From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ua1-f46.google.com (mail-ua1-f46.google.com [209.85.222.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8102E3E5585 for ; Thu, 2 Apr 2026 12:55:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.222.46 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775134531; cv=none; b=YthU9FIZq8Gmvao5ysGaEFIiyp4nu78V1ru3hGw7cBRUFSPXaVT+6xZM0ZDrC2W2o8Awmb/9811qI1diSDwne82fLXuGCNBGAUHei3ATSLNH9WCOoIFQlQztNmXRiQ4oSNtFL4/ByiBWNY6Eltf1UovDx+/uj8PUOW7xAu9Xk8I= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775134531; c=relaxed/simple; bh=+XwAz1WI5ah5S4NeumOZ3kgf/WtVzeiZRQij793c8Z0=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=bMVaO/fq7JeoVF+oSKj3tyDPTqSGNSMPP71/KnZmm0vEcF1fzy1+v3wQ2S5rvLjTYCMIYhuzGqTwmz6YCV6yUJwoAEgd0FS3rLGGMxIgXBe+GNHXDEcBULoxQFhmeI5W7hdp4yVIeaJYxMEfmjwBStN6RLXNZ8YmXVGnSxIk5Nk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=saLoC7qh; arc=none smtp.client-ip=209.85.222.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="saLoC7qh" Received: by mail-ua1-f46.google.com with SMTP id a1e0cc1a2514c-953ad5a55b7so571000241.3 for ; Thu, 02 Apr 2026 05:55:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1775134520; x=1775739320; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=xUGZdZqGdvHzMx1k3Ek8/WSt4jcVtA9CO60KzOm8meg=; b=saLoC7qhL6f01+gvBOC2RUlSm8NZfCYMVFvnK1XLuZZuiVfv0NCuyJQaDHbajbgCkr /zMU5VF1cW+09Jaz6OmWrvawQlEFHE7jnEXtcnSdTE96c6nuRMVdwlQYly9GhXxw2EKs 8CX31tlpP8WRlKTUflqPpG6NX+Yr6XVMPqzumTIlwn8Ixd0FMHcpkv4EzbNQo3yMzEu4 h/bH8ZE4qS7SwCJNtoQ/iE6fxFko6VDN0f4jVtLWjfz+wPzIabh3SLB2KibFGwxvkBPz pX75uSXdJCYpax4TErWBq8SeWRXs/LcT92tlVhrQQplKryRxZ7CNBIwyGemSlTSzHi0O +QlQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1775134520; x=1775739320; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=xUGZdZqGdvHzMx1k3Ek8/WSt4jcVtA9CO60KzOm8meg=; b=V6FddgoyMsCmmJ+YIxx2K4zEPEVS+/1mppz/8cGicNuYODfuKy9eNbNZRwJ8ZJHEZs YYOt7weYTZypwKiaYozbuCNi8kQb1g1N2nTf3BQS6Zp07QwV72Lc9ZPaIVHEmEtW+ky2 XO0BP1XcpHV65dOoVW0P/Cuxsf56RE5qzMZm5rSEW46Z5kyFDVswT/fDrO4oH5kiM3dk LTRXQvnxdAX2+R7aOzRvpa0Iv5O4ICMBBKo2qe/9MGn74c6fvuEMYiLRPufIk6KmKP+d XDjUaZbbxbhtmo8f/Lveb5kmgC184wTaERyIcloIaWWwYt20kITKWFwzkcQoXRwiAz8V iESg== X-Forwarded-Encrypted: i=1; AJvYcCXVRGn5vx8vFUN7ZeZl6T4thELoraUF4USK1x3JU/ob3f8jxJwiK/+KdThTG/W4jm5DU2QziJys8ATrHj8=@vger.kernel.org X-Gm-Message-State: AOJu0Ywv2ZlxNxnuyVzowPPYG051K0BZ+o5NRx/SpZ9QL1b/p5KX11tZ jP126YvQC7Jf6tt1dR8OyDM1jH1FQ8g3Hn4XL9KoktXl83j2fapWGBXV X-Gm-Gg: ATEYQzwjPE1T5B5Ft59KUOuXns+hO6+ddaOIkgyK8kbDwTjGKEH+AQo9zKnCQexLXgB kPSkSwrfYQHdBl1vSQuZPaplZ/+Zbf+BXnmHNW9d5nc7MUpRkG31CdUu135pJOOGYxOdFtxVhbb r1i/UuPGxGG5WN4josdlHKVrn8m1zH6ARoqWRJTgHMFuZN1TpswU+wW+aqZubUcNeOpoa6omr9O v0XwyTcbyAB1oX2vRYojZeRgzYLGBbc6LIgVyKO+LOI06uvTrLROJaXFb7V7tB88QEZPlGbnPv4 aMXWk+DTmvPB9D+YmaJFM5AyMpTWpvmECb+6+68axGQh2TYXjAwCgHHamYzqAJXJ3y1kxmqtSWP sYST44MYgjKG9tuKw6XsP8zuJ1roU5Xyi58Mh8VmRUQA5zd7Q/Ml4qsQK26AZkDTo4RWDAFTvfj MhEy0IPu7P9UPjj9SJcPJunnw= X-Received: by 2002:a05:6102:3581:b0:602:8a42:321e with SMTP id ada2fe7eead31-60583fd1f67mr1334161137.23.1775134519884; Thu, 02 Apr 2026 05:55:19 -0700 (PDT) Received: from localhost.localdomain ([2a09:bac5:6d73:aa::11:178]) by smtp.gmail.com with ESMTPSA id a1e0cc1a2514c-953fba6af44sm3080950241.8.2026.04.02.05.55.18 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 02 Apr 2026 05:55:19 -0700 (PDT) From: Sebastian Alba Vives To: linux-fpga@vger.kernel.org Cc: yilun.xu@linux.intel.com, conor.dooley@microchip.com, mdf@kernel.org, linux-kernel@vger.kernel.org, Sebastian Josue Alba Vives Subject: [PATCH 1/3] fpga: dfl: add bounds check in dfh_get_param_size() Date: Thu, 2 Apr 2026 06:54:44 -0600 Message-ID: <20260402125446.3776153-1-sebasjosue84@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Sebastian Josue Alba Vives dfh_get_param_size() can return a parameter size larger than the feature region because the loop bounds check is evaluated before incrementing size. If the EOP (End of Parameters) bit is set in the same iteration, the inflated size is returned without re-validation against max. This can cause create_feature_instance() to call memcpy_fromio() with a size exceeding the ioremap'd region when a malicious FPGA device provides crafted DFHv1 parameter headers. Add a bounds re-check after the size increment to ensure the returned size never exceeds the feature boundary. Fixes: a80a4b2b2e4f ("fpga: dfl: add support for DFHv1") Signed-off-by: Sebastian Alba Vives --- drivers/fpga/dfl.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/fpga/dfl.c b/drivers/fpga/dfl.c index 4087a36..0f0889a 100644 --- a/drivers/fpga/dfl.c +++ b/drivers/fpga/dfl.c @@ -1133,6 +1133,9 @@ static int dfh_get_param_size(void __iomem *dfh_base, resource_size_t max) size += next * sizeof(u64); + if (size + DFHv1_PARAM_HDR > max) + return -EINVAL; + if (FIELD_GET(DFHv1_PARAM_HDR_NEXT_EOP, v)) return size; } -- 2.43.0