diff options
| author | Bjorn Andersson <bjorn.andersson@linaro.org> | 2021-03-13 02:20:02 +0300 |
|---|---|---|
| committer | Bjorn Andersson <bjorn.andersson@linaro.org> | 2021-03-18 15:54:44 +0300 |
| commit | 3d2ee78906af5f08d499d6aa3aa504406fa38106 (patch) | |
| tree | 8d7a2444cb2e09bf7da8b96daf4e2d0251918a79 /drivers/remoteproc | |
| parent | 9af2a2a9c64ee68a5dc8271d54235609191f1cd1 (diff) | |
| download | linux-3d2ee78906af5f08d499d6aa3aa504406fa38106.tar.xz | |
remoteproc: qcom_q6v5_mss: Validate p_filesz in ELF loader
Analog to the issue in the common mdt_loader code the MSS ELF loader
does not validate that p_filesz bytes will fit in the memory region and
that the loaded segments are not truncated. Fix this in the same way
as proposed for the mdt_loader.
Reviewed-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Fixes: 135b9e8d1cd8 ("remoteproc: qcom_q6v5_mss: Validate modem blob firmware size before load")
Link: https://lore.kernel.org/r/20210312232002.3466791-1-bjorn.andersson@linaro.org
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Diffstat (limited to 'drivers/remoteproc')
| -rw-r--r-- | drivers/remoteproc/qcom_q6v5_mss.c | 18 |
1 files changed, 18 insertions, 0 deletions
diff --git a/drivers/remoteproc/qcom_q6v5_mss.c b/drivers/remoteproc/qcom_q6v5_mss.c index 15abfbba78d2..423b31dfa574 100644 --- a/drivers/remoteproc/qcom_q6v5_mss.c +++ b/drivers/remoteproc/qcom_q6v5_mss.c @@ -1210,6 +1210,14 @@ static int q6v5_mpss_load(struct q6v5 *qproc) goto release_firmware; } + if (phdr->p_filesz > phdr->p_memsz) { + dev_err(qproc->dev, + "refusing to load segment %d with p_filesz > p_memsz\n", + i); + ret = -EINVAL; + goto release_firmware; + } + ptr = memremap(qproc->mpss_phys + offset, phdr->p_memsz, MEMREMAP_WC); if (!ptr) { dev_err(qproc->dev, @@ -1241,6 +1249,16 @@ static int q6v5_mpss_load(struct q6v5 *qproc) goto release_firmware; } + if (seg_fw->size != phdr->p_filesz) { + dev_err(qproc->dev, + "failed to load segment %d from truncated file %s\n", + i, fw_name); + ret = -EINVAL; + release_firmware(seg_fw); + memunmap(ptr); + goto release_firmware; + } + release_firmware(seg_fw); } |