Commit 3d2ee789 authored by Bjorn Andersson's avatar Bjorn Andersson
Browse files

remoteproc: qcom_q6v5_mss: Validate p_filesz in ELF loader 



Analog to the issue in the common mdt_loader code the MSS ELF loader
does not validate that p_filesz bytes will fit in the memory region and
that the loaded segments are not truncated. Fix this in the same way
as proposed for the mdt_loader.

Reviewed-by: default avatarMathieu Poirier <mathieu.poirier@linaro.org>
Fixes: 135b9e8d ("remoteproc: qcom_q6v5_mss: Validate modem blob firmware size before load")
Link: https://lore.kernel.org/r/20210312232002.3466791-1-bjorn.andersson@linaro.org


Signed-off-by: default avatarBjorn Andersson <bjorn.andersson@linaro.org>
parent 9af2a2a9

drivers/remoteproc/qcom_q6v5_mss.c

+18 −0
Original line number Diff line number Diff line
@@ -1210,6 +1210,14 @@ static int q6v5_mpss_load(struct q6v5 *qproc) 
			goto release_firmware;

		}



		if (phdr->p_filesz > phdr->p_memsz) {

			dev_err(qproc->dev,

				"refusing to load segment %d with p_filesz > p_memsz\n",

				i);

			ret = -EINVAL;

			goto release_firmware;

		}



		ptr = memremap(qproc->mpss_phys + offset, phdr->p_memsz, MEMREMAP_WC);

		if (!ptr) {

			dev_err(qproc->dev,
@@ -1241,6 +1249,16 @@ static int q6v5_mpss_load(struct q6v5 *qproc) 
				goto release_firmware;

			}



			if (seg_fw->size != phdr->p_filesz) {

				dev_err(qproc->dev,

					"failed to load segment %d from truncated file %s\n",

					i, fw_name);

				ret = -EINVAL;

				release_firmware(seg_fw);

				memunmap(ptr);

				goto release_firmware;

			}



			release_firmware(seg_fw);

		}