From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1721C27453; Tue, 29 Apr 2025 16:47:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1745945236; cv=none; b=V4BGjfN8VROPh9/PWM1QQQcXQZCb2EHmiiHU11aGNWecu3vRQeRr0Nk66n2xV0HnqNWWmmLIgmB644tblu5D/Yk4Po8BcgVzmEq32+pDOY1wASFnBZskojJSiDDI8jwL/P/5BeJe1iYjg9mscTKtWx5VZihKr7MRjGGXOF4ssQM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1745945236; c=relaxed/simple; bh=/LwShb2i05BR4p2nTZCrpccAJ+u+DzbNrVqRIxf0r8A=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=r75FD/s4IhXjDo82UUH+APz4BuxdCyjGOjT0kgOp1/QTDwlW8ULV0hHgTKqW+kN8nuHKDx5kK58+JmIQQ/cma0y2poVKGpz/9yPGxHL/9XGj4qHueBQxTy4B64vua7rQ6iTqDBGc9FYY454tKQsBpGrXa/8HQNBlUzflT4IF1ZM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=MCKlXE97; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="MCKlXE97" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7B14CC4CEE9; Tue, 29 Apr 2025 16:47:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1745945236; bh=/LwShb2i05BR4p2nTZCrpccAJ+u+DzbNrVqRIxf0r8A=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MCKlXE97gUTdNInsnRjFM7SquF5Dfa80APlAwVkS1sa3VpLOIGHKGqBUuhaZhlj8S VWN4LETwxKEb728jfbb81btVlCBD4TR1r2I20cDXo1bQ7Dwq8/rrJ1Xx60ykVILEjs IVJdgfxjWWWO0pqljhMpjLE7QrbWq9wgyrUUbA2c= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Bryan ODonoghue , Vikash Garodia , Hans Verkuil Subject: [PATCH 5.4 045/179] media: venus: hfi: add a check to handle OOB in sfr region Date: Tue, 29 Apr 2025 18:39:46 +0200 Message-ID: <20250429161051.227460900@linuxfoundation.org> X-Mailer: git-send-email 2.49.0 In-Reply-To: <20250429161049.383278312@linuxfoundation.org> References: <20250429161049.383278312@linuxfoundation.org> User-Agent: quilt/0.68 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 5.4-stable review patch. If anyone has any objections, please let me know. ------------------ From: Vikash Garodia commit f4b211714bcc70effa60c34d9fa613d182e3ef1e upstream. sfr->buf_size is in shared memory and can be modified by malicious user. OOB write is possible when the size is made higher than actual sfr data buffer. Cap the size to allocated size for such cases. Cc: stable@vger.kernel.org Fixes: d96d3f30c0f2 ("[media] media: venus: hfi: add Venus HFI files") Reviewed-by: Bryan O'Donoghue Signed-off-by: Vikash Garodia Signed-off-by: Hans Verkuil Signed-off-by: Greg Kroah-Hartman --- drivers/media/platform/qcom/venus/hfi_venus.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) --- a/drivers/media/platform/qcom/venus/hfi_venus.c +++ b/drivers/media/platform/qcom/venus/hfi_venus.c @@ -970,18 +970,26 @@ static void venus_sfr_print(struct venus { struct device *dev = hdev->core->dev; struct hfi_sfr *sfr = hdev->sfr.kva; + u32 size; void *p; if (!sfr) return; - p = memchr(sfr->data, '\0', sfr->buf_size); + size = sfr->buf_size; + if (!size) + return; + + if (size > ALIGNED_SFR_SIZE) + size = ALIGNED_SFR_SIZE; + + p = memchr(sfr->data, '\0', size); /* * SFR isn't guaranteed to be NULL terminated since SYS_ERROR indicates * that Venus is in the process of crashing. */ if (!p) - sfr->data[sfr->buf_size - 1] = '\0'; + sfr->data[size - 1] = '\0'; dev_err_ratelimited(dev, "SFR message from FW: %s\n", sfr->data); }