mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-27 23:25:13 -04:00
Code Issues Packages Projects Releases Wiki Activity

misc: issei: check bus message length before reading the command

Browse Source 
__issei_ham_process_ham_rsp() dispatches on hdr->cmd before the message
length is validated. The length comes from the firmware-owned DMA header
read in issei_dma_read(), which only bounds it from above, so firmware
sending a short bus message reaches the dispatch with less than
sizeof(struct ham_bus_message) bytes available.

For a zero-length message kmemdup() returns ZERO_SIZE_PTR, which passes
the NULL check in issei_dma_read(), and the dispatch dereferences it. A
length of one to three bytes gives a slab out-of-bounds read instead.

Reject bus messages shorter than the header before touching it, the way
the individual response handlers already validate their own length.

Fixes: 7bd4b9991d ("issei: implement main thread and ham messages")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Link: https://patch.msgid.link/20260731025952.3505287-1-lilinmao@kylinos.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Linmao Li
2026-07-31 10:59:52 +08:00
committed by Greg Kroah-Hartman
parent 9bcb5dbf0d
commit 220190f97d
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/misc/issei/ham.c
View File

@@ -132,6 +132,12 @@ static int __issei_ham_process_ham_rsp(struct issei_device *idev, const u8 *buf,
{
struct ham_bus_message *hdr = (struct ham_bus_message *)buf;
if (length < sizeof(*hdr)) {
dev_err(&idev->dev, "Small bus message size %zu < %zu\n",
length, sizeof(*hdr));
return -EPROTO;
}
switch (hdr->cmd) {
case HAM_BUS_CMD_START_RSP:
return issei_ham_start_rsp(idev, buf, length);