Tobias Kässer 082fdc4d07 virtio-devices: fix guest-triggerable panic via OOB queue_select ...

The queue_msix_vector register (offset 0x1a in virtio PCI common
config) was indexed into the msix_queues Vec using the guest-controlled
queue_select value without bounds checking. A malicious guest can set
queue_select to any u16 value via offset 0x16, then read or write
offset 0x1a to trigger an out-of-bounds panic, crashing the VMM.

Replace direct Vec indexing with .get()/.get_mut() for bounds-checked
access, returning VIRTQ_MSI_NO_VECTOR (0xFFFF) on OOB reads to match
the virtio "no vector" sentinel. Add a regression test that sets
queue_select to 0xFFFF and exercises both the read and write paths.

AI/LLM disclosure: this patch was co-authored with Claude Code.

Fixes #7917
Signed-off-by: Tobias Kässer <t.kaesser@gmail.com>

2026-03-31 12:27:29 +00:00

..

src

virtio-devices: fix guest-triggerable panic via OOB queue_select

2026-03-31 12:27:29 +00:00

build.rs

build: Add "fuzzing" as a valid cfg(..) attribute

2024-05-08 08:10:28 +00:00

Cargo.toml

virtio-devices: Add set_notifier() method to VirtioInterrupt

2026-03-18 09:25:27 +00:00