[PATCH v2 3/3] iommu/virtio: Reject short event buffers
Weimin Xiong <[email protected]>
| Newsgroups | dev.linux.lists.iommu,dev.linux.lists.virtualization,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <[email protected]> |
From: Xiong Weimin <[email protected]> From: Xiong Weimin <[email protected]> viommu_event_handler() only rejects event buffers that are larger than struct viommu_event. A short buffer is also invalid, but the handler would still read evt->head and, for fault events, the rest of evt->fault. Require the used length to match the event buffer size before looking at the event contents. Signed-off-by: Xiong Weimin <[email protected]> --- drivers/iommu/virtio-iommu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iommu/virtio-iommu.c b/drivers/iommu/virtio-iommu.c index 587fc1319..fb19d0bf4 100644 --- a/drivers/iommu/virtio-iommu.c +++ b/drivers/iommu/virtio-iommu.c @@ -635,7 +635,7 @@ static void viommu_event_handler(struct virtqueue *vq) struct viommu_dev *viommu = vq->vdev->priv; while ((evt = virtqueue_get_buf(vq, &len)) != NULL) { - if (len > sizeof(*evt)) { + if (len != sizeof(*evt)) { dev_err(viommu->dev, "invalid event buffer (len %u != %zu)\n", len, sizeof(*evt)); -- 2.43.0