mt8183_scp_da_to_va() translates a device address to a pointer into
SCP SRAM or DRAM. Its bounds check is wrong in two ways:
- offset is an int but is assigned from a u64. For the DRAM window,
da = dma_addr + 0x100000010 is truncated to offset 0x10 and passes
the check. There is also no da >= dma_addr check, so a da below
dma_addr wraps in the u64 subtraction and can truncate to a small
positive offset.
- (offset + len) is computed in size_t and wraps for a large len.
With offset = 0x100 and len = (size_t)-0x80, the sum is 0x80 and
the check passes.
da and len come from the firmware's ELF program headers
(p_paddr/p_memsz) via rproc_da_to_va(), and the returned pointer is
then written to by the ELF loader, so a malformed firmware image can
make the loader write outside the intended region.
Use a u64 offset, check da >= dma_addr before subtracting, and
compare len against the remaining window size instead of adding it
to offset.
Fixes: 63c13d61eafe ("remoteproc/mediatek: add SCP support for mt8183")
Cc: [email protected]
Signed-off-by: Atul Akella <[email protected]>
---
drivers/remoteproc/mtk_scp.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/remoteproc/mtk_scp.c b/drivers/remoteproc/mtk_scp.c
index 9751acc2bf83..d18ae676260a 100644
--- a/drivers/remoteproc/mtk_scp.c
+++ b/drivers/remoteproc/mtk_scp.c
@@ -754,17 +754,19 @@ static int scp_start(struct rproc *rproc)
static void *mt8183_scp_da_to_va(struct mtk_scp *scp, u64 da, size_t len)
{
- int offset;
+ u64 offset;
const struct mtk_scp_sizes_data *scp_sizes;
scp_sizes = scp->data->scp_sizes;
if (da < scp->sram_size) {
offset = da;
- if (offset >= 0 && (offset + len) <= scp->sram_size)
+ if (len <= scp->sram_size - offset)
return (void __force *)scp->sram_base + offset;
} else if (scp_sizes->max_dram_size) {
offset = da - scp->dma_addr;
- if (offset >= 0 && (offset + len) <= scp_sizes->max_dram_size)
+ if (da >= scp->dma_addr &&
+ offset <= scp_sizes->max_dram_size &&
+ len <= scp_sizes->max_dram_size - offset)
return scp->cpu_addr + offset;
}
--
2.43.0
