jerpelea opened a new pull request, #21203: URL: https://github.com/apache/nuttx/pull/21203
## Summary rpmsg_virtio on the driver side takes the TX buffer length from used->len and hands rpmsg_hdr.len to endpoint callbacks unchecked; both are written by the remote. A used->len of 0 turned into a 4 GB payload capacity and reset the chip on the RT1176, and a header length larger than the buffer let callbacks read past it. Patch 0020 fixes the driver-side TX size to h2r_buf_size, clamps the RX length to r2h_buf_size and drops a message whose header does not fit before any callback runs. Found with a bare-metal CM4 remote on the RT1170 RPTUN backend; applies to every rptun backend. ## Impact RELEASE ## Testing CI -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
