tree bd509ff231c12768a1633865d8fdd6c56826f7f3
parent 802671c37a6ab4de116866883841bcc8b2318124
author Jonathan Cameron <Jonathan.Cameron@huawei.com> 1730468348 +0000
committer Michael S. Tsirkin <mst@redhat.com> 1730754205 -0500

hw/cxl: Check size of input data to dynamic capacity mailbox commands

cxl_cmd_dcd_release_dyn_cap() and cmd_dcd_add_dyn_cap_rsp() are missing
input message size checks.  These must be done in the individual
commands when the command has a variable length input payload.

A buggy or malicious guest might send undersized messages via the mailbox.
As that size is used to take a copy of the mailbox content, each command
must check there is sufficient data. In this case the first check is that
there is enough data to read how many extents there are, and the second
that there is enough for those elements to be accessed.

Reported-by: Esifiel <esifiel@gmail.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Message-Id: <20241101133917.27634-2-Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>