Re: [PATCH] misc: nsm: bound the device-reported response length

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

On Sat, Jun 20, 2026 at 09:42:11PM -0500, Bryam Vargas via B4 Relay wrote:
> From: Bryam Vargas <hexlabsecurity@proton.me>
> 
> nsm_sendrecv_msg_locked() stores the virtqueue used-ring length reported
> by the NSM device into msg->resp.len without bounding it to the response
> buffer. A malicious or buggy backend can report a length larger than the
> response buffer; parse_resp_raw() then copies that many bytes out of the
> fixed buffer to user space, disclosing adjacent kernel heap (an
> out-of-bounds read). The request path already floors its length in
> fill_req_raw(); the response path lacks the symmetric check.
> 
> Clamp the stored length to the size of the response buffer. Well-behaved
> devices report no more than the posted buffer size, so conforming traffic
> is unaffected.

Is this really the only place where a "buggy" device that is bound to
the driver can cause any problems?  Shouldn't the driver only be bound
to trusted devices to start with?

thanks,

greg k-h