From 7ed72ebab15f6d519800709c743fc5ed21f3b06e Mon Sep 17 00:00:00 2001 From: manyangshen <1663292285@qq.com> Date: Wed, 23 Sep 2026 09:19:10 +0800 Subject: [PATCH 1/2] [drivers][virtio] Validate input offsets without range-check overflow Reject negative event offsets and compare against the remaining queue range using subtraction. Preserve the existing strict range convention and read/write return behavior for valid requests. Fixes #10379 and #10380 --- components/legacy/virtio/virtio_input.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/components/legacy/virtio/virtio_input.c b/components/legacy/virtio/virtio_input.c index 564b32bcaf67..b0c756b03f4f 100644 --- a/components/legacy/virtio/virtio_input.c +++ b/components/legacy/virtio/virtio_input.c @@ -142,8 +142,9 @@ static rt_err_t virtio_input_init(rt_device_t dev) static rt_ssize_t virtio_input_read(rt_device_t dev, rt_off_t pos, void *buffer, rt_size_t size) { struct virtio_input_device *virtio_input_dev = (struct virtio_input_device *)dev; + rt_size_t num = virtio_input_dev->virtio_dev.queues[VIRTIO_INPUT_QUEUE_EVENT].num; - if (buffer == RT_NULL || pos + size >= virtio_input_dev->virtio_dev.queues[VIRTIO_INPUT_QUEUE_EVENT].num) + if (buffer == RT_NULL || pos < 0 || size >= num || (rt_size_t)pos >= num - size) { return 0; } @@ -160,8 +161,9 @@ static rt_ssize_t virtio_input_read(rt_device_t dev, rt_off_t pos, void *buffer, static rt_ssize_t virtio_input_write(rt_device_t dev, rt_off_t pos, const void *buffer, rt_size_t size) { struct virtio_input_device *virtio_input_dev = (struct virtio_input_device *)dev; + rt_size_t num = virtio_input_dev->virtio_dev.queues[VIRTIO_INPUT_QUEUE_EVENT].num; - if (buffer == RT_NULL || pos + size >= virtio_input_dev->virtio_dev.queues[VIRTIO_INPUT_QUEUE_EVENT].num) + if (buffer == RT_NULL || pos < 0 || size >= num || (rt_size_t)pos >= num - size) { return 0; } From 252fe1e48d37e79485804254882fccd05880cab0 Mon Sep 17 00:00:00 2001 From: manyangshen <1663292285@qq.com> Date: Wed, 23 Sep 2026 09:19:19 +0800 Subject: [PATCH 2/2] [drivers][virtio] Check input offsets before the remaining range Name the queue bound and validate the offset before subtracting it. This keeps the accepted request range unchanged while following the order in which a reader checks an indexed copy. --- components/legacy/virtio/virtio_input.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/components/legacy/virtio/virtio_input.c b/components/legacy/virtio/virtio_input.c index b0c756b03f4f..adec5499048e 100644 --- a/components/legacy/virtio/virtio_input.c +++ b/components/legacy/virtio/virtio_input.c @@ -142,9 +142,10 @@ static rt_err_t virtio_input_init(rt_device_t dev) static rt_ssize_t virtio_input_read(rt_device_t dev, rt_off_t pos, void *buffer, rt_size_t size) { struct virtio_input_device *virtio_input_dev = (struct virtio_input_device *)dev; - rt_size_t num = virtio_input_dev->virtio_dev.queues[VIRTIO_INPUT_QUEUE_EVENT].num; + rt_size_t queue_size = virtio_input_dev->virtio_dev.queues[VIRTIO_INPUT_QUEUE_EVENT].num; - if (buffer == RT_NULL || pos < 0 || size >= num || (rt_size_t)pos >= num - size) + if (buffer == RT_NULL || pos < 0 || (rt_size_t)pos >= queue_size || + size >= queue_size - (rt_size_t)pos) { return 0; } @@ -161,9 +162,10 @@ static rt_ssize_t virtio_input_read(rt_device_t dev, rt_off_t pos, void *buffer, static rt_ssize_t virtio_input_write(rt_device_t dev, rt_off_t pos, const void *buffer, rt_size_t size) { struct virtio_input_device *virtio_input_dev = (struct virtio_input_device *)dev; - rt_size_t num = virtio_input_dev->virtio_dev.queues[VIRTIO_INPUT_QUEUE_EVENT].num; + rt_size_t queue_size = virtio_input_dev->virtio_dev.queues[VIRTIO_INPUT_QUEUE_EVENT].num; - if (buffer == RT_NULL || pos < 0 || size >= num || (rt_size_t)pos >= num - size) + if (buffer == RT_NULL || pos < 0 || (rt_size_t)pos >= queue_size || + size >= queue_size - (rt_size_t)pos) { return 0; }