From nobody Sat Jul 25 02:43:52 2026 Received: from mail-wm1-f41.google.com (mail-wm1-f41.google.com [209.85.128.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DC3E936DA1F for ; Mon, 20 Jul 2026 11:32:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.41 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784547145; cv=none; b=GNsC4gTmsUke7DeT5SV/vBisC8qDQNnrgLX8bQWqlUwwYeFWCgTCjDf10wfcf016cT7L6MP7E/W6xdEQ7Dg5jJMIOIWqagrhzyYVxj4IpqKBL2rP64kRh0hK9Uq631K0SlNPSJ8pkgRZdWeUKMn80bZSEfa3C1WKBHivN5inMdI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784547145; c=relaxed/simple; bh=q17hzmGJa7asagj01Wj+Lil19t6BY3cAjNvlDBdL+sk=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=F8oaSK4cJU1ZYh4Ahqy72WeOOichkCJzIguh4Dr3SjOpfk/j7heP13VKudkY7bDq6oN02BKDAMv2hJI3bU0dZxF8RWF07Ui/qKpx/bpOeFwi6Cs9EZWeaw8XVkEaQwMa0aNgTexTtXoZr9FiUEGTIONrQdn2kt9yoccY4a2O3kY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Hx6ip7s3; arc=none smtp.client-ip=209.85.128.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Hx6ip7s3" Received: by mail-wm1-f41.google.com with SMTP id 5b1f17b1804b1-4953e04ef16so42038135e9.2 for ; Mon, 20 Jul 2026 04:32:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784547142; x=1785151942; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=dqbsg26ABj7eOdNonxG5QwFjKanK0ihJjv+Ud/fidP8=; b=Hx6ip7s3K686fHfzH/mNZlYpMSDXLIgR6o6oQVqJK/fROikuX1/j7tP/4lMYf5avVM JYcEc/wqp2t0RqJULDaf7jpeRS8IhcqIDAg6O+S8WJH5mK9RVQtk7Sl6/9vdit9eFHb4 jifF7vLNuAA06PjN6vIX2x+Hm1mG1SVW/IXndB8eJUwDuzby4qQ5i0CjQR+c6OxDujD+ 3xUfiy814Pt8yIGAy93eZm0lQhFZDHIFvrgQYnCDsj3mD6w5OA7kwM4jccAounceHX8I WDBrHa5ueQ4eCvozJMztLyWSjSJmDFM6U/i4Jc0SsEJnMnPABWmdzZGC30Q3L9uoOQHr K0kg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784547142; x=1785151942; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=dqbsg26ABj7eOdNonxG5QwFjKanK0ihJjv+Ud/fidP8=; b=XuekeXwA9xCaBnqTs3mwpqSKrx08H3dJgtxPiIThuwQm0Q4JXl/WzFh9WKB3JmIR+o LD67NnYXLg7xx9X94jhaT7ciraeMqkcuKVP9aAUirtemxTikkZdPsOC+ENZ4iULAs9IB rn1wv8T8tKvRizauRltjoLQvcCXbBwXab9YNhFu45JduXNxV7uYpSevl8kK1nFmVQqyH vWrigwouKN118GI61XC31XDWwpk85a9A4d69q+n5zxPzE35G62tuas3qxMS+/Q5/UtR1 8ZE8VkGsVrb+P4FZ/5cmRMFDod0wLeLIXlJcP66AGU0VPWzcuohg87P5iY6e+Y+N4SX9 wV5w== X-Forwarded-Encrypted: i=1; AHgh+Ro43N7hY/pic+RCvw7sCEA9/0BNzxJMm0aC5HIHbzhOPtVn38HfE3LfFoq+9MjYregMSgHx6tsMgXA5EB4=@vger.kernel.org X-Gm-Message-State: AOJu0Yyt6iTX7R9lU4Y3cIeXd4jwNVqE7/yB31bTaOgTBzJU17RNE4s/ nfWfocRFmAmq+r9hcIbGS7PPJcPIj0nOIoFV6lFtE4PE/+G05iUds0t30vshOA== X-Gm-Gg: AfdE7clHViQYjCEjmb4JpNetF8I1KMYl0QnfI65ne052PXhI8MKrAUHjbWixLO/gda/ fAQ6npxzfBkGytROgh2ZDBoXGf9QnTr4yA13nDU5fQ5o+NQ1aZBGrpCWSzfKB5klXuPyWea1WLx 0OOzikKUcVjM3rB15dWnIuepzdJpGeLzw11oRId7izgrpUQ6E+6OvVZE40tPJgP1618jjrMk95C +N8PhMK8ufJnWtkzxcfKo9uqBWzfEb8axr5awsQRC6goB2Htzj13eWhvcwfiT/QUNE1rP6kCxej n0/hWote5e89WLDBribrtXJyM+XGwPC9aEl10QuBs5Uf3z/BFpX2JJYJ8k43APiDy2yLi7V7+YK aa8yPsP9JSfz10LrRZcgV6lDZNgRqX0uk7B0x0AdbB382DvKp8b7t8u6mjZnam2FYrzHTYyClMs H0nfDSWX8fXGywwzvKp46oh4TC8r/3a39YVrDxCQ== X-Received: by 2002:a05:600c:630e:b0:495:4856:2659 with SMTP id 5b1f17b1804b1-4954a3db6b0mr153568145e9.9.1784547141812; Mon, 20 Jul 2026 04:32:21 -0700 (PDT) Received: from osama.. ([2a02:908:185:7e40:a26b:a888:7408:fac]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-47f6980582csm21957014f8f.13.2026.07.20.04.32.21 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 20 Jul 2026 04:32:21 -0700 (PDT) From: Osama Abdelkader To: Boris Brezillon , Steven Price , Liviu Dudau , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Heiko Stuebner , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org Cc: Osama Abdelkader , stable@vger.kernel.org Subject: [PATCH] drm/panthor: harden firmware build-info bounds checks Date: Mon, 20 Jul 2026 13:32:11 +0200 Message-ID: <20260720113212.11981-1-osama.abdelkader@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" panthor_fw_read_build_info() checks whether the metadata range fits in the firmware image with hdr.meta_start + hdr.meta_size. Both fields are u32, so the addition can wrap and let an out-of-bounds range pass validation. The function also reads the "git_sha: " prefix without first checking that the metadata is long enough, and meta_size =3D=3D 0 can underflow the NULL terminator index. Use subtraction-based bounds checking and reject metadata that is too short to contain the expected prefix and trailing NULL byte. Fixes: 2718d91816ee ("drm/panthor: Add the FW logical block") Cc: stable@vger.kernel.org Signed-off-by: Osama Abdelkader --- drivers/gpu/drm/panthor/panthor_fw.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/panthor/panthor_fw.c b/drivers/gpu/drm/panthor= /panthor_fw.c index 6335893d3f16..9d0e1fafdce2 100644 --- a/drivers/gpu/drm/panthor/panthor_fw.c +++ b/drivers/gpu/drm/panthor/panthor_fw.c @@ -709,7 +709,8 @@ static int panthor_fw_read_build_info(struct panthor_de= vice *ptdev, return ret; =20 if (hdr.meta_start > fw->size || - hdr.meta_start + hdr.meta_size > fw->size) { + hdr.meta_size > fw->size - hdr.meta_start || + hdr.meta_size <=3D header_len) { drm_err(&ptdev->base, "Firmware build info corrupt\n"); /* We don't need the build info, so continue */ return 0; --=20 2.43.0