<!-- Mark the GitLab issue as confidential before submitting. Replace the reporter placeholders below. Do not remove the final QEMU label line. --> ## Reporter and tooling disclosure - Reporter: `BB CC` (`@wywwzjj`) - Contact: `@wywwzjj` on GitLab - Credit requested as: `BB CC (@wywwzjj), with AI/LLM-assisted source auditing and manual validation` This issue was discovered with assistance from AI/LLM-based source auditing. The finding, root cause, reproducer, current-upstream source state, and sanitizer results were subsequently reviewed and validated manually. The reproducer was run against a locally built QEMU master with ASan and UBSan enabled. ## Host environment - Operating system: Ubuntu 24.04.4 LTS - OS/kernel version: Linux 6.17.0-35-generic - Architecture: x86_64 - QEMU flavor: contrib `vhost-user-blk` - QEMU version: 11.0.50, commit `a759542a2c62f0fd3b65f5a66ad9868201014669` - Compiler: GCC 13.3.0 - Sanitizers: AddressSanitizer and UndefinedBehaviorSanitizer - QEMU command line, generated by the attached reproducer: ```text vhost-user-blk \ --socket-path <temporary-socket> \ --blk-file <temporary-disk> ``` ## Emulated/virtualized environment - Guest operating system: none; a local userspace vhost-user frontend reproducer sends protocol messages directly to the backend. - Architecture: x86_64 host process. - No remote system, production workload, or external guest is involved. ## Description of problem `vu_check_queue_inflights()` makes two passes over frontend-controlled inflight shared-memory descriptors, but the two passes use different predicates. The first pass increments `vq->inuse` only when `desc[i].inflight == 1`: ```c for (i = 0; i < vq->inflight->desc_num; i++) { if (vq->inflight->desc[i].inflight == 1) { vq->inuse++; } } ``` The function then allocates `resubmit_list` using that count: ```c vq->resubmit_list = calloc(vq->inuse, sizeof(VuVirtqInflightDesc)); ``` The second pass, however, copies every descriptor whose `inflight` field is non-zero: ```c for (i = 0; i < vq->inflight->desc_num; i++) { if (vq->inflight->desc[i].inflight) { vq->resubmit_list[vq->resubmit_num].index = i; vq->resubmit_list[vq->resubmit_num].counter = vq->inflight->desc[i].counter; vq->resubmit_num++; } } ``` Therefore, values other than zero and one cause the copy count to exceed the allocation count. The vhost-user frontend controls the inflight shared-memory contents, including the `inflight` and `counter` fields. The minimal trigger uses otherwise ordinary geometry: - `num_queues = 1` - QSD export `num-queues = 1` - `queue_size = 8` - complete, correctly sized inflight mapping (`mmap_size = 192`) - `desc[0].inflight = 1` - `desc[1].inflight = 2` The first pass counts one descriptor and allocates one 16-byte `VuVirtqInflightDesc`. The second pass copies two entries. In QEMU master at the commit above, ASan ultimately reports a heap-buffer-overflow while `qsort` processes the overfilled resubmit list. This issue is distinct from public work item #3740. That issue concerns `VHOST_USER_SET_INFLIGHT_FD.num_queues > dev->max_queues` and an out-of-bounds access to `dev->vq[i]`. This reproducer keeps `num_queues == 1` and reaches a different function, trigger, root cause, and fix location during `SET_VRING_KICK` replay processing. ## Security impact and trust boundary A malicious or compromised vhost-user frontend/control peer can corrupt the heap of a libvhost-user backend during inflight replay setup. QEMU's contrib `vhost-user-blk` backend advertises `VHOST_USER_PROTOCOL_F_INFLIGHT_SHMFD` and provides a current-upstream, valid-negotiation reproducer. The demonstrated result is a reliable backend process crash under ASan and allocator-corruption failures in non-sanitized builds. The current evidence does not claim a direct guest-only path in every QEMU deployment. Exploitability depends on whether an attacker can control or impersonate the vhost-user frontend/control channel. The issue nevertheless crosses the process boundary that libvhost-user parses and should not permit a peer to corrupt backend heap memory. ## Steps to reproduce 1. Build the latest QEMU master with ASan: ```bash git clone https://gitlab.com/qemu-project/qemu.git cd qemu git checkout a759542a2c62f0fd3b65f5a66ad9868201014669 mkdir build cd build ../configure \ --target-list=x86_64-softmmu \ --enable-debug \ --enable-asan \ --enable-ubsan \ --disable-docs \ --disable-werror ninja contrib/vhost-user-blk/vhost-user-blk cd .. ``` 2. Save the attached `qemu-inflight-predicate-mismatch-poc.py` next to the source tree and run the negative control: ```bash python3 qemu-inflight-predicate-mismatch-poc.py \ --binary ./build/contrib/vhost-user-blk/vhost-user-blk \ --backend vhost-user-blk \ --mode control \ --output-dir ./poc-control ``` Expected result: ```text mode=control backend_returncode_before_cleanup=None asan_seen=False ``` 3. Run the predicate-mismatch trigger: ```bash python3 qemu-inflight-predicate-mismatch-poc.py \ --binary ./build/contrib/vhost-user-blk/vhost-user-blk \ --backend vhost-user-blk \ --mode trigger \ --output-dir ./poc-trigger ``` Expected result: ```text mode=trigger backend_returncode_before_cleanup=-6 asan_seen=True ``` ## ASan result Representative output from QEMU master commit `a759542a2c62f0fd3b65f5a66ad9868201014669`: ```text ERROR: AddressSanitizer: heap-buffer-overflow WRITE of size 32 #0 qsort_r #1 vu_check_queue_inflights ../subprojects/libvhost-user/libvhost-user.c:1387 #2 vu_set_vring_kick_exec ../subprojects/libvhost-user/libvhost-user.c:1430 #3 vu_process_message #4 vu_dispatch #5 vu_client_trip 0x5020000023c0 is located 0 bytes after 16-byte region [0x5020000023b0,0x5020000023c0) allocated by thread T0 here: #0 calloc #1 vu_check_queue_inflights ../subprojects/libvhost-user/libvhost-user.c:1372 SUMMARY: AddressSanitizer: heap-buffer-overflow in qsort_r ``` On an older ASan QEMU build, the same mismatch is caught directly during the second pass while storing the next `index`/`counter`. Ordinary release and a copied downstream QSD also terminate with glibc heap-corruption diagnostics. ## Suggested fix At minimum, the two passes must use exactly the same predicate, and the code must reject invalid inflight state values. A defensive fix should also verify that `resubmit_num` cannot exceed the allocation count before each write. For example, if the only valid active state is exactly one: ```c for (i = 0; i < vq->inflight->desc_num; i++) { if (vq->inflight->desc[i].inflight == 1) { if (vq->resubmit_num >= vq->inuse) { return -1; } vq->resubmit_list[vq->resubmit_num].index = i; vq->resubmit_list[vq->resubmit_num].counter = vq->inflight->desc[i].counter; vq->resubmit_num++; } else if (vq->inflight->desc[i].inflight != 0) { return -1; } } ``` Additional validation of `desc_num`, the mapped inflight size, and `last_batch_head` would provide defense in depth but is not required to demonstrate this predicate-mismatch root cause. ## Public duplicate search The current source, QEMU public GitLab issues/work items, public commit history, and public mailing-list/Patchew results were checked. No public issue or patch matching the `inflight == 1` versus `inflight != 0` allocation/copy mismatch in `vu_check_queue_inflights()` was found as of 2026-07-11. Public work item #3740 is nearby but distinct, as explained above: https://gitlab.com/qemu-project/qemu/-/work_items/3740 ## Attachments - [qemu-inflight-predicate-mismatch-poc.py](/uploads/5958bf09ad97242c2226fef26a60a368/qemu-inflight-predicate-mismatch-poc.py): self-contained local reproducer - `control.log`: optional negative-control log - `trigger.log`: optional full ASan trigger log