rpmsg: virtio: Bound the buffer sizes read from config space

With VIRTIO_RPMSG_F_BUFSZ, rpmsg_virtio_get_buf_size() reads the rx and
tx buffer sizes from the config space as u32 values and checks only that
each can hold the message header. The probe multiplies them by the
buffer counts in unsigned int arithmetic to size the buffer area. An rx
buffer size of 0x1000000 with 256 rx buffers wraps the rx part to zero,
so the allocation covers only the tx buffers, and the driver posts the
rx buffers at offsets up to 4 GiB past its start for the device to
write.

Reject a buffer larger than the header plus U16_MAX, since the 16-bit
msg->len cannot describe a longer payload. With at most 256 buffers in
each direction, this bound also keeps the size of the buffer area from
wrapping.

This patch is assisted by Claude Opus 5.5.

Fixes: ca96ea25e51a ("rpmsg: virtio_rpmsg_bus: Get buffer size from config space")
Signed-off-by: Lianjie Wang <karin0.zst@gmail.com>
Link: https://lore.kernel.org/r/20261022194129.2233880-1-karin0.zst@gmail.com
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>

0 files changed, 0 insertions, 0 deletions