Anatol Belski 3b431afba4 virtio-devices: Check MSI-X vector bounds before table access ...

A malicious or buggy guest can write an out-of-bounds value to
queue_msix_vector or msix_config. When the device later triggers
an interrupt, it indexes into table_entries with the unchecked
vector, causing a panic.

Validate the vector against the MSI-X table size in both trigger()
and notifier() paths, logging a warning and returning early when
the vector exceeds the table bounds.

Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>

2026-05-05 08:24:19 +00:00

..

src

virtio-devices: Check MSI-X vector bounds before table access

2026-05-05 08:24:19 +00:00

build.rs

build: Add "fuzzing" as a valid cfg(..) attribute

2024-05-08 08:10:28 +00:00

Cargo.toml

virtio-devices: Add set_notifier() method to VirtioInterrupt

2026-03-18 09:25:27 +00:00