From ff9c5a7cd59d14e78e8016010a272189cdfe01e0 Mon Sep 17 00:00:00 2001 From: Mahesh Kallelil Date: Mon, 4 Mar 2024 11:07:37 -0800 Subject: soc/google/cpif: Fix OOB write in rx_pktproc The fore pointer is passed by CP using shared memory. Without an OOB check for this, we risk an OOB access if the CP firmware gets compromised. Bug: 321941700 Change-Id: I744d58fc54bfa5ac75575ba0921e269766d8a1c7 Signed-off-by: Mahesh Kallelil --- drivers/soc/google/cpif/link_rx_pktproc.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/soc/google/cpif/link_rx_pktproc.c b/drivers/soc/google/cpif/link_rx_pktproc.c index 8768b718b759..db5e736a3667 100644 --- a/drivers/soc/google/cpif/link_rx_pktproc.c +++ b/drivers/soc/google/cpif/link_rx_pktproc.c @@ -414,6 +414,14 @@ static int pktproc_fill_data_addr_without_bm(struct pktproc_queue *q) fore = *q->fore_ptr; #endif + /* The fore pointer is passed by CP from shared memory. Check the + * range to avoid OOB access */ + if ((fore < 0) || (fore >= q->num_desc)) { + mif_err("Invalid fore_ptr (%d) passed by CP on queue(%d)!\n", + fore, q->q_idx); + return -EINVAL; + } + pp_debug("Q%d:%d/%d/%d\n", q->q_idx, fore, *q->rear_ptr, q->done_ptr); -- cgit v1.2.3