From patchwork Wed Oct 12 16:00:35 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Loic Pallardy X-Patchwork-Id: 77560 Delivered-To: patch@linaro.org Received: by 10.140.97.247 with SMTP id m110csp510269qge; Wed, 12 Oct 2016 09:04:34 -0700 (PDT) X-Received: by 10.66.190.4 with SMTP id gm4mr2420287pac.210.1476288274244; Wed, 12 Oct 2016 09:04:34 -0700 (PDT) Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id n10si8301813pae.328.2016.10.12.09.04.33; Wed, 12 Oct 2016 09:04:34 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755710AbcJLQEX (ORCPT + 27 others); Wed, 12 Oct 2016 12:04:23 -0400 Received: from mx08-00178001.pphosted.com ([91.207.212.93]:52079 "EHLO mx07-00178001.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1753680AbcJLQCy (ORCPT ); Wed, 12 Oct 2016 12:02:54 -0400 Received: from pps.filterd (m0046660.ppops.net [127.0.0.1]) by mx08-00178001.pphosted.com (8.16.0.11/8.16.0.11) with SMTP id u9CFuSgs029213; Wed, 12 Oct 2016 18:01:24 +0200 Received: from beta.dmz-eu.st.com (beta.dmz-eu.st.com [164.129.1.35]) by mx08-.pphosted.com with ESMTP id 2615cgwhy0-1 (version=TLSv1 cipher=ECDHE-RSA-AES256-SHA bits=256 verify=NOT); Wed, 12 Oct 2016 18:01:24 +0200 Received: from zeta.dmz-eu.st.com (zeta.dmz-eu.st.com [164.129.230.9]) by beta.dmz-eu.st.com (STMicroelectronics) with ESMTP id 085D93A; Wed, 12 Oct 2016 16:01:22 +0000 (GMT) Received: from Webmail-eu.st.com (Safex1hubcas22.st.com [10.75.90.92]) by zeta.dmz-eu.st.com (STMicroelectronics) with ESMTP id 9CE4B2AB7; Wed, 12 Oct 2016 16:01:22 +0000 (GMT) Received: from localhost (10.201.23.23) by Webmail-ga.st.com (10.75.90.48) with Microsoft SMTP Server (TLS) id 14.3.279.2; Wed, 12 Oct 2016 18:01:22 +0200 From: Loic Pallardy To: , , CC: , , , Subject: [PATCH v3 17/20] remoteproc: core: Add function to verify resource table consistency Date: Wed, 12 Oct 2016 18:00:35 +0200 Message-ID: <1476288038-24909-18-git-send-email-loic.pallardy@st.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1476288038-24909-1-git-send-email-loic.pallardy@st.com> References: <1476288038-24909-1-git-send-email-loic.pallardy@st.com> MIME-Version: 1.0 X-Originating-IP: [10.201.23.23] X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-10-12_09:, , signatures=0 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org As resource table could be parsed several times, at different times, to avoid sanity check duplication, let's introduce a new function to verify the complete integrity of one resource table. This new function is called before copying it in cache and accessing it. Signed-off-by: Loic Pallardy --- drivers/remoteproc/remoteproc_core.c | 70 ++++++++++++++++++++++++++++++++++++ 1 file changed, 70 insertions(+) -- 1.9.1 diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c index 559a63b..849460e 100644 --- a/drivers/remoteproc/remoteproc_core.c +++ b/drivers/remoteproc/remoteproc_core.c @@ -785,6 +785,69 @@ static void rproc_resource_cleanup(struct rproc *rproc) rproc_remove_virtio_dev(rvdev); } +static int rproc_resource_table_sanity_check(struct rproc *rproc, + struct resource_table *table_ptr, int len) +{ + struct device *dev = &rproc->dev; + int i; + + if (len < sizeof(*table_ptr)) + goto out; + + for (i = 0; i < table_ptr->num; i++) { + int offset = table_ptr->offset[i]; + struct fw_rsc_hdr *hdr = (void *)table_ptr + offset; + int avail = len - offset - sizeof(*hdr); + void *rsc = (void *)hdr + sizeof(*hdr); + struct fw_rsc_vdev *v; + + /* Make sure table isn't truncated */ + if (avail < 0) + goto out; + + if (offset == FW_RSC_ADDR_ANY || offset == 0) { + dev_err(dev, "Entry %d: bad offset value %x\n", i, offset); + return -EINVAL; + } + + dev_dbg(dev, "rsc: type %d\n", hdr->type); + + switch (hdr->type) { + case RSC_CARVEOUT: + avail -= sizeof(struct fw_rsc_carveout); + break; + case RSC_DEVMEM: + avail -= sizeof(struct fw_rsc_devmem); + break; + case RSC_TRACE: + avail -= sizeof(struct fw_rsc_trace); + break; + case RSC_VDEV: + v = rsc; + avail -= sizeof(struct fw_rsc_vdev); + if (avail < 0) + goto out; + + avail -= v->num_of_vrings * sizeof(struct fw_rsc_vdev_vring) + + v->config_len; + break; + default: + dev_err(&rproc->dev, "Unsupported resource type: %d\n", + hdr->type); + return -EINVAL; + } + if (avail < 0) + goto out; + } + + return 0; + +out: + dev_err(dev, "Invalid resource table format\n"); + dump_stack(); + return -EINVAL; +} + static void rproc_dump_resource_table(struct rproc *rproc, struct resource_table *table, int size) { @@ -1246,6 +1309,13 @@ static int rproc_fw_boot(struct rproc *rproc, const struct firmware *fw) goto clean_up; } + /* Verify resource table consistency */ + ret = rproc_resource_table_sanity_check(rproc, table, tablesz); + if (ret) { + dev_err(dev, "Failed to get valid resource table,%d\n", ret); + goto clean_up; + } + /* * Create a copy of the resource table. When a virtio device starts * and calls vring_new_virtqueue() the address of the allocated vring