[5.16,04/28] remoteproc: qcom: pil_info: Dont memcpy_toio more than is provided

From: Stephen Boyd <swboyd@chromium.org>

From: Stephen Boyd <swboyd@chromium.org>

commit fdc12231d885119cc2e2b4f3e0fbba3155f37a56 upstream.

If the string passed into qcom_pil_info_store() isn't as long as
PIL_RELOC_NAME_LEN we'll try to copy the string assuming the length is
PIL_RELOC_NAME_LEN to the io space and go beyond the bounds of the
string. Let's only copy as many byes as the string is long, ignoring the
NUL terminator.

This fixes the following KASAN error:

 BUG: KASAN: global-out-of-bounds in __memcpy_toio+0x124/0x140
 Read of size 1 at addr ffffffd35086e386 by task rmtfs/2392

 CPU: 2 PID: 2392 Comm: rmtfs Tainted: G        W         5.16.0-rc1-lockdep+ #10
 Hardware name: Google Lazor (rev3+) with KB Backlight (DT)
 Call trace:
  dump_backtrace+0x0/0x410
  show_stack+0x24/0x30
  dump_stack_lvl+0x7c/0xa0
  print_address_description+0x78/0x2bc
  kasan_report+0x160/0x1a0
  __asan_report_load1_noabort+0x44/0x50
  __memcpy_toio+0x124/0x140
  qcom_pil_info_store+0x298/0x358 [qcom_pil_info]
  q6v5_start+0xdf0/0x12e0 [qcom_q6v5_mss]
  rproc_start+0x178/0x3a0
  rproc_boot+0x5f0/0xb90
  state_store+0x78/0x1bc
  dev_attr_store+0x70/0x90
  sysfs_kf_write+0xf4/0x118
  kernfs_fop_write_iter+0x208/0x300
  vfs_write+0x55c/0x804
  ksys_pwrite64+0xc8/0x134
  __arm64_compat_sys_aarch32_pwrite64+0xc4/0xdc
  invoke_syscall+0x78/0x20c
  el0_svc_common+0x11c/0x1f0
  do_el0_svc_compat+0x50/0x60
  el0_svc_compat+0x5c/0xec
  el0t_32_sync_handler+0xc0/0xf0
  el0t_32_sync+0x1a4/0x1a8

 The buggy address belongs to the variable:
  .str.59+0x6/0xffffffffffffec80 [qcom_q6v5_mss]

 Memory state around the buggy address:
  ffffffd35086e280: 00 00 00 00 02 f9 f9 f9 f9 f9 f9 f9 00 00 00 00
  ffffffd35086e300: 00 02 f9 f9 f9 f9 f9 f9 00 00 00 06 f9 f9 f9 f9
 >ffffffd35086e380: 06 f9 f9 f9 05 f9 f9 f9 00 00 00 00 00 06 f9 f9
                    ^
  ffffffd35086e400: f9 f9 f9 f9 01 f9 f9 f9 04 f9 f9 f9 00 00 01 f9
  ffffffd35086e480: f9 f9 f9 f9 00 00 00 00 00 00 00 01 f9 f9 f9 f9

Fixes: 549b67da660d ("remoteproc: qcom: Introduce helper to store pil info in IMEM")
Signed-off-by: Stephen Boyd <swboyd@chromium.org>
Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Link: https://lore.kernel.org/r/20211117065454.4142936-1-swboyd@chromium.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/remoteproc/qcom_pil_info.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Message ID	20220118160452.542527418@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Stephen Boyd <swboyd@chromium.org>, Bjorn Andersson <bjorn.andersson@linaro.org> Subject: [PATCH 5.16 04/28] remoteproc: qcom: pil_info: Dont memcpy_toio more than is provided Date: Tue, 18 Jan 2022 17:05:59 +0100 Message-Id: <20220118160452.542527418@linuxfoundation.org> In-Reply-To: <20220118160452.384322748@linuxfoundation.org> References: <20220118160452.384322748@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.15,09/28] KVM: x86: dont print when fail to read/write pv eoi memory [5.16,02/28] drm/amd/display: explicitly set is_dsc_supported to false before use [5.16,03/28] orangefs: Fix the size of a memory allocation in orangefs_bufmap_alloc() [5.16,04/28] remoteproc: qcom: pil_info: Dont memcpy_toio more than is provided [5.16,05/28] vfs: fs_context: fix up param length parsing in legacy_parse_param [5.16,06/28] perf: Protect perf_guest_cbs with RCU [5.16,07/28] KVM: x86: Register perf callbacks after calling vendors hardware_setup() [5.15,16/28] firmware: qemu_fw_cfg: fix sysfs information leak [5.16,08/28] KVM: x86: Register Processor Trace interrupt hook iff PT enabled in guest [5.16,10/28] KVM: s390: Clarify SIGP orders versus STOP/RESTART [5.16,11/28] remoteproc: qcom: pas: Add missing power-domain "mxc" for CDSP [5.16,12/28] NFSD: Fix zero-length NFSv3 WRITEs [5.16,13/28] 9p: only copy valid iattrs in 9P2000.L setattr implementation [5.16,14/28] 9p: fix enodata when reading growing file [5.16,15/28] video: vga16fb: Only probe for EGA and VGA 16 color graphic cards [5.16,17/28] rtlwifi: rtl8192cu: Fix WARNING when calling local_irq_restore() with interrupts ena... [5.16,18/28] firmware: qemu_fw_cfg: fix sysfs information leak [5.16,19/28] firmware: qemu_fw_cfg: fix NULL-pointer deref on duplicate entries [5.16,20/28] firmware: qemu_fw_cfg: fix kobject leak in probe error path [5.16,21/28] perf annotate: Avoid TUI crash when navigating in the annotation of recursive functions [5.16,22/28] ALSA: hda/realtek: Add speaker fixup for some Yoga 15ITL5 devices [5.16,23/28] ALSA: hda/realtek: Use ALC285_FIXUP_HP_GPIO_LED on another HP laptop [5.16,24/28] ALSA: hda/realtek - Fix silent output on Gigabyte X570 Aorus Master after reboot fro... [5.16,25/28] ALSA: hda: ALC287: Add Lenovo IdeaPad Slim 9i 14ITL5 speaker quirk [5.16,26/28] ALSA: hda/tegra: Fix Tegra194 HDA reset failure [5.16,27/28] ALSA: hda/realtek: Add quirk for Legion Y9000X 2020 [5.16,28/28] ALSA: hda/realtek: Re-order quirk entries for Lenovo

[5.16,04/28] remoteproc: qcom: pil_info: Dont memcpy_toio more than is provided

Commit Message

Patch