From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 3093FC4451B for ; Sat, 18 Jul 2026 17:14:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help :List-Post:List-Archive:List-Unsubscribe:List-Id:Content-Transfer-Encoding: Content-Type:In-Reply-To:From:References:Cc:To:Subject:MIME-Version:Date: Message-ID:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=Kmg/oVx9eDq9DbjD5LyWE41pOadzdERcbN6f9vfP8Zg=; b=axGcA/ySwCtSFhedFOAw+lYizi ZqcrdJxEtzILxaaR/zEOD6EMwo9GtKTIyYMnGK3A/tzARLOkrpE7Xsu96AinwZpBJnmTmM0OhTaSw MOvaQcoId9PJhhAYAf1Wj9fm+HIPzNSFrKm5wlfK8yvY32/N+rr0Wy3DF/TmBUvUIhASvUhi8fSJa /1+j2hYu4YrjRic8E7oOF6zgzjAqvec+jc0H8/SoluQUV6YENJrbFcTG+BWGqoCCCJdO8ItNkJdH7 8DyGQcqPwE0m310v2aJYrutZwi5U5ObYvcFUib4E99GUpsJVJlx7ebk20ePeOfNdAC8UouTf1qwwZ LQdE3zDg==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1wl8cc-00000004O90-1QB0; Sat, 18 Jul 2026 17:14:42 +0000 Received: from tor.source.kernel.org ([172.105.4.254]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1wl8ca-00000004O8U-1RIs for linux-arm-kernel@lists.infradead.org; Sat, 18 Jul 2026 17:14:41 +0000 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) by tor.source.kernel.org (Postfix) with ESMTP id 78F506001A; Sat, 18 Jul 2026 17:14:39 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C2D361F000E9; Sat, 18 Jul 2026 17:14:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784394879; bh=Kmg/oVx9eDq9DbjD5LyWE41pOadzdERcbN6f9vfP8Zg=; h=Date:Subject:To:Cc:References:From:In-Reply-To; b=jroHrji20KSSfWwo4f8dE0447gyvuablthWD6Az31nNGbuYDXHvBT+lH7Uoay8yqW 3C1K+NVUhadsPLLmeY+x2OQI8BqAZ7M1Cql9QS+/zxBSY9tq9teZ4Vn4uvy1UtmJKj pgySLCxU32ygO0A7Rl7abobV7dN8Y8G81SHCfbo6S+T/pmyonS7t0mCNICUNXq6gPF qgTpoo01hK+4eQMWiqlUt+HwH/dbgwxgLjZ2FDuoR4ubFVwDEzT/VIVK7S5ZhOFDRY cAneLddBAdt45YNH0s0kE/xXtG/fKvGJmCcFZPBs0vEplLmX1O0z9f1DWyJzDthd4g Xhn/EMwVkAgEQ== Message-ID: Date: Sat, 18 Jul 2026 19:14:33 +0200 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] memory: brcmstb_dpfe: validate firmware section sizes To: Pengpeng Hou , Markus Mayer Cc: Broadcom internal kernel review list , Florian Fainelli , linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org References: <20260706092223.78541-1-pengpeng@iscas.ac.cn> From: Krzysztof Kozlowski Content-Language: en-US Autocrypt: addr=krzk@kernel.org; keydata= xsFNBFVDQq4BEAC6KeLOfFsAvFMBsrCrJ2bCalhPv5+KQF2PS2+iwZI8BpRZoV+Bd5kWvN79 cFgcqTTuNHjAvxtUG8pQgGTHAObYs6xeYJtjUH0ZX6ndJ33FJYf5V3yXqqjcZ30FgHzJCFUu JMp7PSyMPzpUXfU12yfcRYVEMQrmplNZssmYhiTeVicuOOypWugZKVLGNm0IweVCaZ/DJDIH gNbpvVwjcKYrx85m9cBVEBUGaQP6AT7qlVCkrf50v8bofSIyVa2xmubbAwwFA1oxoOusjPIE J3iadrwpFvsZjF5uHAKS+7wHLoW9hVzOnLbX6ajk5Hf8Pb1m+VH/E8bPBNNYKkfTtypTDUCj NYcd27tjnXfG+SDs/EXNUAIRefCyvaRG7oRYF3Ec+2RgQDRnmmjCjoQNbFrJvJkFHlPeHaeS BosGY+XWKydnmsfY7SSnjAzLUGAFhLd/XDVpb1Een2XucPpKvt9ORF+48gy12FA5GduRLhQU vK4tU7ojoem/G23PcowM1CwPurC8sAVsQb9KmwTGh7rVz3ks3w/zfGBy3+WmLg++C2Wct6nM Pd8/6CBVjEWqD06/RjI2AnjIq5fSEH/BIfXXfC68nMp9BZoy3So4ZsbOlBmtAPvMYX6U8VwD TNeBxJu5Ex0Izf1NV9CzC3nNaFUYOY8KfN01X5SExAoVTr09ewARAQABzSVLcnp5c3p0b2Yg S296bG93c2tpIDxrcnprQGtlcm5lbC5vcmc+wsGPBBMBCgA5AhsDBgsJCAcDAgYVCAIJCgsE FgIDAQIeAQIXgBYhBJvQfg4MUfjVlne3VBuTQ307QWKbBQJp2mE8AAoJEBuTQ307QWKbeaIP /ihHTkTW4KsN/DQ945JJbyu5tI0J80Wue7QyyLPglyKfhgb5cLLNPpOC8cCIJsc7+W3i2P38 s2c1cOH6CYGE7E9ur3Vfme8NW2S2I/Z8VC7bZnzyS23wT17LrsdS/qCpx4o8U+pt/xdXDKph EGRYrIEmMpUWvyYzyYKGIe25FtaayIIKpq8eZYyFcp2f/sG5IkOW5uZzHPMPdcm87jU7fyuQ rAU2vx9r+ulUfQ/q9Z2roC/ode3l7t2pN7BCBCsUDp6JCrUyZrtT1e7EbA0ZRP3aOBNk2P2E DQOgJGjGdO5Yx2Y9LFtltu6JbsBJHi1syGRX3AtQYOMc4Y1WGoeZJmMlvKj2ZqqXNkcWi2DS IQEWB0uW6CqFsBBIMGDa+6OzdaVO/uAVXWDWml02Men3CILdI1MbVjoh8ECqYUY7OQ+JJvNN vnliuq5WM3Ghd3jg/LZZrxXjdIginRHFQCjIJYLKpLZWm1/iDFedcfzqRNYmTtqscdCNHW41 oT3Z7BmO9xwdjuwBS6nmS6JJwkbf5Ot2QR4pB/DRU7ZwjT1qHe+9r9gF32wXVQatHNGK/VVu sfwOnkdxCWkp/qb2gdQRmZh+SedStWshigH6sNfuHBloF/q+hjMRc8b2m326OZdrbSHwY1Sz vti8Hn7n8NjdHO9LKB7BIdjkA9DA5WsqOuVCzsFNBFVDXDQBEADNkrQYSREUL4D3Gws46JEo Z9HEQOKtkrwjrzlw/tCmqVzERRPvz2Xg8n7+HRCrgqnodIYoUh5WsU84N03KlLueMNsWLJBv BaubYN4JuJIdRr4dS4oyF1/fQAQPHh8Thpiz0SAZFx6iWKB7Qrz3OrGCjTPcW6eiOMheesVS 5hxietSmlin+SilmIAPZHx7n242u6kdHOh+/SyLImKn/dh9RzatVpUKbv34eP1wAGldWsRxb f3WP9pFNObSzI/Bo3kA89Xx2rO2roC+Gq4LeHvo7ptzcLcrqaHUAcZ3CgFG88CnA6z6lBZn0 WyewEcPOPdcUB2Q7D/NiUY+HDiV99rAYPJztjeTrBSTnHeSBPb+qn5ZZGQwIdUW9YegxWKvX XHTwB5eMzo/RB6vffwqcnHDoe0q7VgzRRZJwpi6aMIXLfeWZ5Wrwaw2zldFuO4Dt91pFzBSO IpeMtfgb/Pfe/a1WJ/GgaIRIBE+NUqckM+3zJHGmVPqJP/h2Iwv6nw8U+7Yyl6gUBLHFTg2h YnLFJI4Xjg+AX1hHFVKmvl3VBHIsBv0oDcsQWXqY+NaFahT0lRPjYtrTa1v3tem/JoFzZ4B0 p27K+qQCF2R96hVvuEyjzBmdq2esyE6zIqftdo4MOJho8uctOiWbwNNq2U9pPWmu4vXVFBYI GmpyNPYzRm0QPwARAQABwsF2BBgBCgAgAhsMFiEEm9B+DgxR+NWWd7dUG5NDfTtBYpsFAmna YUkACgkQG5NDfTtBYptX+BAApg32CkxwNucNEi8WfWA8oKkW0y8YDuY6ORMo9FWNGiT/OTy0 vyJrLocrpn86zwfjVp+eCrssPYh8eqJfnWqmYv6ACQtHPYzPZQ3mSo8H97Z01oUxITzCxpXm ZkLgPIqtDPcC2E3dPM/fVxcyowM8XsaMA9wcsaUYrta8toOq2b9tKcjleKMfMrm0gQ9u7wUc QbLkwj6TCLOwucb07GXzLTNF9PZmaDUpKAZjMjmrW+le+SFvQbhamx0rxLWPR0NWntXpbCn+ +ACch03p/JyTBVktxFsFyCt7pTPE1kEaeuXBTe/a2D9iQvRxRW19LvuO2e59/u1wYUiH/orz wbIC2S4dBsPAPihL3ztOU1yE86GPyQtSE0kU+/7snnLt4QGi6PChf3t5gnNjAzjUUovO8rgI c+5yN5heq5loYHgK6OQ9OlHzsPHO9e9MOQcKlFycs1pyijFGzDwdNUm/SchK8iWT2QApTx4A K9bCVaboTA2T77QYkRcRJYSsO1alGX0ome/hMLD1daXlkrNUp1HWa3K4iytLRXjCSIorWiGs n+q3krnpXu3TFkA8qtOFZMdnIiFuiq1yLT8hptsV5xh1TA2nsVvSYiaCr3q4s4BKjS/KrLDb qoxzw8ISjdUp4pA85vb6YLCmb39NgidD+7PmAr65lBNveIFynTgsja1rRQ4= In-Reply-To: <20260706092223.78541-1-pengpeng@iscas.ac.cn> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org On 06/07/2026 11:22, Pengpeng Hou wrote: > __verify_firmware() reads a firmware header and sums declared > data and instruction section sizes with a trailing checksum. > > Require the image to contain the header and checksum, and check each > declared section against the remaining firmware size before computing the > final total. > > Signed-off-by: Pengpeng Hou > --- > drivers/memory/brcmstb_dpfe.c | 10 ++++++++++ > 1 file changed, 10 insertions(+) > > diff --git a/drivers/memory/brcmstb_dpfe.c b/drivers/memory/brcmstb_dpfe.c > index 08d9e05b1b33..6846e3dac3d3 100644 > --- a/drivers/memory/brcmstb_dpfe.c > +++ b/drivers/memory/brcmstb_dpfe.c > @@ -522,6 +522,9 @@ static int __verify_firmware(struct init_data *init, > bool is_big_endian = false; > const u32 *chksum_ptr; > > + if (fw->size < sizeof(*header) + sizeof(*chksum_ptr)) > + return ERR_INVALID_SIZE; This looks redundant, there is a check at line 546 for this, no? > + > if (header->magic == DPFE_BE_MAGIC) > is_big_endian = true; > else if (header->magic != DPFE_LE_MAGIC) > @@ -539,6 +542,13 @@ static int __verify_firmware(struct init_data *init, > if ((dmem_size % sizeof(u32)) != 0 || (imem_size % sizeof(u32)) != 0) > return ERR_INVALID_SIZE; > > + if (dmem_size > fw->size - sizeof(*header) - sizeof(*chksum_ptr)) > + return ERR_INVALID_SIZE; > + > + if (imem_size > fw->size - sizeof(*header) - sizeof(*chksum_ptr) - > + dmem_size) > + return ERR_INVALID_SIZE; Is this vibe coded with some tools? Look like but I see not Assisted-by tags. Best regards, Krzysztof