virtio_console: Assure used length from device is limited
authorXie Yongji <xieyongji@bytedance.com>
Tue, 25 May 2021 12:56:22 +0000 (20:56 +0800)
committerSalvatore Bonaccorso <carnil@debian.org>
Thu, 23 Sep 2021 20:35:21 +0000 (21:35 +0100)
commit029bb62044885dde409a2acf559564b8822a7d8f
tree204e65d70382d5c7ea50547d5bb6a3e25717ff2c
parentb5e060d0e92d897b87979439eb1d252321bbddc9
virtio_console: Assure used length from device is limited

Origin: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit?id=f6ec306b93dc600a0ab3bb2693568ef1cc5f7f7a
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2021-38160

[ Upstream commit d00d8da5869a2608e97cfede094dfc5e11462a46 ]

The buf->len might come from an untrusted device. This
ensures the value would not exceed the size of the buffer
to avoid data corruption or loss.

Signed-off-by: Xie Yongji <xieyongji@bytedance.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Link: https://lore.kernel.org/r/20210525125622.1203-1-xieyongji@bytedance.com
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Gbp-Pq: Topic bugfix/all
Gbp-Pq: Name virtio_console-Assure-used-length-from-device-is-lim.patch
drivers/char/virtio_console.c