From: Xiong Weimin <[email protected]> viommu_event_handler() only rejects event buffers that are larger than struct viommu_event. A short buffer is also invalid, but the handler would still read evt->head and, for fault events, the rest of evt->fault.
Require the used length to match the event buffer size before looking at the event contents. Signed-off-by: Xiong Weimin <[email protected]> --- drivers/iommu/virtio-iommu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iommu/virtio-iommu.c b/drivers/iommu/virtio-iommu.c index 4c91a82d2..4b7f0dcfa 100644 --- a/drivers/iommu/virtio-iommu.c +++ b/drivers/iommu/virtio-iommu.c @@ -635,7 +635,7 @@ static void viommu_event_handler(struct virtqueue *vq) struct viommu_dev *viommu = vq->vdev->priv; while ((evt = virtqueue_get_buf(vq, &len)) != NULL) { - if (len > sizeof(*evt)) { + if (len != sizeof(*evt)) { dev_err(viommu->dev, "invalid event buffer (len %u != %zu)\n", len, sizeof(*evt)); -- 2.43.0
