From 9f405a21ac25954667b7ca9f81605879b4006327 Mon Sep 17 00:00:00 2001 From: Dylan Reid Date: Fri, 24 Apr 2026 16:58:07 -0700 Subject: [PATCH] virtio-devices: vsock: Add bounds check on inline TX path The TX path's inline-data branch didn't check the inline buffer length against the guest-supplied pkt.len() field. The worker will later panic when it tries to index the packet. Add the missing check, mirroring the other TX branches. Signed-off-by: Dylan Reid --- virtio-devices/src/vsock/packet.rs | 3 +++ 1 file changed, 3 insertions(+) diff --git a/virtio-devices/src/vsock/packet.rs b/virtio-devices/src/vsock/packet.rs index e6b4c5afb..e9834b5f3 100644 --- a/virtio-devices/src/vsock/packet.rs +++ b/virtio-devices/src/vsock/packet.rs @@ -175,6 +175,9 @@ impl VsockPacket { // For small packets, the data may be stored in the same descriptor as the header. if !head.has_next() { let buf_size: usize = head.len() as usize - VSOCK_PKT_HDR_SIZE; + if buf_size < pkt.len() as usize { + return Err(VsockError::BufDescTooSmall); + } let buf_ptr = get_host_address_range( desc_chain.memory(), head.addr()