| Message ID | 20210312232002.3466791-1-bjorn.andersson@linaro.org |
|---|---|
| State | Accepted |
| Commit | 3d2ee78906af5f08d499d6aa3aa504406fa38106 |
| Headers | show |
| Series | [v2] remoteproc: qcom_q6v5_mss: Validate p_filesz in ELF loader | expand |
On Fri, Mar 12, 2021 at 03:20:02PM -0800, Bjorn Andersson wrote: > Analog to the issue in the common mdt_loader code the MSS ELF loader > does not validate that p_filesz bytes will fit in the memory region and > that the loaded segments are not truncated. Fix this in the same way > as proposed for the mdt_loader. > > Fixes: 135b9e8d1cd8 ("remoteproc: qcom_q6v5_mss: Validate modem blob firmware size before load") > Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org> > --- > > Changes since v1: > - Don't just break the loop, goto release_firmware. > - Release seg_fw as well. > > drivers/remoteproc/qcom_q6v5_mss.c | 18 ++++++++++++++++++ > 1 file changed, 18 insertions(+) > > diff --git a/drivers/remoteproc/qcom_q6v5_mss.c b/drivers/remoteproc/qcom_q6v5_mss.c > index 66106ba25ba3..14e0ce5f18f5 100644 > --- a/drivers/remoteproc/qcom_q6v5_mss.c > +++ b/drivers/remoteproc/qcom_q6v5_mss.c > @@ -1210,6 +1210,14 @@ static int q6v5_mpss_load(struct q6v5 *qproc) > goto release_firmware; > } > > + if (phdr->p_filesz > phdr->p_memsz) { > + dev_err(qproc->dev, > + "refusing to load segment %d with p_filesz > p_memsz\n", > + i); > + ret = -EINVAL; > + goto release_firmware; > + } > + > ptr = memremap(qproc->mpss_phys + offset, phdr->p_memsz, MEMREMAP_WC); > if (!ptr) { > dev_err(qproc->dev, > @@ -1241,6 +1249,16 @@ static int q6v5_mpss_load(struct q6v5 *qproc) > goto release_firmware; > } > > + if (seg_fw->size != phdr->p_filesz) { > + dev_err(qproc->dev, > + "failed to load segment %d from truncated file %s\n", > + i, fw_name); > + ret = -EINVAL; > + release_firmware(seg_fw); > + memunmap(ptr); > + goto release_firmware; > + } > + Reviewed-by: Mathieu Poirier <mathieu.poirier@linaro.org> > release_firmware(seg_fw); > } > > -- > 2.29.2 >
Hello: This patch was applied to qcom/linux.git (refs/heads/for-next): On Fri, 12 Mar 2021 15:20:02 -0800 you wrote: > Analog to the issue in the common mdt_loader code the MSS ELF loader > does not validate that p_filesz bytes will fit in the memory region and > that the loaded segments are not truncated. Fix this in the same way > as proposed for the mdt_loader. > > Fixes: 135b9e8d1cd8 ("remoteproc: qcom_q6v5_mss: Validate modem blob firmware size before load") > Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org> > > [...] Here is the summary with links: - [v2] remoteproc: qcom_q6v5_mss: Validate p_filesz in ELF loader https://git.kernel.org/qcom/c/3d2ee78906af You are awesome, thank you! -- Deet-doot-dot, I am a bot. https://korg.docs.kernel.org/patchwork/pwbot.html
diff --git a/drivers/remoteproc/qcom_q6v5_mss.c b/drivers/remoteproc/qcom_q6v5_mss.c index 66106ba25ba3..14e0ce5f18f5 100644 --- a/drivers/remoteproc/qcom_q6v5_mss.c +++ b/drivers/remoteproc/qcom_q6v5_mss.c @@ -1210,6 +1210,14 @@ static int q6v5_mpss_load(struct q6v5 *qproc) goto release_firmware; } + if (phdr->p_filesz > phdr->p_memsz) { + dev_err(qproc->dev, + "refusing to load segment %d with p_filesz > p_memsz\n", + i); + ret = -EINVAL; + goto release_firmware; + } + ptr = memremap(qproc->mpss_phys + offset, phdr->p_memsz, MEMREMAP_WC); if (!ptr) { dev_err(qproc->dev, @@ -1241,6 +1249,16 @@ static int q6v5_mpss_load(struct q6v5 *qproc) goto release_firmware; } + if (seg_fw->size != phdr->p_filesz) { + dev_err(qproc->dev, + "failed to load segment %d from truncated file %s\n", + i, fw_name); + ret = -EINVAL; + release_firmware(seg_fw); + memunmap(ptr); + goto release_firmware; + } + release_firmware(seg_fw); }
Analog to the issue in the common mdt_loader code the MSS ELF loader does not validate that p_filesz bytes will fit in the memory region and that the loaded segments are not truncated. Fix this in the same way as proposed for the mdt_loader. Fixes: 135b9e8d1cd8 ("remoteproc: qcom_q6v5_mss: Validate modem blob firmware size before load") Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org> --- Changes since v1: - Don't just break the loop, goto release_firmware. - Release seg_fw as well. drivers/remoteproc/qcom_q6v5_mss.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) -- 2.29.2