> The control queue handler hands whatever the host wrote to the
> control queue straight to the parser:
>
> buf->len = min_t(size_t, len, buf->size);
> buf->offset = 0;
>
> handle_control_message(vq->vdev, portdev, buf);
>
> handle_control_message() casts the start of the buffer to struct
> virtio_console_control and reads the id, event and value fields
> without ever looking at buf->len. A control packet shorter than the
> structure makes the driver parse whatever bytes were left in the
> reused buffer as a control header, and the uninitialized event then
> drives the port state machine.
>
> Drop control packets that are too short to hold the header.
>
> Fixes: 17634ba25544 ("virtio: console: Add a new MULTIPORT feature, support
> for generic ports")
> Cc: [email protected]
> Signed-off-by: Guanglei Zhu <[email protected]>
Sashiko has reviewed this patch and found no issues.
--
Sashiko AI review ยท
https://sashiko.dev/#/patchset/[email protected]?part=1
