drm/panthor: reject firmware sections with oversized data

[PATCH] drm/panthor: reject firmware sections with oversized data

Posted by Osama Abdelkader 1 week, 2 days ago

In panthor_fw_load_section_entry(), the data size to copy is calculated
without validating it against the allocated section_size:

    section->data.size = hdr.data.end - hdr.data.start;

If a crafted firmware sets data.size larger than the allocated memory,
this could cause a heap buffer overflow in panthor_fw_init_section_mem()

    memcpy(section->mem->kmap, section->data.buf, section->data.size);

Additionally, if the section->data.size exceeds the BO size, could this
memset underflow the size calculation, leading to a massive out-of-bounds
zeroing of kernel memory?

    memset(section->mem->kmap + section->data.size, 0,
           panthor_kernel_bo_size(section->mem) - section->data.size);

Reject section entries whose initial data is larger than the section size.

Fixes: 2718d91816ee ("drm/panthor: Add the FW logical block")
Cc: stable@vger.kernel.org
Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com>
---
 drivers/gpu/drm/panthor/panthor_fw.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/panthor/panthor_fw.c b/drivers/gpu/drm/panthor/panthor_fw.c
index 986151681b24..a338c4f0a7f5 100644
--- a/drivers/gpu/drm/panthor/panthor_fw.c
+++ b/drivers/gpu/drm/panthor/panthor_fw.c
@@ -545,6 +545,7 @@ static int panthor_fw_load_section_entry(struct panthor_device *ptdev,
 	struct panthor_fw_binary_section_entry_hdr hdr;
 	struct panthor_fw_section *section;
 	u32 section_size;
+	u32 data_size;
 	u32 name_len;
 	int ret;
 
@@ -595,6 +596,13 @@ static int panthor_fw_load_section_entry(struct panthor_device *ptdev,
 		return -EINVAL;
 	}
 
+	section_size = hdr.va.end - hdr.va.start;
+	data_size = hdr.data.end - hdr.data.start;
+	if (data_size > section_size) {
+		drm_err(&ptdev->base, "Firmware corrupted, section data exceeds section size\n");
+		return -EINVAL;
+	}
+
 	name_len = iter->size - iter->offset;
 
 	section = drmm_kzalloc(&ptdev->base, sizeof(*section), GFP_KERNEL);
@@ -603,7 +611,7 @@ static int panthor_fw_load_section_entry(struct panthor_device *ptdev,
 
 	list_add_tail(&section->node, &ptdev->fw->sections);
 	section->flags = hdr.flags;
-	section->data.size = hdr.data.end - hdr.data.start;
+	section->data.size = data_size;
 
 	if (section->data.size > 0) {
 		void *data = drmm_kmalloc(&ptdev->base, section->data.size, GFP_KERNEL);
@@ -626,7 +634,6 @@ static int panthor_fw_load_section_entry(struct panthor_device *ptdev,
 		section->name = name;
 	}
 
-	section_size = hdr.va.end - hdr.va.start;
 	if (section_size) {
 		u32 cache_mode = hdr.flags & CSF_FW_BINARY_IFACE_ENTRY_CACHE_MODE_MASK;
 		struct panthor_gem_object *bo;
-- 
2.43.0

Re: [PATCH] drm/panthor: reject firmware sections with oversized data

Posted by Steven Price 23 hours ago

On 16/07/2026 15:39, Osama Abdelkader wrote:
> In panthor_fw_load_section_entry(), the data size to copy is calculated
> without validating it against the allocated section_size:
> 
>     section->data.size = hdr.data.end - hdr.data.start;
> 
> If a crafted firmware sets data.size larger than the allocated memory,
> this could cause a heap buffer overflow in panthor_fw_init_section_mem()
> 
>     memcpy(section->mem->kmap, section->data.buf, section->data.size);
> 
> Additionally, if the section->data.size exceeds the BO size, could this
> memset underflow the size calculation, leading to a massive out-of-bounds
> zeroing of kernel memory?
> 
>     memset(section->mem->kmap + section->data.size, 0,
>            panthor_kernel_bo_size(section->mem) - section->data.size);
> 
> Reject section entries whose initial data is larger than the section size.
> 
> Fixes: 2718d91816ee ("drm/panthor: Add the FW logical block")
> Cc: stable@vger.kernel.org
> Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com>

Reviewed-by: Steven Price <steven.price@arm.com>

I'll apply this to drm-misc-fixes.

Thanks,
Steve

> ---
>  drivers/gpu/drm/panthor/panthor_fw.c | 11 +++++++++--
>  1 file changed, 9 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/gpu/drm/panthor/panthor_fw.c b/drivers/gpu/drm/panthor/panthor_fw.c
> index 986151681b24..a338c4f0a7f5 100644
> --- a/drivers/gpu/drm/panthor/panthor_fw.c
> +++ b/drivers/gpu/drm/panthor/panthor_fw.c
> @@ -545,6 +545,7 @@ static int panthor_fw_load_section_entry(struct panthor_device *ptdev,
>  	struct panthor_fw_binary_section_entry_hdr hdr;
>  	struct panthor_fw_section *section;
>  	u32 section_size;
> +	u32 data_size;
>  	u32 name_len;
>  	int ret;
>  
> @@ -595,6 +596,13 @@ static int panthor_fw_load_section_entry(struct panthor_device *ptdev,
>  		return -EINVAL;
>  	}
>  
> +	section_size = hdr.va.end - hdr.va.start;
> +	data_size = hdr.data.end - hdr.data.start;
> +	if (data_size > section_size) {
> +		drm_err(&ptdev->base, "Firmware corrupted, section data exceeds section size\n");
> +		return -EINVAL;
> +	}
> +
>  	name_len = iter->size - iter->offset;
>  
>  	section = drmm_kzalloc(&ptdev->base, sizeof(*section), GFP_KERNEL);
> @@ -603,7 +611,7 @@ static int panthor_fw_load_section_entry(struct panthor_device *ptdev,
>  
>  	list_add_tail(&section->node, &ptdev->fw->sections);
>  	section->flags = hdr.flags;
> -	section->data.size = hdr.data.end - hdr.data.start;
> +	section->data.size = data_size;
>  
>  	if (section->data.size > 0) {
>  		void *data = drmm_kmalloc(&ptdev->base, section->data.size, GFP_KERNEL);
> @@ -626,7 +634,6 @@ static int panthor_fw_load_section_entry(struct panthor_device *ptdev,
>  		section->name = name;
>  	}
>  
> -	section_size = hdr.va.end - hdr.va.start;
>  	if (section_size) {
>  		u32 cache_mode = hdr.flags & CSF_FW_BINARY_IFACE_ENTRY_CACHE_MODE_MASK;
>  		struct panthor_gem_object *bo;

Re: [PATCH] drm/panthor: reject firmware sections with oversized data

Posted by Boris Brezillon 1 week, 1 day ago

On Thu, 16 Jul 2026 16:39:38 +0200
Osama Abdelkader <osama.abdelkader@gmail.com> wrote:

> In panthor_fw_load_section_entry(), the data size to copy is calculated
> without validating it against the allocated section_size:
> 
>     section->data.size = hdr.data.end - hdr.data.start;
> 
> If a crafted firmware sets data.size larger than the allocated memory,
> this could cause a heap buffer overflow in panthor_fw_init_section_mem()
> 
>     memcpy(section->mem->kmap, section->data.buf, section->data.size);
> 
> Additionally, if the section->data.size exceeds the BO size, could this
> memset underflow the size calculation, leading to a massive out-of-bounds
> zeroing of kernel memory?
> 
>     memset(section->mem->kmap + section->data.size, 0,
>            panthor_kernel_bo_size(section->mem) - section->data.size);
> 
> Reject section entries whose initial data is larger than the section size.
> 
> Fixes: 2718d91816ee ("drm/panthor: Add the FW logical block")
> Cc: stable@vger.kernel.org
> Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com>

Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>

> ---
>  drivers/gpu/drm/panthor/panthor_fw.c | 11 +++++++++--
>  1 file changed, 9 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/gpu/drm/panthor/panthor_fw.c b/drivers/gpu/drm/panthor/panthor_fw.c
> index 986151681b24..a338c4f0a7f5 100644
> --- a/drivers/gpu/drm/panthor/panthor_fw.c
> +++ b/drivers/gpu/drm/panthor/panthor_fw.c
> @@ -545,6 +545,7 @@ static int panthor_fw_load_section_entry(struct panthor_device *ptdev,
>  	struct panthor_fw_binary_section_entry_hdr hdr;
>  	struct panthor_fw_section *section;
>  	u32 section_size;
> +	u32 data_size;
>  	u32 name_len;
>  	int ret;
>  
> @@ -595,6 +596,13 @@ static int panthor_fw_load_section_entry(struct panthor_device *ptdev,
>  		return -EINVAL;
>  	}
>  
> +	section_size = hdr.va.end - hdr.va.start;
> +	data_size = hdr.data.end - hdr.data.start;
> +	if (data_size > section_size) {
> +		drm_err(&ptdev->base, "Firmware corrupted, section data exceeds section size\n");
> +		return -EINVAL;
> +	}
> +
>  	name_len = iter->size - iter->offset;
>  
>  	section = drmm_kzalloc(&ptdev->base, sizeof(*section), GFP_KERNEL);
> @@ -603,7 +611,7 @@ static int panthor_fw_load_section_entry(struct panthor_device *ptdev,
>  
>  	list_add_tail(&section->node, &ptdev->fw->sections);
>  	section->flags = hdr.flags;
> -	section->data.size = hdr.data.end - hdr.data.start;
> +	section->data.size = data_size;
>  
>  	if (section->data.size > 0) {
>  		void *data = drmm_kmalloc(&ptdev->base, section->data.size, GFP_KERNEL);
> @@ -626,7 +634,6 @@ static int panthor_fw_load_section_entry(struct panthor_device *ptdev,
>  		section->name = name;
>  	}
>  
> -	section_size = hdr.va.end - hdr.va.start;
>  	if (section_size) {
>  		u32 cache_mode = hdr.flags & CSF_FW_BINARY_IFACE_ENTRY_CACHE_MODE_MASK;
>  		struct panthor_gem_object *bo;