vmw_host_get_guestinfo subtracts the two-byte reply prefix using
max(reply_len - 2, (size_t)0). Since reply_len is unsigned, a one-byte
reply wraps to SIZE_MAX instead of being clamped to zero. The subsequent
copy can read past the host reply allocation.
Theoretically malformed host reply can reach this path when the driver
queries the GuestInfo parameter used to enable VKMS.
Check the reply length before subtracting the prefix so short replies
produce an empty payload and cannot cause an out-of-bounds read.
Sashiko reported this while reviewing the i386 hypercall changes.
Fixes: 89da76fde68d ("drm/vmwgfx: Add VMWare host messaging capability")
Cc: [email protected]
Closes:
https://sashiko.dev/#/patchset/4ab10678a8f50053934b62b56af81f881c1d3798.1788414669.git.zack.rusin%40broadcom.com
Signed-off-by: Zack Rusin <[email protected]>
---
drivers/gpu/drm/vmwgfx/vmwgfx_msg.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
index fd77ab6568cb..49e04a50c6ed 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
@@ -431,7 +431,7 @@ int vmw_host_get_guestinfo(const char *guest_info_param,
/* Remove reply code, which are the first 2 characters of
* the reply
*/
- reply_len = max(reply_len - 2, (size_t) 0);
+ reply_len = reply_len > 2 ? reply_len - 2 : 0;
reply_len = min(reply_len, *length);
if (reply_len > 0)
--
2.53.0
