From: Xu Rao <[email protected]> The event queue uses fixed-size buffers for struct viommu_event. The device-reported used length is currently only checked for oversized buffers, so a short used buffer can still be passed to the fault handler.
In that case the handler parses fields that were not written by the device for this event, potentially using stale data from a previous event and reporting a bogus fault. Reject any event buffer whose used length is not exactly the expected event size. Still recycle the buffer back to the event queue so a bad event does not permanently shrink the queue. Signed-off-by: Xu Rao <[email protected]> --- drivers/iommu/virtio-iommu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iommu/virtio-iommu.c b/drivers/iommu/virtio-iommu.c index 587fc13197f1..3ace4a6dd02a 100644 --- a/drivers/iommu/virtio-iommu.c +++ b/drivers/iommu/virtio-iommu.c @@ -635,7 +635,7 @@ static void viommu_event_handler(struct virtqueue *vq) struct viommu_dev *viommu = vq->vdev->priv; while ((evt = virtqueue_get_buf(vq, &len)) != NULL) { - if (len > sizeof(*evt)) { + if (len != sizeof(*evt)) { dev_err(viommu->dev, "invalid event buffer (len %u != %zu)\n", len, sizeof(*evt)); -- 2.50.1
