On Tue, Nov 03, 2026 at 04:41:56PM +0800, Guanglei Zhu wrote:
> The control queue handler hands whatever the host wrote to the
> control queue straight to the parser:
>
> buf->len = min_t(size_t, len, buf->size);
> buf->offset = 0;
>
> handle_control_message(vq->vdev, portdev, buf);
>
> handle_control_message() casts the start of the buffer to struct
> virtio_console_control and reads the id, event and value fields
> without ever looking at buf->len. A control packet shorter than the
> structure
That's a broken device.
> makes the driver parse whatever bytes were left in the
> reused buffer as a control header, and the uninitialized event then
> drives the port state machine.
So what?
> Drop control packets that are too short to hold the header.
And then what?
> Fixes: 17634ba25544 ("virtio: console: Add a new MULTIPORT feature, support
> for generic ports")
> Cc: [email protected]
Not clear why this is needed on stable.
> Signed-off-by: Guanglei Zhu <[email protected]>
> ---
> drivers/char/virtio_console.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
> diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
> index 019bcae81af5..5e2a4403dbf8 100644
> --- a/drivers/char/virtio_console.c
> +++ b/drivers/char/virtio_console.c
> @@ -1597,6 +1597,12 @@ static void handle_control_message(struct
> virtio_device *vdev,
> size_t name_size;
> int err;
>
> + if (buf->len < sizeof(struct virtio_console_control)) {
> + dev_dbg(&portdev->vdev->dev,
> + "Invalid control packet size %zu\n", buf->len);
> + return;
> + }
> +
> cpkt = (struct virtio_console_control *)(buf->buf + buf->offset);
>
> port = find_port_by_id(portdev, virtio32_to_cpu(vdev, cpkt->id));
> --
> 2.50.1
>
