The control queue handler hands whatever the host wrote to the
control queue straight to the parser:
buf->len = min_t(size_t, len, buf->size);
buf->offset = 0;
handle_control_message(vq->vdev, portdev, buf);
handle_control_message() casts the start of the buffer to struct
virtio_console_control and reads the id, event and value fields
without ever looking at buf->len. A control packet shorter than the
structure makes the driver parse whatever bytes were left in the
reused buffer as a control header, and the uninitialized event then
drives the port state machine.
Drop control packets that are too short to hold the header.
Fixes: 17634ba25544 ("virtio: console: Add a new MULTIPORT feature, support for
generic ports")
Cc: [email protected]
Signed-off-by: Guanglei Zhu <[email protected]>
---
drivers/char/virtio_console.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index 019bcae81af5..5e2a4403dbf8 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -1597,6 +1597,12 @@ static void handle_control_message(struct virtio_device
*vdev,
size_t name_size;
int err;
+ if (buf->len < sizeof(struct virtio_console_control)) {
+ dev_dbg(&portdev->vdev->dev,
+ "Invalid control packet size %zu\n", buf->len);
+ return;
+ }
+
cpkt = (struct virtio_console_control *)(buf->buf + buf->offset);
port = find_port_by_id(portdev, virtio32_to_cpu(vdev, cpkt->id));
--
2.50.1
