From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2F8681DF73C; Tue, 29 Apr 2025 17:12:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1745946741; cv=none; b=TX35dPY7d9JKacb+FDkhRix/ZoSPtodjDtqXi2AnxL+8tVZlsnXczQeTzt1/ibYZF1kRCmV3AnsQlgHCdPY3F1pFlVOx1/VZyLq6xmWpeMP6fU5xd8dtXImB0OMl/ECqNlBVYnLNoRapre1u2wWrf1NULcpot4YHfAH1t+YWILE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1745946741; c=relaxed/simple; bh=SBF7hn0A0wZt2E8BraJuUDXN6kbubeEsFEreQmAgKmU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=e/gBro4A6vnWwo8A9NMLDrfLQb/QVLv8ZCXvlHgxME1D85C75w/0i5x46n3RZbvE+OnYZUyMz7l7CBpRA/ZUbUlUzn+nvbPzyV4SwempzkNzCApC8lYjThKIkfuvIm2CDONMcnI8rBQ3yL3qn7OQXYYotp7NyNL+KlZ4NN14ezQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Tj9GfbeB; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="Tj9GfbeB" Received: by smtp.kernel.org (Postfix) with ESMTPSA id AB85BC4CEE9; Tue, 29 Apr 2025 17:12:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1745946741; bh=SBF7hn0A0wZt2E8BraJuUDXN6kbubeEsFEreQmAgKmU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Tj9GfbeBJkKXfO9x2elnhuCRn4uB+vSW1rYze29FGI30ToPjPT/5szpwh19NSPSyH PqoF28CySDdvL+FRWp0wL435/pcrb5gF4GApjb2zjeJL9iQWGU4P+lziLCs3Ap3f12 yjr3hDS1YbEV9CMSGV7bufMo54Cco14M+E2mGZQg= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Bryan ODonoghue , Vikash Garodia , Hans Verkuil Subject: [PATCH 5.10 054/286] media: venus: hfi: add a check to handle OOB in sfr region Date: Tue, 29 Apr 2025 18:39:18 +0200 Message-ID: <20250429161110.073846262@linuxfoundation.org> X-Mailer: git-send-email 2.49.0 In-Reply-To: <20250429161107.848008295@linuxfoundation.org> References: <20250429161107.848008295@linuxfoundation.org> User-Agent: quilt/0.68 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 5.10-stable review patch. If anyone has any objections, please let me know. ------------------ From: Vikash Garodia commit f4b211714bcc70effa60c34d9fa613d182e3ef1e upstream. sfr->buf_size is in shared memory and can be modified by malicious user. OOB write is possible when the size is made higher than actual sfr data buffer. Cap the size to allocated size for such cases. Cc: stable@vger.kernel.org Fixes: d96d3f30c0f2 ("[media] media: venus: hfi: add Venus HFI files") Reviewed-by: Bryan O'Donoghue Signed-off-by: Vikash Garodia Signed-off-by: Hans Verkuil Signed-off-by: Greg Kroah-Hartman --- drivers/media/platform/qcom/venus/hfi_venus.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) --- a/drivers/media/platform/qcom/venus/hfi_venus.c +++ b/drivers/media/platform/qcom/venus/hfi_venus.c @@ -978,18 +978,26 @@ static void venus_sfr_print(struct venus { struct device *dev = hdev->core->dev; struct hfi_sfr *sfr = hdev->sfr.kva; + u32 size; void *p; if (!sfr) return; - p = memchr(sfr->data, '\0', sfr->buf_size); + size = sfr->buf_size; + if (!size) + return; + + if (size > ALIGNED_SFR_SIZE) + size = ALIGNED_SFR_SIZE; + + p = memchr(sfr->data, '\0', size); /* * SFR isn't guaranteed to be NULL terminated since SYS_ERROR indicates * that Venus is in the process of crashing. */ if (!p) - sfr->data[sfr->buf_size - 1] = '\0'; + sfr->data[size - 1] = '\0'; dev_err_ratelimited(dev, "SFR message from FW: %s\n", sfr->data); }