[PATCH 0/2] Harden DPFE driver against buggy/malicious DCPU

[Danesh Petigara <danesh.petigara@broadcom.com>]

This patch series hardens the Broadcom STB DPFE driver against potential
exploitation through a buggy or compromised DCPU coprocessor.

The DPFE driver exchanges messages with the DCPU over shared memory-mapped
regions and currently trusts DCPU supplied values without bounds checking
them before use.

A compromised or malfunctioning DCPU could:

- On API v1/v2 boards, provide an arbitrary MMIO read/write primitive
  through the offset supplied in get_msg_ptr(), combined with
  root-writable and world-readable sysfs files.

- Make a user who reads world-readable sysfs files trigger an out-of-bounds
  stack read of arbitrary extent via an unvalidated checksum index.

Patch 1 addresses the MMIO read/write issue by rejecting an offset that,
along with the largest field accessed (DRAM_VENDOR_ERROR + sizeof(u32)),
exceeds the recorded mapping size.

Patch 2 addresses the stack over-read via the checksum index by checking
it against MSG_FIELD_MAX after reading the response from the DCPU message
RAM.

Justin Chen (2):
  memory: brcmstb_dpfe: Fix out-of-bounds access due to DCPU offset
  memory: brcmstb_dpfe: Bounds check DCPU-supplied MSG_ARG_COUNT

 drivers/memory/brcmstb_dpfe.c | 24 ++++++++++++++++++++++--
 1 file changed, 22 insertions(+), 2 deletions(-)

-- 
2.54.0