From nobody Sat Jul 25 15:51:37 2026 Received: from mail-wm1-f49.google.com (mail-wm1-f49.google.com [209.85.128.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 93CD243148D for ; Thu, 16 Jul 2026 14:40:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.49 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784212836; cv=none; b=a9wwUDhKgYkQm4uVYdl/PYj0iGb92/7K5pptQSdetfSdiov2aaY6OC67Bn1aTKKPcnLby1Bki/TTy55I3MgZCXi8nVyViF06FdwxbmLxM/J/1fFU2OmriXghVFp2U91/BTaWzz+AYPawjcornHUU73TU7zgUbv6F/DUiYuyVd+c= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784212836; c=relaxed/simple; bh=jTPed7eE035vhQ8rlC8ZfmFszbglDwnM4zRLkO9bRZM=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=GtqkMIHL+n6TSckVSWk0L5PURWMBbymzt66j2G9639ModgDCpUjZySz7skdwBjP+LfinKJy8hwO5FHfFSXB29NWKfDpA+xLAt/YXNeXAErMKNOT/3O2yASkeuqg94ChQNLPEWO5flE+4j3PLPj7VwFJUJZTJn5lWiUa+ZrasihY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=e8g8IaGv; arc=none smtp.client-ip=209.85.128.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="e8g8IaGv" Received: by mail-wm1-f49.google.com with SMTP id 5b1f17b1804b1-493b1710405so37304465e9.2 for ; Thu, 16 Jul 2026 07:40:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784212833; x=1784817633; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=mpcBzLLGhgmpRm2ChWHisnZOSJCjUEDvDGQ4AxFAGiU=; b=e8g8IaGv/+dOx/xAX1D9i0IZ6Zc5MgwrnMDSnhurS1H+g5srub9iSnGtEFeALeoNGX 56T/YAD7mH1ZLD8sxYJlZ9JmPH+TtrC6d4ThTab1+BrRGHQ8pl4frhMByxr+kqrJyx9E jqQanBAE2aqZ2NqrT3ejtwdsaErb54DgBqBm3ctB023OToUfqy4v1n2OOKBmbuSOQGmI 996yiHHFYZpbQWwx6Z8Lpc7cnR43INknYp9zM4uotrAaiG3BwTkubSs+Q8D1/BoqNaGE H3gA07L0vj7K/lYo6JJ80BIiVweueNrey20AY1YkOj5aQHDcHueKSHvvLGCgLsZyIvTL l1vQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784212833; x=1784817633; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=mpcBzLLGhgmpRm2ChWHisnZOSJCjUEDvDGQ4AxFAGiU=; b=oFmgugiXYR9ANFofj5s6evwSzNOoerBiUEr+wcVuvrtu1TvqM3EEpuxxXzfCeHR1LS 6JcbUjn9VzGZPZ3PDry7q753vE1zyw5Y9sOGtFyo7fgnnc5wvPURRTsNpqtUCzRiJMG/ HU4haaNkI0Teu1E6LnybXahwMQiy/uBf092HNQeNBRaG/XRYbMhT9ltdglw9CLHwwKMS Pzy8gzslAqaYgOGDZ3A5kAUsSkQWnWTktHW9cJa+R5e9RmvB1FXsT+P93tcl2OY9jhnz CfndyhWGwz7kSpmiu9Cip3YXA22fefvZsFN81+kWnc1R+/kTXEmjiNdLnZkIT4jKUTH+ aOHw== X-Forwarded-Encrypted: i=1; AHgh+RrvZBdhpxcYStTRFVwFj6jtVn1VmUNVHxTi73EGxmF5QVdHpkSq78/41zNztEz0BzzyhW+c+bqszgjomIU=@vger.kernel.org X-Gm-Message-State: AOJu0YwzlvoK+HlbaqtEIt6UgZliquGrsJbSqs1zkvtEJwOlCr7i3PTu 5Fne6ZpYj7pI3Af1dl7Uib9hjzbA/jBMjqI4BTmBZ2LCU/vcKit+gNk0 X-Gm-Gg: AfdE7ckuSl0eozveU9VJDI+3v7gLAzxNCX/LzRGOXZMSzf4o80nBZT4zG7KYP6X2KjF 9opeod5KSLpygHxl1BQHZ3i7shYeKlDcXtbyYsnWWaSBJPQNt0FJzaA5V5TDqXLvhfX563FMH/a TWaLMOhCh2dYbHl49TKOUcP5BxSrZgG9pn65XPU6t6uOe80iN+LWzHxMeXnBFIF5Oomu3rkGHLc hTlBzfWU1TQH2o/lDqpK/JS4L37Uac3sbSsYVWcXp76phjLi+Um6GA5BG8ofjkcFXTHS8NodDbf BVAr5XDBXqWi06oFJMfPSg+DTW84JTxaLFsPkVX+i6icm9psiZZfTRzozpw2OqJJXo7Z8gZvuJN +6ICMXKog+zpuwgkQHXRWh12ak5gtBUgtIPqrNj1Oxl+Bx+BnTOnyHdD4V5ncikW0XXFqfm7lHZ qLu9YJo0yGVgAXR8uoh4smopd/Pl66pzN+72KW X-Received: by 2002:a05:600d:6443:10b0:493:f762:45d4 with SMTP id 5b1f17b1804b1-495158c693bmr120308635e9.2.1784212832541; Thu, 16 Jul 2026 07:40:32 -0700 (PDT) Received: from osama.. ([2a02:908:185:7e40:8529:198:eaf9:708]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-49541eb7372sm85145815e9.13.2026.07.16.07.40.31 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 16 Jul 2026 07:40:32 -0700 (PDT) From: Osama Abdelkader To: Boris Brezillon , Steven Price , Liviu Dudau , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Heiko Stuebner , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org Cc: Osama Abdelkader , stable@vger.kernel.org Subject: [PATCH] drm/panthor: reject firmware sections with oversized data Date: Thu, 16 Jul 2026 16:39:38 +0200 Message-ID: <20260716143939.21903-1-osama.abdelkader@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" In panthor_fw_load_section_entry(), the data size to copy is calculated without validating it against the allocated section_size: section->data.size =3D hdr.data.end - hdr.data.start; If a crafted firmware sets data.size larger than the allocated memory, this could cause a heap buffer overflow in panthor_fw_init_section_mem() memcpy(section->mem->kmap, section->data.buf, section->data.size); Additionally, if the section->data.size exceeds the BO size, could this memset underflow the size calculation, leading to a massive out-of-bounds zeroing of kernel memory? memset(section->mem->kmap + section->data.size, 0, panthor_kernel_bo_size(section->mem) - section->data.size); Reject section entries whose initial data is larger than the section size. Fixes: 2718d91816ee ("drm/panthor: Add the FW logical block") Cc: stable@vger.kernel.org Signed-off-by: Osama Abdelkader Reviewed-by: Boris Brezillon Reviewed-by: Steven Price --- drivers/gpu/drm/panthor/panthor_fw.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/panthor/panthor_fw.c b/drivers/gpu/drm/panthor= /panthor_fw.c index 986151681b24..a338c4f0a7f5 100644 --- a/drivers/gpu/drm/panthor/panthor_fw.c +++ b/drivers/gpu/drm/panthor/panthor_fw.c @@ -545,6 +545,7 @@ static int panthor_fw_load_section_entry(struct panthor= _device *ptdev, struct panthor_fw_binary_section_entry_hdr hdr; struct panthor_fw_section *section; u32 section_size; + u32 data_size; u32 name_len; int ret; =20 @@ -595,6 +596,13 @@ static int panthor_fw_load_section_entry(struct pantho= r_device *ptdev, return -EINVAL; } =20 + section_size =3D hdr.va.end - hdr.va.start; + data_size =3D hdr.data.end - hdr.data.start; + if (data_size > section_size) { + drm_err(&ptdev->base, "Firmware corrupted, section data exceeds section = size\n"); + return -EINVAL; + } + name_len =3D iter->size - iter->offset; =20 section =3D drmm_kzalloc(&ptdev->base, sizeof(*section), GFP_KERNEL); @@ -603,7 +611,7 @@ static int panthor_fw_load_section_entry(struct panthor= _device *ptdev, =20 list_add_tail(§ion->node, &ptdev->fw->sections); section->flags =3D hdr.flags; - section->data.size =3D hdr.data.end - hdr.data.start; + section->data.size =3D data_size; =20 if (section->data.size > 0) { void *data =3D drmm_kmalloc(&ptdev->base, section->data.size, GFP_KERNEL= ); @@ -626,7 +634,6 @@ static int panthor_fw_load_section_entry(struct panthor= _device *ptdev, section->name =3D name; } =20 - section_size =3D hdr.va.end - hdr.va.start; if (section_size) { u32 cache_mode =3D hdr.flags & CSF_FW_BINARY_IFACE_ENTRY_CACHE_MODE_MASK; struct panthor_gem_object *bo; --=20 2.43.0