[PATCH v2 0/2] virtio: fix virtio_add_queue() queue size Coverity issue

Stefan Hajnoczi <[email protected]> Thu, 30 Jul 2026 16:58:44 -0400
Newsgroups dev.linux.lists.virtio-fs,org.nongnu.qemu-devel
Message-ID <[email protected]>
v2:
- Deal with x-override-queue-size, the root cause for the Coverity issue
  [Peter]

virtio_add_queue() uses int rather than unsigned int for the virtqueue size. It
also fails to validate the x-override-queue-size qdev property. Refactor the
code to solve these issues.

Patch 2 adds an Error **errp argument to virtio_add_queue() and changes all
callers to pass &error_abort. This solution requires many code changes, but
it's a step in the direction of propagating errors and that should be the
long-term goal.

Stefan Hajnoczi (2):
  virtio: make virtio_add_queue() queue_size an unsigned int
  virtio: use Error for queue size validation in virtio_add_queue()

 include/hw/virtio/virtio.h     |  4 ++--
 hw/9pfs/virtio-9p-device.c     |  2 +-
 hw/audio/virtio-snd.c          |  8 +++----
 hw/block/vhost-user-blk.c      |  3 ++-
 hw/block/virtio-blk.c          |  3 ++-
 hw/char/virtio-serial-bus.c    | 14 ++++++------
 hw/display/virtio-gpu-base.c   |  8 +++----
 hw/input/virtio-input.c        |  6 ++++--
 hw/net/virtio-net.c            | 15 ++++++++-----
 hw/scsi/virtio-scsi.c          |  9 +++++---
 hw/virtio/vdpa-dev.c           |  3 ++-
 hw/virtio/vhost-user-base.c    |  3 ++-
 hw/virtio/vhost-user-fs.c      |  8 +++++--
 hw/virtio/vhost-user-scmi.c    |  6 ++++--
 hw/virtio/vhost-vsock-common.c |  9 +++++---
 hw/virtio/virtio-balloon.c     | 15 ++++++++-----
 hw/virtio/virtio-crypto.c      |  6 ++++--
 hw/virtio/virtio-iommu.c       |  6 ++++--
 hw/virtio/virtio-mem.c         |  3 ++-
 hw/virtio/virtio-nsm.c         |  2 +-
 hw/virtio/virtio-pmem.c        |  2 +-
 hw/virtio/virtio-rng.c         |  2 +-
 hw/virtio/virtio-rtc.c         |  3 ++-
 hw/virtio/virtio.c             | 39 +++++++++++++++++++++++++++++-----
 24 files changed, 122 insertions(+), 57 deletions(-)

-- 
2.55.0