Good day Kery,
On Fri, Jan 09, 2026 at 03:23:36AM +0800, Kery Qi wrote:
> rproc_virtio_get() returns early on out-of-bounds access without touching
> the caller-provided buffer. Callers of virtio config accessors commonly
> pass stack storage and do not get an error code back, so stale/uninit
> bytes may be consumed as device configuration, leading to unpredictable
> behavior and potentially leaking stack data if later exposed.
>
> Always clear the destination buffer, reject offsets past config_len, and
> clamp the read length to the available config bytes before copying.
>
> Fixes: 92b38f851470 ("remoteproc: support virtio config space.")
> Signed-off-by: Kery Qi <[email protected]>
> ---
> drivers/remoteproc/remoteproc_virtio.c | 9 ++++++---
> 1 file changed, 6 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/remoteproc/remoteproc_virtio.c
> b/drivers/remoteproc/remoteproc_virtio.c
> index c5d46a878149..8fa8c8a86b4b 100644
> --- a/drivers/remoteproc/remoteproc_virtio.c
> +++ b/drivers/remoteproc/remoteproc_virtio.c
> @@ -298,10 +298,13 @@ static void rproc_virtio_get(struct virtio_device
> *vdev, unsigned int offset,
> rsc = (void *)rvdev->rproc->table_ptr + rvdev->rsc_offset;
> cfg = &rsc->vring[rsc->num_of_vrings];
>
> - if (offset + len > rsc->config_len || offset + len < len) {
> - dev_err(&vdev->dev, "rproc_virtio_get: access out of bounds\n");
> + memset(buf, 0, len);
I think this should be done in the caller, not virtio_config_ops->get(). I am
willing to reconsider if you include this change in a patchset that changes all
the other virtio_config_ops->get() function.
Thanks,
Mathieu
> +
> + if (offset > rsc->config_len)
> return;
> - }
> +
> + if (len > rsc->config_len - offset)
> + len = rsc->config_len - offset;
>
> memcpy(buf, cfg + offset, len);
> }
> --
> 2.34.1
>
>
