Re: [PATCH] um: virtio_uml: fix heap overflow in vhost_user_get_config()

On Mon, Jun 22, 2026 at 2:47=E2=80=AFPM Michael Bommarito
<[email protected]> wrote:
>
> vhost_user_get_config() sizes its reply buffer from header + payload:
>
>         size_t payload_size =3D sizeof(msg->payload.config) + cfg_size;
>         size_t msg_size =3D sizeof(msg->header) + payload_size;
>         ...
>         msg =3D kzalloc(msg_size, GFP_KERNEL);
>
> but then receives the response with msg_size as the payload cap:
>
>         rc =3D vhost_user_recv_resp(vu_dev, msg, msg_size);
>
> vhost_user_recv() reads the header, then full_read()s header.size bytes
> into &msg->payload after checking only "size > max_payload_size". The
> payload area is msg_size - sizeof(msg->header) =3D=3D payload_size bytes,=
 so
> passing msg_size as the cap lets a peer set header.size up to msg_size
> and write sizeof(struct vhost_user_msg_header) (12) bytes past the end
> of the kzalloc(msg_size) buffer -- a slab out-of-bounds write of
> peer-controlled content.
>
> Pass payload_size, which is the size the payload area was allocated for.
>
> A malicious or compromised vhost-user backend triggers this during
> device probe (vu_get -> vhost_user_get_config) with no guest action,
> which matters in the confidential-computing model where the guest does
> not trust the device backend.
>
> Fixes: 5d38f324993f ("um: drivers: Add virtio vhost-user driver")
> Cc: [email protected]
> Assisted-by: Claude:claude-opus-4-8
> Signed-off-by: Michael Bommarito <[email protected]>
> ---
> Reproduced on a UML KASAN build (ARCH=3Dum, CONFIG_KASAN=3Dy) off this ba=
se.
> A stub vhost-user backend that answers GET_CONFIG with header.size set to
> the full msg_size makes vhost_user_recv() full_read() 12 bytes past the
> kzalloc'd reply buffer; KASAN reports a slab-out-of-bounds write in
> vhost_user_get_config(). With this patch the oversized reply is rejected
> (-EPROTO) and KASAN is clean. Benign control: a correctly-sized GET_CONFI=
G
> reply succeeds on both stock and patched. Before/after logs available on
> request.
>
>  arch/um/drivers/virtio_uml.c | 2 +-

Reviewed-by: Richard Weinberger <[email protected]>

--=20
Thanks,
//richard