[PATCH v2 0/5] Misc. RSC table changes

[PATCH v2 0/5] Misc. RSC table changes

[Mukesh Ojha]

Integrated multiple separate as one series.

1/5 was part of https://lore.kernel.org/lkml/20260506050107.1985033-6-mukesh.ojha@oss.qualcomm.com/

2/5 to 4/5 was here https://lore.kernel.org/lkml/20260611180550.2442641-1-mukesh.ojha@oss.qualcomm.com/

5/5 was reported as a part of https://lore.kernel.org/lkml/tencent_53F3322FDEB2E45D6412C427B8D1C6081407@qq.com/


Changes in v2:
 - Rebased it on next-20260723
 - Integrated multiple singleton into this series.

Mukesh Ojha (5):
  MAINTAINERS: add rsc_table.h to remoteproc entry
  remoteproc: fix coding style issues in remoteproc.h
  remoteproc: add SPDX-License-Identifier tag to remoteproc.h
  remoteproc: add SPDX-License-Identifier tag to rsc_table.h
  remoteproc: fix OOB read via signed offset in
    rsc_table_for_each_entry()

 MAINTAINERS                |  1 +
 include/linux/remoteproc.h | 10 +++++-----
 include/linux/rsc_table.h  | 18 ++++++++++++------
 3 files changed, 18 insertions(+), 11 deletions(-)

-- 
2.53.0

[PATCH v2 1/5] MAINTAINERS: add rsc_table.h to remoteproc entry

[Mukesh Ojha]

include/linux/rsc_table.h was split out from include/linux/remoteproc.h
to hold the resource table wire-format definitions. Add it to the
REMOTEPROC entry so it is covered by the same maintainers.

Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
---
 MAINTAINERS | 1 +
 1 file changed, 1 insertion(+)

diff --git a/MAINTAINERS b/MAINTAINERS
index cc3c01eecfa2..c1d49922f523 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -22952,6 +22952,7 @@ F:	Documentation/devicetree/bindings/remoteproc/
 F:	Documentation/staging/remoteproc.rst
 F:	drivers/remoteproc/
 F:	include/linux/remoteproc.h
+F:	include/linux/rsc_table.h
 F:	include/linux/remoteproc/
 
 REMOTE PROCESSOR MESSAGING (RPMSG) SUBSYSTEM
-- 
2.53.0

[PATCH v2 2/5] remoteproc: fix coding style issues in remoteproc.h

[Mukesh Ojha]

The function pointer declarations for find_loaded_rsc_table() and
get_loaded_rsc_table() had their opening parenthesis at the end of
the line. Move the first argument onto the same line as the opening
parenthesis to fix the checkpatch warning.

Also remove a spurious blank line after the opening brace in
struct rproc_vdev.

Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
---
 include/linux/remoteproc.h | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/include/linux/remoteproc.h b/include/linux/remoteproc.h
index 17ed75a11e15..9cd0708d5ac9 100644
--- a/include/linux/remoteproc.h
+++ b/include/linux/remoteproc.h
@@ -127,10 +127,10 @@ struct rproc_ops {
 	int (*parse_fw)(struct rproc *rproc, const struct firmware *fw);
 	int (*handle_rsc)(struct rproc *rproc, u32 rsc_type, void *rsc,
 			  int offset, int avail);
-	struct resource_table *(*find_loaded_rsc_table)(
-				struct rproc *rproc, const struct firmware *fw);
-	struct resource_table *(*get_loaded_rsc_table)(
-				struct rproc *rproc, size_t *size);
+	struct resource_table *(*find_loaded_rsc_table)(struct rproc *rproc,
+							const struct firmware *fw);
+	struct resource_table *(*get_loaded_rsc_table)(struct rproc *rproc,
+						       size_t *size);
 	int (*load)(struct rproc *rproc, const struct firmware *fw);
 	int (*sanity_check)(struct rproc *rproc, const struct firmware *fw);
 	u64 (*get_boot_addr)(struct rproc *rproc, const struct firmware *fw);
@@ -379,7 +379,6 @@ struct rproc_vring {
  * @index: vdev position versus other vdev declared in resource table
  */
 struct rproc_vdev {
-
 	struct rproc_subdev subdev;
 	struct platform_device *pdev;
 
-- 
2.53.0

[PATCH v2 3/5] remoteproc: add SPDX-License-Identifier tag to remoteproc.h

[Mukesh Ojha]

Add the missing SPDX-License-Identifier tag consistent with the
BSD-3-Clause license text already present in the file.

Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
---
 include/linux/remoteproc.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/include/linux/remoteproc.h b/include/linux/remoteproc.h
index 9cd0708d5ac9..e6b8fbb0af8e 100644
--- a/include/linux/remoteproc.h
+++ b/include/linux/remoteproc.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: BSD-3-Clause */
 /*
  * Remote Processor Framework
  *
-- 
2.53.0

Re: [PATCH v2 3/5] remoteproc: add SPDX-License-Identifier tag to remoteproc.h

[Bjorn Andersson]

On Sat, Jul 25, 2026 at 12:11:30AM +0530, Mukesh Ojha wrote:
> Add the missing SPDX-License-Identifier tag consistent with the
> BSD-3-Clause license text already present in the file.
> 

Looks like the standard BSD blurb, so I think you should take the
opportunity to replace the blurb with the SPDX header, not "duplicate"
the information.

Please update both patches.

Regards,
Bjorn

> Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
> ---
>  include/linux/remoteproc.h | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/include/linux/remoteproc.h b/include/linux/remoteproc.h
> index 9cd0708d5ac9..e6b8fbb0af8e 100644
> --- a/include/linux/remoteproc.h
> +++ b/include/linux/remoteproc.h
> @@ -1,3 +1,4 @@
> +/* SPDX-License-Identifier: BSD-3-Clause */
>  /*
>   * Remote Processor Framework
>   *
> -- 
> 2.53.0
> 

[PATCH v2 4/5] remoteproc: add SPDX-License-Identifier tag to rsc_table.h

[Mukesh Ojha]

Add the missing SPDX-License-Identifier tag consistent with the
BSD-3-Clause license text already present in the file.

Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
---
 include/linux/rsc_table.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/include/linux/rsc_table.h b/include/linux/rsc_table.h
index c6d6d553d8f1..b78c4760d83e 100644
--- a/include/linux/rsc_table.h
+++ b/include/linux/rsc_table.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: BSD-3-Clause */
 /*
  * Resource table and its types data structure
  *
-- 
2.53.0

[PATCH v2 5/5] remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry()

[Mukesh Ojha]

table->offset[i] is a u32 from firmware, but was stored into a signed
int.  A crafted offset like 0xFFFFFFF0 becomes -16, placing hdr 16 bytes
before the table buffer.  The subsequent avail check was bypassed
because the negative int was promoted to a large size_t in the
expression "table_sz - offset - sizeof(*hdr)", yielding a large positive
avail and letting the out-of-bounds hdr->type read proceed undetected.

Store the offset as u32 and validate it with unsigned comparisons before
any pointer arithmetic.

Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
---
 include/linux/rsc_table.h | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/include/linux/rsc_table.h b/include/linux/rsc_table.h
index b78c4760d83e..f9c5628e16cd 100644
--- a/include/linux/rsc_table.h
+++ b/include/linux/rsc_table.h
@@ -338,17 +338,22 @@ static inline int rsc_table_for_each_entry(struct resource_table *table,
 	int i, ret;
 
 	for (i = 0; i < table->num; i++) {
-		int offset = table->offset[i];
-		struct fw_rsc_hdr *hdr = (void *)table + offset;
-		int avail = table_sz - offset - sizeof(*hdr);
-		int rsc_offset = offset + sizeof(*hdr);
-		void *rsc = (void *)hdr + sizeof(*hdr);
+		u32 offset = table->offset[i];
+		struct fw_rsc_hdr *hdr;
+		int avail, rsc_offset;
+		void *rsc;
 
-		if (avail < 0) {
+		if (offset < sizeof(*table) || offset >= table_sz ||
+		    table_sz - offset < sizeof(*hdr)) {
 			dev_err(dev, "rsc table is truncated\n");
 			return -EINVAL;
 		}
 
+		hdr = (void *)table + offset;
+		avail = table_sz - offset - sizeof(*hdr);
+		rsc_offset = offset + sizeof(*hdr);
+		rsc = (void *)hdr + sizeof(*hdr);
+
 		ret = cb(hdr->type, rsc, rsc_offset, avail, data);
 		if (ret)
 			return ret;
-- 
2.53.0