Received: by 2002:a05:7412:3b8b:b0:fc:a2b0:25d7 with SMTP id nd11csp726282rdb; Thu, 8 Feb 2024 21:46:16 -0800 (PST) X-Forwarded-Encrypted: i=3; AJvYcCUw5Vs5jMqpfIFlQhrNPKdA9pA9V+wAkgnWdz6OD4EFBX864VhsutuumCLFx5WE6qpPKwa+GG13Lr9sRMqN8dUUPu3q+cx80ZQZg11FtA== X-Google-Smtp-Source: AGHT+IGlHHaxEcgnmAh2ivK9p+mmDGxhyHbfl/NDbn+DLfGErZ0ipUf4esCkPCvGlIvOrI2ZlGux X-Received: by 2002:a17:906:2c59:b0:a38:4634:b922 with SMTP id f25-20020a1709062c5900b00a384634b922mr4943ejh.34.1707457576635; Thu, 08 Feb 2024 21:46:16 -0800 (PST) ARC-Seal: i=2; a=rsa-sha256; t=1707457576; cv=pass; d=google.com; s=arc-20160816; b=VmC0Uz+5iY/lFpNig2clltOi0oXeIOUP5XniKEMEEVO8uTQvKWeN1MAPqQWuD5+fmB k+fIbOgYdLiM9OYFiA7yUvgZK/Q2N+3YC9i7ctbNl8LVs6EFiv3Cp7mW54dkBu1M5iXR h2S4BYgqM+kpB2pcZa/DVNiOEU/olQGq8XL4gtCkx8T+Rj3zy78FEU0U3ojLcX7H/PEM xcbLaSX4Ohuq4DXTMbiYQFiziaUpAbpYREjI/jz2i3jVVghz6FyAz3sigUiOzjJZY1ok zqu5bjd5GoXB2IMebj6ZKUgoSOgFNDaxQF9+r4mHLUMDRJwh4HX6Z2qR8cw9m9CeccG6 HvRw== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:list-unsubscribe :list-subscribe:list-id:precedence:date:message-id:dkim-signature; bh=RmHl5Ylvj5X+p+kpgbitx3Q3WlejEr4zXeM7PwNWL0Y=; fh=ycD0fnoHCoc3oBz4S2oeSUDRWTlF7av+h+ll3Eh8y6Y=; b=FshAlT8mwh/5HqdsdFRsK3t5FOn71HMGXPGfuW2PegkeZwDo3BQyqGtwSrtnUFUdAL dmjtJ/iVQtiO1zUuM4TFOsx6Bp6YbLMBpoeTbVwuotxbcT/WTDODvSnCPsH7pc+Pg1FX Sx+TgkZmjN0wgwycYA/YOE+3U/9b5RMHlOJzT8cxSz9p547Q5hjdRVIk6D7MQ+tfMHk/ Q86yIYJ2pEDsW7XLJrEYBkqa7LLyPNUONm22uc2yHyW8IrmgEgJfNi2D2JTzYTLwXERV rVmubmI+kCbJpFOuJUXeV9FobPAPkSEDZgYhv4y98yBFq/skdDtblssQu0MGwiRPEAzW 7IdA==; dara=google.com ARC-Authentication-Results: i=2; mx.google.com; dkim=pass header.i=@quicinc.com header.s=qcppdkim1 header.b=S1+O7agG; arc=pass (i=1 spf=pass spfdomain=quicinc.com dkim=pass dkdomain=quicinc.com dmarc=pass fromdomain=quicinc.com); spf=pass (google.com: domain of linux-kernel+bounces-59023-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) smtp.mailfrom="linux-kernel+bounces-59023-linux.lists.archive=gmail.com@vger.kernel.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=quicinc.com X-Forwarded-Encrypted: i=2; AJvYcCX3tneBTe7n42+CDjQLow1DdDoxB/6Ofc777zmsOxF93DQQJJVNZT9MGvW5oSsiyDd6Q3s3wHoFekFdN4PxkcL+2VI3SGNNWJwjEF2C8Q== Return-Path: Received: from am.mirrors.kernel.org (am.mirrors.kernel.org. [2604:1380:4601:e00::3]) by mx.google.com with ESMTPS id g5-20020a1709063b0500b00a394e84ddcfsi471537ejf.160.2024.02.08.21.46.16 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 08 Feb 2024 21:46:16 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel+bounces-59023-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) client-ip=2604:1380:4601:e00::3; Authentication-Results: mx.google.com; dkim=pass header.i=@quicinc.com header.s=qcppdkim1 header.b=S1+O7agG; arc=pass (i=1 spf=pass spfdomain=quicinc.com dkim=pass dkdomain=quicinc.com dmarc=pass fromdomain=quicinc.com); spf=pass (google.com: domain of linux-kernel+bounces-59023-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) smtp.mailfrom="linux-kernel+bounces-59023-linux.lists.archive=gmail.com@vger.kernel.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=quicinc.com Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by am.mirrors.kernel.org (Postfix) with ESMTPS id DE9F31F26C1B for ; Fri, 9 Feb 2024 05:46:12 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 29DB556B91; Fri, 9 Feb 2024 05:46:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=quicinc.com header.i=@quicinc.com header.b="S1+O7agG" Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B5E6F56B63; Fri, 9 Feb 2024 05:46:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.168.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1707457562; cv=none; b=cfrEGcEtTcmRBrzqFXHLrcvDx4iKLUhuFo64COZYuV5aBwJXmauyNLPnODrq2EiroccppgbI/ABro/4RQtxdpnFDPnWZBkSZcc7+xI6YgWnHGWPs30538Tg/hy9gzETEaeP9/ou5Es1NvYPtWYc8L+1XvK5YkRnCeug0w4oeULg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1707457562; c=relaxed/simple; bh=ytZogGHJ89xBKc3Tv9qyqwQ+gu5ReSiLlM0x399+j9w=; h=Message-ID:Date:MIME-Version:Subject:To:CC:References:From: In-Reply-To:Content-Type; b=mokIdE68HR/X+mXHIScRDA+ZPdVADG3dnH5/yPxbjuja27GkIG2zHTHfTtKMRgLKgv94V2hMfISD4pH9TpnkcsLPhnxA8SzcjArCQXhzyAu6YSP3hhLcMvrIoc32957gN3QaXK0pUG9ARUVCqiXRuLrwpNU1IF80x2iHpSm9ysU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=quicinc.com; spf=pass smtp.mailfrom=quicinc.com; dkim=pass (2048-bit key) header.d=quicinc.com header.i=@quicinc.com header.b=S1+O7agG; arc=none smtp.client-ip=205.220.168.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=quicinc.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=quicinc.com Received: from pps.filterd (m0279867.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.17.1.24/8.17.1.24) with ESMTP id 4195jvOb005382; Fri, 9 Feb 2024 05:45:57 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=quicinc.com; h= message-id:date:mime-version:subject:to:cc:references:from :in-reply-to:content-type:content-transfer-encoding; s= qcppdkim1; bh=RmHl5Ylvj5X+p+kpgbitx3Q3WlejEr4zXeM7PwNWL0Y=; b=S1 +O7agG/1LOCdOYnpy9coEMEvovEftFxj/8+dQvu8wlXPkUHPrqc4D2z8swhTO9ou TyqqHOffKjwovwctrSWyBNJ73K423opqWAc9zGMXbGfxKHesuB9kF+yj8zwP3xtD Ovj7BiAiLYUOv8wuiE/4bw+6uV6tIoOKHRS5k7dHa6QHl8SbxHuDc+NjqJ1GjkiM tcSqgSc+aFpyzkhhwTgUz2httDZg8klbfToBt8K00s80f0FZ4iSSb9mUkCQ47T8v r00sWrXs6IoQ8A4suA3XlDAi4qDmrCE/03bfsnaU/lWZiNp4QRCQz3KHfNAd2kmW USd9MQbmfG8Fni1izxTw== Received: from nalasppmta02.qualcomm.com (Global_NAT1.qualcomm.com [129.46.96.20]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 3w4sudjv57-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 09 Feb 2024 05:45:56 +0000 (GMT) Received: from nalasex01b.na.qualcomm.com (nalasex01b.na.qualcomm.com [10.47.209.197]) by NALASPPMTA02.qualcomm.com (8.17.1.5/8.17.1.5) with ESMTPS id 4195juwc011843 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 9 Feb 2024 05:45:56 GMT Received: from [10.214.18.146] (10.80.80.8) by nalasex01b.na.qualcomm.com (10.47.209.197) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1118.40; Thu, 8 Feb 2024 21:45:53 -0800 Message-ID: <1c91c653-cebe-4407-bdd6-cfc73b64c0fb@quicinc.com> Date: Fri, 9 Feb 2024 11:15:50 +0530 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v3] soc: qcom: mdt_loader: Add Upperbounds check for program header access To: Mukesh Ojha , , CC: , , References: <20240208123527.19725-1-quic_audityab@quicinc.com> Content-Language: en-US From: Auditya Bhattaram In-Reply-To: Content-Type: text/plain; charset="UTF-8"; format=flowed Content-Transfer-Encoding: 8bit X-ClientProxiedBy: nasanex01a.na.qualcomm.com (10.52.223.231) To nalasex01b.na.qualcomm.com (10.47.209.197) X-QCInternal: smtphost X-Proofpoint-Virus-Version: vendor=nai engine=6200 definitions=5800 signatures=585085 X-Proofpoint-GUID: wAUIgYonGwOsUz7OjLk2-WRiyUItKySa X-Proofpoint-ORIG-GUID: wAUIgYonGwOsUz7OjLk2-WRiyUItKySa X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.272,Aquarius:18.0.1011,Hydra:6.0.619,FMLib:17.11.176.26 definitions=2024-02-09_03,2024-02-08_01,2023-05-22_02 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 lowpriorityscore=0 spamscore=0 mlxscore=0 bulkscore=0 phishscore=0 mlxlogscore=999 clxscore=1015 priorityscore=1501 adultscore=0 malwarescore=0 impostorscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.19.0-2401310000 definitions=main-2402090039 On 2/8/2024 7:59 PM, Mukesh Ojha wrote: > > > On 2/8/2024 6:05 PM, Auditya Bhattaram wrote: >> hash_index is evaluated by looping phdrs till QCOM_MDT_TYPE_HASH >> is found. Add an upperbound check to phdrs to access within elf size. >> >> Fixes: 64fb5eb87d58 ("soc: qcom: mdt_loader: Allow hash to reside in >> any segment") >> Cc: >> Signed-off-by: Auditya Bhattaram >> --- >> Changes in v3: >>   - Corrected wrong patch versioning in the Subject. >>   - Added error prints for Invalid access. >> Link to v2 >> https://lore.kernel.org/linux-arm-msm/9773d189-c896-d5c5-804c-e086c24987b4@quicinc.com/T/#t >> Link to v1 >> https://lore.kernel.org/linux-arm-msm/5d7a3b97-d840-4863-91a0-32c1d8e7532f@linaro.org/T/#t >> --- >>   drivers/soc/qcom/mdt_loader.c | 5 +++++ >>   1 file changed, 5 insertions(+) >> >> diff --git a/drivers/soc/qcom/mdt_loader.c >> b/drivers/soc/qcom/mdt_loader.c >> index 6f177e46fa0f..61e2377cc5c3 100644 >> --- a/drivers/soc/qcom/mdt_loader.c >> +++ b/drivers/soc/qcom/mdt_loader.c >> @@ -145,6 +145,11 @@ void *qcom_mdt_read_metadata(const struct >> firmware *fw, size_t *data_len, >>       if (phdrs[0].p_type == PT_LOAD) >>           return ERR_PTR(-EINVAL); >> >> +    if (((size_t)(phdrs + ehdr->e_phnum)) > ((size_t)ehdr + fw->size)) { > > This change is valid only if somehow, ehdr->e_phnum gets corrupted or > changed via some engineering means and results in out-of-bounds access. > > Acked-by: Mukesh Ojha > >> +        dev_err(dev, "Invalid phdrs access: %s\n", fw_name); > > Should it print ehdr->e_phnum as well to be more valid? > > -Mukesh > Sure, planning to add fw->size as well. dev_err(dev, "Invalid phdrs access for fw: %s, e_phnum: %hu, fw->size: %zu \n", fw_name, ehdr->e_phnum, fw->size); >> +        return ERR_PTR(-EINVAL); >> +    } >> + >>       for (i = 1; i < ehdr->e_phnum; i++) { >>           if ((phdrs[i].p_flags & QCOM_MDT_TYPE_MASK) == >> QCOM_MDT_TYPE_HASH) { >>               hash_segment = i; >> -- >> 2.17.1 >> >>