From 43937a4f5e411b3a82014fe0fa78ef4de90b11c2 Mon Sep 17 00:00:00 2001 From: Andrew Scull <ascull@google.com> Date: Mon, 16 May 2022 10:41:39 +0000 Subject: [PATCH] virtio: rng: Check length before copying Check the length of data written by the device is consistent with the size of the buffers to avoid out-of-bounds memory accesses in case values aren't consistent. Signed-off-by: Andrew Scull <ascull@google.com> Cc: Sughosh Ganu <sughosh.ganu@linaro.org> Reviewed-by: Simon Glass <sjg@chromium.org> --- drivers/virtio/virtio_rng.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/virtio/virtio_rng.c b/drivers/virtio/virtio_rng.c index 9314c0a03e..b85545c2ee 100644 --- a/drivers/virtio/virtio_rng.c +++ b/drivers/virtio/virtio_rng.c @@ -41,6 +41,9 @@ static int virtio_rng_read(struct udevice *dev, void *data, size_t len) while (!virtqueue_get_buf(priv->rng_vq, &rsize)) ; + if (rsize > sg.length) + return -EIO; + memcpy(ptr, buf, rsize); len -= rsize; ptr += rsize; -- 2.39.5