Commit 1e663b47 authored by Cristian Marussi's avatar Cristian Marussi Committed by g30012805
Browse files

firmware: arm_scmi: Harden accesses to the reset domains 

mainline inclusion
from mainline-v6.0-rc7
commit e9076ffb
category: bugfix
bugzilla: 189860
CVE: CVE-2022-48655

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e9076ffbcaed5da6c182b144ef9f6e24554af268

--------------------------------

Accessing reset domains descriptors by the index upon the SCMI drivers
requests through the SCMI reset operations interface can potentially
lead to out-of-bound violations if the SCMI driver misbehave.

Add an internal consistency check before any such domains descriptors
accesses.

Link: https://lore.kernel.org/r/20220817172731.1185305-5-cristian.marussi@arm.com


Signed-off-by: default avatarCristian Marussi <cristian.marussi@arm.com>
Signed-off-by: default avatarSudeep Holla <sudeep.holla@arm.com>
Conflicts:
        drivers/firmware/arm_scmi/reset.c
[This is a conflict caused by commit 7e029344("firmware: arm_scmi:
Port reset protocol to new protocols interface") which is not merged.]
Signed-off-by: default avatarCheng Yu <serein.chengyu@huawei.com>
parent 93f42c5d

drivers/firmware/arm_scmi/reset.c

+5 −1
Original line number Diff line number Diff line
@@ -149,8 +149,12 @@ static int scmi_domain_reset(const struct scmi_handle *handle, u32 domain, 
	struct scmi_xfer *t;

	struct scmi_msg_reset_domain_reset *dom;

	struct scmi_reset_info *pi = handle->reset_priv;

	struct reset_dom_info *rdom = pi->dom_info + domain;

	struct reset_dom_info *rdom;



	if (domain >= pi->num_domains)

		return -EINVAL;



	rdom = pi->dom_info + domain;

	if (rdom->async_reset)

		flags |= ASYNCHRONOUS_RESET;