2021-01-07 23:33:35

by Bjorn Andersson

Subject: [PATCH] soc: qcom: mdt_loader: Validate that p_filesz < p_memsz

The code validates that segments of p_memsz bytes of a segment will fit
in the provided memory region, but does not validate that p_filesz bytes
will, which means that an incorrectly crafted ELF header might write
beyond the provided memory region.

Fixes: 051fb70fd4ea ("remoteproc: qcom: Driver for the self-authenticating Hexagon v5")
Signed-off-by: Bjorn Andersson <[email protected]>
---
drivers/soc/qcom/mdt_loader.c | 8 ++++++++
1 file changed, 8 insertions(+)

diff --git a/drivers/soc/qcom/mdt_loader.c b/drivers/soc/qcom/mdt_loader.c
index e01d18e9ad2b..5180b5996830 100644
--- a/drivers/soc/qcom/mdt_loader.c
+++ b/drivers/soc/qcom/mdt_loader.c
@@ -230,6 +230,14 @@ static int __qcom_mdt_load(struct device *dev, const struct firmware *fw,
break;
}

+ if (phdr->p_filesz > phdr->p_memsz) {
+ dev_err(dev,
+ "refusing to load segment %d with p_filesz > p_memsz\n",
+ i);
+ ret = -EINVAL;
+ break;
+ }
+
ptr = mem_region + offset;

if (phdr->p_filesz && phdr->p_offset < fw->size) {
--
2.29.2

2021-04-08 11:21:45

by Sibi Sankar

Subject: Re: [PATCH] soc: qcom: mdt_loader: Validate that p_filesz < p_memsz

Hey Bjorn,
Thanks for the patch!

On 1/8/21 5:01 AM, Bjorn Andersson wrote:
> The code validates that segments of p_memsz bytes of a segment will fit
> in the provided memory region, but does not validate that p_filesz bytes
> will, which means that an incorrectly crafted ELF header might write
> beyond the provided memory region.
>
> Fixes: 051fb70fd4ea ("remoteproc: qcom: Driver for the self-authenticating Hexagon v5")
> Signed-off-by: Bjorn Andersson <[email protected]>
> ---
> drivers/soc/qcom/mdt_loader.c | 8 ++++++++
> 1 file changed, 8 insertions(+)
>
> diff --git a/drivers/soc/qcom/mdt_loader.c b/drivers/soc/qcom/mdt_loader.c
> index e01d18e9ad2b..5180b5996830 100644
> --- a/drivers/soc/qcom/mdt_loader.c
> +++ b/drivers/soc/qcom/mdt_loader.c
> @@ -230,6 +230,14 @@ static int __qcom_mdt_load(struct device *dev, const struct firmware *fw,
> break;
> }
>
> + if (phdr->p_filesz > phdr->p_memsz) {
> + dev_err(dev,
> + "refusing to load segment %d with p_filesz > p_memsz\n",
> + i);
> + ret = -EINVAL;
> + break;
> + }
> +

Reviewed-by: Sibi Sankar <[email protected]>

> ptr = mem_region + offset;
>
> if (phdr->p_filesz && phdr->p_offset < fw->size) {
>

--
Qualcomm Innovation Center, Inc.
Qualcomm Innovation Center, Inc, is a member of Code Aurora Forum,
a Linux Foundation Collaborative Project