[PATCH 02/14] vhost: fix missing memory size validation before mmap

[Maxime Coquelin]

A malicious guest could send a VHOST_USER_SET_MEM_TABLE message with
a memory_size larger than the actual backing file size. The mmap()
call would succeed, but subsequent access to addresses beyond the
real file size would cause SIGBUS, crashing the DPDK host process.

Add validation to check that mmap_size does not exceed the backing
file's st_size before calling mmap().

CVE-2026-86561
Bugzilla ID: 2002

Cc: stable at dpdk.org

Acked-by: Kevin Traynor <ktraynor at redhat.com>
Signed-off-by: Maxime Coquelin <maxime.coquelin at redhat.com>
---
 lib/vhost/vhost_user.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/lib/vhost/vhost_user.c b/lib/vhost/vhost_user.c
index 020c993b29..ce3420ae90 100644
--- a/lib/vhost/vhost_user.c
+++ b/lib/vhost/vhost_user.c
@@ -1345,6 +1345,7 @@ vhost_user_mmap_region(struct virtio_net *dev,
 	void *mmap_addr;
 	uint64_t mmap_size;
 	uint64_t alignment;
+	struct stat file_stat;
 	int populate;
 
 	/* Check for memory_size + mmap_offset overflow */
@@ -1384,6 +1385,19 @@ vhost_user_mmap_region(struct virtio_net *dev,
 		return -1;
 	}
 
+	/* Validate mmap_size does not exceed backing file size */
+	if (fstat(region->fd, &file_stat) == -1) {
+		VHOST_CONFIG_LOG(dev->ifname, ERR,
+			"failed to get backing file size: %s", strerror(errno));
+		return -1;
+	}
+	if (mmap_size > (uint64_t)file_stat.st_size) {
+		VHOST_CONFIG_LOG(dev->ifname, ERR,
+			"mmap size (0x%" PRIx64 ") exceeds backing file size (0x%" PRIx64 ")",
+			mmap_size, (uint64_t)file_stat.st_size);
+		return -1;
+	}
+
 	populate = dev->async_copy ? MAP_POPULATE : 0;
 	mmap_addr = mmap(NULL, mmap_size, PROT_READ | PROT_WRITE,
 			MAP_SHARED | populate, region->fd, 0);
-- 
2.56.0