Re: [PATCH] rpmsg: virtio: bound the buffer sizes read from config space

[Mathieu Poirier <mathieu.poirier@linaro.org>]

On Fri, Oct 23, 2026 at 04:41:29AM +0900, Lianjie Wang wrote:
> With VIRTIO_RPMSG_F_BUFSZ, rpmsg_virtio_get_buf_size() reads the rx and
> tx buffer sizes from the config space as u32 values and checks only that
> each can hold the message header. The probe multiplies them by the
> buffer counts in unsigned int arithmetic to size the buffer area. An rx
> buffer size of 0x1000000 with 256 rx buffers wraps the rx part to zero,
> so the allocation covers only the tx buffers, and the driver posts the
> rx buffers at offsets up to 4 GiB past its start for the device to
> write.
> 
> Reject a buffer larger than the header plus U16_MAX, since the 16-bit
> msg->len cannot describe a longer payload. With at most 256 buffers in
> each direction, this bound also keeps the size of the buffer area from
> wrapping.
> 
> This patch is assisted by Claude Opus 5.5.
> 
> Fixes: ca96ea25e51a ("rpmsg: virtio_rpmsg_bus: Get buffer size from config space")
> Signed-off-by: Lianjie Wang <karin0.zst@gmail.com>
> ---
> The patch is tested against a virtio-rpmsg device added to QEMU. With
> buffer sizes in config space that wrap the size of the buffer area, the
> unpatched driver probes and warns in rpmsg_sg_init() while posting
> buffers past its allocation. With the patch, the probe fails with "bad
> vdev config".
> 
>  drivers/rpmsg/virtio_rpmsg_bus.c | 10 ++++++++--
>  1 file changed, 8 insertions(+), 2 deletions(-)
>

Applied.

Thanks,
Mathieu
 
> diff --git a/drivers/rpmsg/virtio_rpmsg_bus.c b/drivers/rpmsg/virtio_rpmsg_bus.c
> index 23ff6c8b7a20b..de4af75ee1620 100644
> --- a/drivers/rpmsg/virtio_rpmsg_bus.c
> +++ b/drivers/rpmsg/virtio_rpmsg_bus.c
> @@ -91,6 +91,7 @@ struct rpmsg_hdr {
>  	u8 data[];
>  } __packed;
>  
> +#define MAX_RPMSG_BUF_SIZE	(sizeof(struct rpmsg_hdr) + U16_MAX)
>  
>  /**
>   * struct virtio_rpmsg_channel - rpmsg channel descriptor
> @@ -851,9 +852,14 @@ static int rpmsg_virtio_get_buf_size(struct virtproc_info *vrp)
>  		virtio_cread(vdev, struct virtio_rpmsg_config,
>  			     rxbuf_size, &vrp->tx_buf_size);
>  
> -		/* The buffers must hold at least the rpmsg header */
> +		/*
> +		 * The buffers must hold at least the rpmsg header, and at most
> +		 * the header and the largest payload its 16-bit len describes.
> +		 */
>  		if (vrp->rx_buf_size < sizeof(struct rpmsg_hdr) ||
> -		    vrp->tx_buf_size < sizeof(struct rpmsg_hdr)) {
> +		    vrp->tx_buf_size < sizeof(struct rpmsg_hdr) ||
> +		    vrp->rx_buf_size > MAX_RPMSG_BUF_SIZE ||
> +		    vrp->tx_buf_size > MAX_RPMSG_BUF_SIZE) {
>  			dev_err(&vdev->dev,
>  				"bad vdev config: rx buf sz = %u, tx buf sz = %u\n",
>  				vrp->rx_buf_size, vrp->tx_buf_size);
> 
> base-commit: bd1ecbb61afefc6a8b876ccbc31e9228b44e9eab
> -- 
> 2.56.0
>