The result of `mctp_pktbuf_alloc` wasn't being checked on both
controller and target. While a simple check is enough for the
controller, the target fix is a bit more involved.
As the target was allocating the buffer when it received the length
of the message on its pseudoregister, a buggy controller could write
this more than once, making previous allocations leak. This is solved by
only noting the size of the message written to the pseudoregister, and
doing the allocation when the first byte of the message was received.
This flow also ensures that a buggy controller can't skip sending the
length of the message, as this will result in a zero-sized MCTP packet,
which will be handled by libmctp.
Signed-off-by: Ederson de Souza <ederson.desouza@intel.com>
Signed-off-by: David Brown <david.brown@linaro.org>
Assisted-By: Claude:opus-4.8
42942b2177