected]>
    Message-ID: <
    801b1501ee10241f7ac49a10570d548352b36347.1784890517.git.mst@redhat.com>
    ---
     include/migration/vmstate.h |  5 ++++-
     migration/vmstate.c         | 31 ++++++++++++++++++++++++++++---
     2 files changed, 32 insertions(+), 4 deletions(-)

    diff --git a/include/migration/vmstate.h b/include/migration/vmstate.h
    index 1b7f295417..e7095cd977 100644
    --- a/include/migration/vmstate.h
    +++ b/include/migration/vmstate.h
    @@ -168,6 +168,9 @@ enum VMStateFlags {
          */
         VMS_ARRAY_OF_POINTER_AUTO_ALLOC = 0x10000,

    +    /* Use a uint64_t size field for VMS_VBUFFER instead of int32_t. */
    +    VMS_VBUFFER_UINT64              = 0x40000,
    +
         /* Marker for end of list */
         VMS_END                         = 0x20000,
     };
    @@ -788,7 +791,7 @@ extern const VMStateInfo vmstate_info_g_byte_array;
         .field_exists = (_test),                                         \
         .size_offset  = vmstate_offset_value(_state, _field_size, uint64_t),\
         .info         = &vmstate_info_buffer,                            \
    -    .flags        = VMS_VBUFFER | VMS_POINTER,                       \
    +    .flags        = VMS_VBUFFER | VMS_VBUFFER_UINT64 | VMS_POINTER,  \
         .offset       = offsetof(_state, _field),                        \
     }

    diff --git a/migration/vmstate.c b/migration/vmstate.c
    index 50ebe37845..d7f03a9f5b 100644
    --- a/migration/vmstate.c
    +++ b/migration/vmstate.c
    @@ -103,10 +103,24 @@ static int vmstate_size(void *opaque, const
    VMStateField *field)
         int size;

         if (field->flags & VMS_VBUFFER) {
    -        size = *(int32_t *)(opaque + field->size_offset);
    -        if (field->flags & VMS_MULTIPLY) {
    -            size *= field->size;
    +        uint64_t usize64;
    +
    +        if (field->flags & VMS_VBUFFER_UINT64) {
    +            usize64 = *(uint64_t *)(opaque + field->size_offset);
    +        } else {
    +            int32_t ssize32 = *(int32_t *)(opaque + field->size_offset);
    +            if (ssize32 < 0) {
    +                return -1;
    +            }
    +            usize64 = ssize32;
             }
    +        if (field->flags & VMS_MULTIPLY) {
    +            usize64 *= field->size;
    +        }
    +        if (usize64 > INT_MAX) {
    +            return -1;
    +        }
    +        size = usize64;
         } else if (field->flags & VMS_ARRAY_OF_POINTER) {
             /*
              * For an array of pointer, the each element is always size of a
    @@ -337,6 +351,11 @@ bool vmstate_load_vmsd(QEMUFile *f, const
    VMStateDescription *vmsd,
                 void *first_elem = opaque + field->offset;
                 int i, n_elems = vmstate_n_elems(opaque, field);
                 int size = vmstate_size(opaque, field);
    +            if (size < 0) {
    +                error_setg(errp, "VMState field '%s': invalid size",
    +                           field->name);
    +                return false;
    +            }

                 vmstate_handle_alloc(first_elem, field, opaque);
                 if (field->flags & VMS_POINTER) {
    @@ -661,6 +680,12 @@ static bool vmstate_save_vmsd_v(QEMUFile *f, const
    VMStateDescription *vmsd,
                 bool use_dynamic_array =
                     field->flags & VMS_ARRAY_OF_POINTER_AUTO_ALLOC;

    +            if (size < 0) {
    +                error_setg(errp, "VMState field '%s': invalid size",
    +                           field->name);
    +                ok = false;
    +                goto out;
    +            }
                 trace_vmstate_save_state_loop(vmsd->name, field->name,
    n_elems);
                 if (field->flags & VMS_POINTER) {
                     first_elem = *(void **)first_elem;
    --
    MST

Signature · 1 line

Peter Xu

Signature · 1 line

Peter Xu

The following changes since commit cbd42e2b75b23953a9bdb073c8531518b1bd6163:

Update version for v11.1.0-rc1 release (2026-07-21 13:18:25 -0400)

are available in the Git repository at:

https://git.kernel.org/pub/scm/virt/kvm/mst/qemu.git tags/for_upstream

for you to fetch changes up to 13342b9c4104f3bf93c2e52e7de4b383971d7bd6:

backends/rng: cap request size to avoid oversized allocation (2026-07-26 17:26:41 -0400)

----------------------------------------------------------------
pci, vhost, virtio, iommu: bugfixes

Fixes all over the place, including a bunch of CVE fixes.

Signed-off-by Michael S. Tsirkin <[email protected]>

----------------------------------------------------------------
Clément MATHIEU--DRIF (1):
intel_iommu: Check address mask before using it in pasid-based iotlb invalidation

GuoHan Zhao (1):
hw/virtio/vdpa-dev: pass set_config buffer to vhost backend

Haotian Jiang (1):
hw/cxl: fix OOB access in cxl_doe_cdat_rsp via entry_handle

Laurent Vivier (4):
hw/virtio: reject zero-length packed indirect descriptor table hw/net/virtio-net: Protect from DMA re-entrancy bugs hw/virtio-rng: Fix host use-after-free (CVE-2026-50624) backends/rng: cap request size to avoid oversized allocation

Manos Pitsidianakis (2):
virtio-snd: check rx buffer descriptor size
virtio-snd: check for overflow before g_malloc0

Michael S. Tsirkin (18):
virtio: use masked features with set_features_ex
virtio-net: fix OOB read in RSC receive path
virtio-net: fix short frame OOB read in receive_filter()
libvhost-user: protect against OOB writes in vu_set_inflight_fd
libvhost-user: protect against OOB vring queue access
vhost: do not crash on ring map failure
virtio-scsi: fix SCSIRequest leak on a bad request
virtio-mmio: fix QUEUE_NUM_MAX
virtio: fix queue size validation against allocated maximum
virtio: stop migrating num_default, validate vring.num on load
virtio: fail early on bad config_len in migration
vhost-user: assert nregions within limit
virtio-pmem: wait for flush requests on unrealize
libvhost-user: validate last_batch_head in vu_check_queue_inflights
libvhost-user: fix heap overflow in vu_check_queue_inflights
vmstate: fix type confusion in vmstate_size() for VMSTATE_VBUFFER_UINT64
libvduse: validate vq size
virtio-iommu: fix OOM due to unbounded call_rcu

Peter Maydell (3):
hw/pci-host/q35.c: Always initialize smram-region even if SMM disabled hw/pci-host/q35.c: Factor out creation of SMRAM MRs hw/pci-host/q35.c: Avoid early return in mch_write_config()

 include/hw/scsi/scsi.h                    |   1 +
 include/hw/virtio/virtio-bus.h            |   1 +
 include/hw/virtio/virtio-iommu.h          |   1 +
 include/hw/virtio/virtio-mmio.h           |   1 +
 include/hw/virtio/virtio-pmem.h           |   1 +
 include/migration/vmstate.h               |   5 +-
 include/system/rng.h                      |  14 ++++
 backends/rng.c                            |  21 +++++-
 hw/audio/virtio-snd.c                     |  24 +++++--
 hw/core/machine.c                         |   1 +
 hw/i386/intel_iommu.c                     |   9 +++
 hw/mem/cxl_type3.c                        |   3 +
 hw/net/virtio-net.c                       |  25 ++++++-
 hw/pci-bridge/cxl_upstream.c              |   3 +
 hw/pci-host/q35.c                         | 110 ++++++++++++++++--------------
 hw/scsi/scsi-bus.c                        |   7 ++
 hw/scsi/virtio-scsi.c                     |   2 +
 hw/virtio/vdpa-dev.c                      |   2 +-
 hw/virtio/vhost-user.c                    |   3 +
 hw/virtio/vhost.c                         |   5 +-
 hw/virtio/virtio-iommu.c                  |  29 ++++++++
 hw/virtio/virtio-mmio.c                   |   7 +-
 hw/virtio/virtio-pmem.c                   |  17 ++++-
 hw/virtio/virtio-rng.c                    |   2 +
 hw/virtio/virtio.c                        |  43 ++++++++----
 migration/vmstate.c                       |  31 ++++++++-
 subprojects/libvduse/libvduse.c           |   5 ++
 subprojects/libvhost-user/libvhost-user.c |  61 ++++++++++++++++-
 28 files changed, 345 insertions(+), 89 deletions(-)

Quoted 8 lines · Michael S. Tsirkin

The following changes since commit cbd42e2b75b23953a9bdb073c8531518b1bd6163:

Update version for v11.1.0-rc1 release (2026-07-21 13:18:25 -0400)

are available in the Git repository at:

https://git.kernel.org/pub/scm/virt/kvm/mst/qemu.git tags/for_upstream

Quoted 1 line

for you to fetch changes up to 13342b9c4104f3bf93c2e52e7de4b383971d7bd6:

moved to f2fe2afd27ddf93b49a16a29e8224d16b9888953 now:
I dropped
vmstate: fix type confusion in vmstate_size() for VMSTATE_VBUFFER_UINT64
will go in through the migration tree.

Quoted 84 lines

backends/rng: cap request size to avoid oversized allocation (2026-07-26 17:26:41 -0400)

----------------------------------------------------------------
pci, vhost, virtio, iommu: bugfixes

Fixes all over the place, including a bunch of CVE fixes.

Signed-off-by Michael S. Tsirkin <[email protected]>

----------------------------------------------------------------
Clément MATHIEU--DRIF (1):
intel_iommu: Check address mask before using it in pasid-based iotlb invalidation

GuoHan Zhao (1):
hw/virtio/vdpa-dev: pass set_config buffer to vhost backend

Haotian Jiang (1):
hw/cxl: fix OOB access in cxl_doe_cdat_rsp via entry_handle

Laurent Vivier (4):
hw/virtio: reject zero-length packed indirect descriptor table hw/net/virtio-net: Protect from DMA re-entrancy bugs hw/virtio-rng: Fix host use-after-free (CVE-2026-50624) backends/rng: cap request size to avoid oversized allocation

Manos Pitsidianakis (2):
virtio-snd: check rx buffer descriptor size
virtio-snd: check for overflow before g_malloc0

Michael S. Tsirkin (18):
virtio: use masked features with set_features_ex
virtio-net: fix OOB read in RSC receive path
virtio-net: fix short frame OOB read in receive_filter()
libvhost-user: protect against OOB writes in vu_set_inflight_fd
libvhost-user: protect against OOB vring queue access
vhost: do not crash on ring map failure
virtio-scsi: fix SCSIRequest leak on a bad request
virtio-mmio: fix QUEUE_NUM_MAX
virtio: fix queue size validation against allocated maximum
virtio: stop migrating num_default, validate vring.num on load
virtio: fail early on bad config_len in migration
vhost-user: assert nregions within limit
virtio-pmem: wait for flush requests on unrealize
libvhost-user: validate last_batch_head in vu_check_queue_inflights
libvhost-user: fix heap overflow in vu_check_queue_inflights
vmstate: fix type confusion in vmstate_size() for VMSTATE_VBUFFER_UINT64
libvduse: validate vq size
virtio-iommu: fix OOM due to unbounded call_rcu

Peter Maydell (3):
hw/pci-host/q35.c: Always initialize smram-region even if SMM disabled hw/pci-host/q35.c: Factor out creation of SMRAM MRs hw/pci-host/q35.c: Avoid early return in mch_write_config()

 include/hw/scsi/scsi.h                    |   1 +
 include/hw/virtio/virtio-bus.h            |   1 +
 include/hw/virtio/virtio-iommu.h          |   1 +
 include/hw/virtio/virtio-mmio.h           |   1 +
 include/hw/virtio/virtio-pmem.h           |   1 +
 include/migration/vmstate.h               |   5 +-
 include/system/rng.h                      |  14 ++++
 backends/rng.c                            |  21 +++++-
 hw/audio/virtio-snd.c                     |  24 +++++--
 hw/core/machine.c                         |   1 +
 hw/i386/intel_iommu.c                     |   9 +++
 hw/mem/cxl_type3.c                        |   3 +
 hw/net/virtio-net.c                       |  25 ++++++-
 hw/pci-bridge/cxl_upstream.c              |   3 +
 hw/pci-host/q35.c                         | 110 ++++++++++++++++--------------
 hw/scsi/scsi-bus.c                        |   7 ++
 hw/scsi/virtio-scsi.c                     |   2 +
 hw/virtio/vdpa-dev.c                      |   2 +-
 hw/virtio/vhost-user.c                    |   3 +
 hw/virtio/vhost.c                         |   5 +-
 hw/virtio/virtio-iommu.c                  |  29 ++++++++
 hw/virtio/virtio-mmio.c                   |   7 +-
 hw/virtio/virtio-pmem.c                   |  17 ++++-
 hw/virtio/virtio-rng.c                    |   2 +
 hw/virtio/virtio.c                        |  43 ++++++++----
 migration/vmstate.c                       |  31 ++++++++-
 subprojects/libvduse/libvduse.c           |   5 ++
 subprojects/libvhost-user/libvhost-user.c |  61 ++++++++++++++++-
 28 files changed, 345 insertions(+), 89 deletions(-)