rpmsg: virtio: Reject a message shorter than its header

rpmsg_recv_single() checks the msg_len field of a message header against
the used length with an unsigned subtraction, so every msg_len passes
the check with a used length shorter than the header. The rx callback of
the destination endpoint can receive a message of up to 65535 bytes,
longer than the default receive buffer of 512 bytes, so rpmsg_char can
copy the whole message into an skb and read past the buffer:

  BUG: KASAN: slab-out-of-bounds in rpmsg_ept_cb+0x4d/0xb0
  Read of size 65535 at addr ffff888002484010 by task rpmsg_echo/140
  Call Trace:
   rpmsg_ept_cb+0x4d/0xb0
   rpmsg_recv_done+0x29f/0x840
   vring_interrupt+0x32a/0x540
   vp_interrupt+0x146/0x180

Compare the sum of the header size and msg_len with the used length, so
no subtraction wraps.

This patch is assisted by Claude Opus 5.5.

Fixes: 9648224e564a ("rpmsg: validate incoming message length before propagating")
Cc: stable@vger.kernel.org
Signed-off-by: Lianjie Wang <lian@is.s.u-tokyo.ac.jp>
Link: https://lore.kernel.org/r/20261106232322.1093165-1-lian@is.s.u-tokyo.ac.jp
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>

0 files changed, 0 insertions, 0 deletions