vdpa_sim TxPull OOB

Vulnerability analysis

In the vdpa_sim network device simulator, when a transmit buffer pull fails and returns a negative error code, the code does not check for this error and instead treats the negative value as a very large unsigned byte count. This enormous length is then passed to the receive processing path, causing out-of-bounds reads from a page-sized internal buffer and potentially leaking host kernel memory to the guest or crashing the kernel. A malicious VM guest or container with access to a vdpa_sim device can trigger this by submitting transmit descriptors with buffer addresses that fail address translation. The fix checks the pull return value before any length use and, on failure or zero, skips receive processing entirely and completes the transmit descriptor with zero bytes.