summaryrefslogtreecommitdiff
path: root/drivers/soc/qcom
diff options
context:
space:
mode:
authorBjorn Andersson <bjorn.andersson@linaro.org>2021-01-08 02:31:19 +0300
committerBjorn Andersson <bjorn.andersson@linaro.org>2021-04-08 18:28:55 +0300
commit84168d1b54e76a1bcb5192991adde5176abe02e3 (patch)
tree0df102a1f3f80dbd319b809bd73b7218c13291e1 /drivers/soc/qcom
parent769738fc49bb578e05d404b481a9241d18147d86 (diff)
downloadlinux-84168d1b54e76a1bcb5192991adde5176abe02e3.tar.xz
soc: qcom: mdt_loader: Validate that p_filesz < p_memsz
The code validates that segments of p_memsz bytes of a segment will fit in the provided memory region, but does not validate that p_filesz bytes will, which means that an incorrectly crafted ELF header might write beyond the provided memory region. Fixes: 051fb70fd4ea ("remoteproc: qcom: Driver for the self-authenticating Hexagon v5") Reviewed-by: Sibi Sankar <sibis@codeaurora.org> Link: https://lore.kernel.org/r/20210107233119.717173-1-bjorn.andersson@linaro.org Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Diffstat (limited to 'drivers/soc/qcom')
-rw-r--r--drivers/soc/qcom/mdt_loader.c8
1 files changed, 8 insertions, 0 deletions
diff --git a/drivers/soc/qcom/mdt_loader.c b/drivers/soc/qcom/mdt_loader.c
index 24cd193dec55..2ddaee5ef9cc 100644
--- a/drivers/soc/qcom/mdt_loader.c
+++ b/drivers/soc/qcom/mdt_loader.c
@@ -230,6 +230,14 @@ static int __qcom_mdt_load(struct device *dev, const struct firmware *fw,
break;
}
+ if (phdr->p_filesz > phdr->p_memsz) {
+ dev_err(dev,
+ "refusing to load segment %d with p_filesz > p_memsz\n",
+ i);
+ ret = -EINVAL;
+ break;
+ }
+
ptr = mem_region + offset;
if (phdr->p_filesz && phdr->p_offset < fw->size) {