From: Jeffrey Hugo <jhugo@codeaurora.org>
To: Bhaumik Bhatt <bbhatt@codeaurora.org>, mani@kernel.org
Cc: linux-arm-msm@vger.kernel.org, linux-kernel@vger.kernel.org,
hemantk@codeaurora.org
Subject: Re: [PATCH v4 4/8] bus: mhi: core: Read transfer length from an event properly
Date: Mon, 4 May 2020 08:31:25 -0600 [thread overview]
Message-ID: <4e187d13-951d-4833-ea82-577b0e755521@codeaurora.org> (raw)
In-Reply-To: <1588386725-1165-5-git-send-email-bbhatt@codeaurora.org>
On 5/1/2020 8:32 PM, Bhaumik Bhatt wrote:
> From: Hemant Kumar <hemantk@codeaurora.org>
>
> When MHI Driver receives an EOT event, it reads xfer_len from the
> event in the last TRE. The value is under control of the MHI device
> and never validated by Host MHI driver. The value should never be
> larger than the real size of the buffer but a malicious device can
> set the value 0xFFFF as maximum. This causes driver to memory
> overflow (both read or write). Fix this issue by reading minimum of
> transfer length from event and the buffer length provided.
>
> Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
> Signed-off-by: Bhaumik Bhatt <bbhatt@codeaurora.org>
Reviewed-by: Jeffrey Hugo <jhugo@codeaurora.org>
--
Jeffrey Hugo
Qualcomm Technologies, Inc. is a member of the
Code Aurora Forum, a Linux Foundation Collaborative Project.
next prev parent reply other threads:[~2020-05-04 14:31 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-05-02 2:31 [PATCH v4 0/8] Bug fixes and improved logging in MHI Bhaumik Bhatt
2020-05-02 2:31 ` [PATCH v4 1/8] bus: mhi: core: Refactor mhi queue APIs Bhaumik Bhatt
2020-05-02 2:31 ` [PATCH v4 2/8] bus: mhi: core: Cache intmod from mhi event to mhi channel Bhaumik Bhatt
2020-05-02 2:32 ` [PATCH v4 3/8] bus: mhi: core: Add range check for channel id received in event ring Bhaumik Bhatt
2020-05-02 2:32 ` [PATCH v4 4/8] bus: mhi: core: Read transfer length from an event properly Bhaumik Bhatt
2020-05-04 14:31 ` Jeffrey Hugo [this message]
2020-05-02 2:32 ` [PATCH v4 5/8] bus: mhi: core: Handle firmware load using state worker Bhaumik Bhatt
2020-05-02 2:32 ` [PATCH v4 6/8] bus: mhi: core: Return appropriate error codes for AMSS load failure Bhaumik Bhatt
2020-05-02 2:32 ` [PATCH v4 7/8] bus: mhi: core: Improve debug logs for loading firmware Bhaumik Bhatt
2020-05-02 2:32 ` [PATCH v4 8/8] bus: mhi: core: Ensure non-zero session or sequence ID values are used Bhaumik Bhatt
2020-05-04 14:33 ` Jeffrey Hugo
2020-05-05 2:32 ` bbhatt
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4e187d13-951d-4833-ea82-577b0e755521@codeaurora.org \
--to=jhugo@codeaurora.org \
--cc=bbhatt@codeaurora.org \
--cc=hemantk@codeaurora.org \
--cc=linux-arm-msm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mani@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.