nvproxy: Add size check for NV0000_CTRL_CMD_SYSTEM_GET_BUILD_VERSION.

This change introduces a maximum size limit for the strings requested in
NV0000_CTRL_CMD_SYSTEM_GET_BUILD_VERSION to prevent excessive memory allocation
based on user-provided input.

Reported-by: Antoni Tremblay <i00@tutanota.com>
PiperOrigin-RevId: 873011768

Author: ayushr2

pkg/abi/nvgpu/ctrl.go

@@ -131,15 +131,16 @@ const (
 
 // From src/common/sdk/nvidia/inc/ctrl/ctrl0000/ctrl0000system.h:
 const (
-	NV0000_CTRL_CMD_SYSTEM_GET_BUILD_VERSION   = 0x101
-	NV0000_CTRL_CMD_SYSTEM_GET_CPU_INFO        = 0x102
-	NV0000_CTRL_CMD_SYSTEM_GET_P2P_CAPS        = 0x127
-	NV0000_CTRL_CMD_SYSTEM_GET_P2P_CAPS_V2     = 0x12b
-	NV0000_CTRL_CMD_SYSTEM_GET_FABRIC_STATUS   = 0x136
-	NV0000_CTRL_CMD_SYSTEM_GET_P2P_CAPS_MATRIX = 0x13a
-	NV0000_CTRL_CMD_SYSTEM_GET_FEATURES        = 0x1f0
-	NV0000_CTRL_SYSTEM_MAX_ATTACHED_GPUS       = 32
-	NV0000_CTRL_P2P_CAPS_INDEX_TABLE_SIZE      = 9
+	NV0000_CTRL_CMD_SYSTEM_GET_BUILD_VERSION                = 0x101
+	NV0000_CTRL_CMD_SYSTEM_GET_CPU_INFO                     = 0x102
+	NV0000_CTRL_CMD_SYSTEM_GET_P2P_CAPS                     = 0x127
+	NV0000_CTRL_CMD_SYSTEM_GET_P2P_CAPS_V2                  = 0x12b
+	NV0000_CTRL_CMD_SYSTEM_GET_FABRIC_STATUS                = 0x136
+	NV0000_CTRL_CMD_SYSTEM_GET_P2P_CAPS_MATRIX              = 0x13a
+	NV0000_CTRL_CMD_SYSTEM_GET_FEATURES                     = 0x1f0
+	NV0000_CTRL_SYSTEM_GET_BUILD_VERSION_V2_MAX_STRING_SIZE = 256
+	NV0000_CTRL_SYSTEM_MAX_ATTACHED_GPUS                    = 32
+	NV0000_CTRL_P2P_CAPS_INDEX_TABLE_SIZE                   = 9
 )
 
 // NV0000_CTRL_SYSTEM_GET_P2P_CAPS_PARAMS is the param type for NV0000_CTRL_CMD_SYSTEM_GET_P2P_CAPS,

pkg/sentry/devices/nvproxy/frontend.go

@@ -961,6 +961,10 @@ func ctrlClientSystemGetBuildVersion(fi *frontendIoctlState, ioctlParams *nvgpu.
 	if ctrlParams.SizeOfStrings == 0 {
 		return 0, linuxerr.EINVAL
 	}
+	// The driver internally uses NV0000_CTRL_CMD_SYSTEM_GET_BUILD_VERSION_V2 to
+	// fetch the version strings, which has a maximum string size limit. Any
+	// extra buffer space provided by the user is ignored.
+	ctrlParams.SizeOfStrings = min(ctrlParams.SizeOfStrings, nvgpu.NV0000_CTRL_SYSTEM_GET_BUILD_VERSION_V2_MAX_STRING_SIZE)
 	driverVersionBuf := make([]byte, ctrlParams.SizeOfStrings)
 	versionBuf := make([]byte, ctrlParams.SizeOfStrings)
 	titleBuf := make([]byte, ctrlParams.SizeOfStrings)