Re: [PATCH v3 2/7] hw/char/virtio-serial-bus: validate nr_active_ports from migration stream

On 30/07/2026 01.18, Laurent Vivier wrote:
> The migration restore path reads nr_active_ports from the incoming
> stream and passes it directly to fetch_active_ports_list(), which
> uses it to size a heap allocation. A crafted migration stream can set
> this field to a very large value, causing QEMU to attempt a
> multi-gigabyte allocation and abort.
> 
> Fix this by checking nr_active_ports against the configured
> max_virtserial_ports before calling fetch_active_ports_list().
> 
> Cc: [email protected]
> Fixes: 6663a1956eb6 ("virtio-serial-bus: Maintain guest and host port open/close state")
> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3801
> Signed-off-by: Laurent Vivier <[email protected]>
> Reviewed-by: Daniel P. Berrangé <[email protected]>
> Reviewed-by: Thomas Huth <[email protected]>
> Acked-by: Michael S. Tsirkin <[email protected]>
> ---
> 
> Notes:
>      v2: add error_setg() call with descriptive error message
> 
>   hw/char/virtio-serial-bus.c | 6 ++++++
>   1 file changed, 6 insertions(+)
> 
> diff --git a/hw/char/virtio-serial-bus.c b/hw/char/virtio-serial-bus.c
> index 87bfe51b6e93..4a5507e2f755 100644
> --- a/hw/char/virtio-serial-bus.c
> +++ b/hw/char/virtio-serial-bus.c
> @@ -803,6 +803,12 @@ static int virtio_serial_load_device(VirtIODevice *vdev, QEMUFile *f,
>   
>       qemu_get_be32s(f, &nr_active_ports);
>   
> +    if (nr_active_ports > max_nr_ports) {
> +        error_setg(errp, "Invalid number of active ports %u > %u", nr_active_ports,
> +                   max_nr_ports);
> +        return -EINVAL;
> +    }
> +
>       if (nr_active_ports) {
>           Error *local_err = NULL;
>   

Reviewed-by: Thomas Huth <[email protected]>