From nobody Sat Aug 1 21:31:43 2026 Received: from mail-pg1-f177.google.com (mail-pg1-f177.google.com [209.85.215.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 20D1F3403EE for ; Sat, 1 Aug 2026 16:53:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.177 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785603197; cv=none; b=IUM/KN5nkmsMs8PrADowjg9/JkBURT/FOpc2P0n40Sq1oPByNsGMYz+lAJ9mRO1SqW1p98tgSBc+W3KyAukWsac3Is+YFgMtGHb8Cc0e8ONCk9iYhe99HqDjyoV7Tgg4Dbzk/PRKIsD6kqZOCPoWW1Nc5P+v4m46LWHb28lGrsY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785603197; c=relaxed/simple; bh=CP+ohCGhRGTOmeDU3bgc4kikkyEnsFy/EIMt+qIpsDc=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=ctLnhMb3vfJ2OApr3Pe5l/PPilwSGf2DWCQMwBiCmkRNutdbRdx42ptBpNf/tQa4P2Cp22VxXkcjLG8ByjsfAjqSCjrj8ltRVqSnbF33I9fjaqY7+viOyIWMbQkMndj8xr6vf9b/CWW8ZvxzU2WaYc+xdoebSVQWNUV87OEaJYs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=hEBsmkT1; arc=none smtp.client-ip=209.85.215.177 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="hEBsmkT1" Received: by mail-pg1-f177.google.com with SMTP id 41be03b00d2f7-c9e7391839cso1769699a12.0 for ; Sat, 01 Aug 2026 09:53:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785603195; x=1786207995; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=xq2W0X8GPyXmXG3YRrZVrOO3inEF9iPwgMwa2t8gxKc=; b=hEBsmkT1QEh1h7um1l2zkpXxcRWDoqmmSf8SFRrY9Z813QODhQkW0MMlDw34lpkCw7 aESS6fhdlD6vwQ5ZMmPsMQVew7/DoYRjVD8OTlFA19tl2ANmW3P7etdvJQZwIIpe3Ejz Ew0zEGemSf3LefLBMeSV6J3tCiOvJ+d+XY0qVqyeAqXT4ozcZq7aG3L7UZwm/z7GeV6p CqMXCFIGP8V7mrObNelMrsJTjm5lR1KXDm47ATLLc2abpnjqoo7CmywnY6A/t6+f7Q8T Ou5Em/22va7hX8rUs6XYITqrVgTxKJqQj6Ujh5LPvypAXSHJOnwkeqkMyIHg30UIkjs1 Zlwg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785603195; x=1786207995; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=xq2W0X8GPyXmXG3YRrZVrOO3inEF9iPwgMwa2t8gxKc=; b=e41dZzXF7OfA5ZC1c/RPhLLzwHs+06wS34JGAjFAIAp0kizlGCGWi7hV4qVFXozu/C 9kp8/ZhuF3SgVm7FkAivFffgunInZknKE5o8GIUu1/STUHRdIKEJmPfpwI07I6lx9KSF yqoF9pMTFYIJAweAWt5ejkCO7pXRvP0B2OzWNrBnTeMOh3QIk0tKZHHbIHk3yQuRSrV0 ysH51D7okxMJncab/ctmi0MrsOZ9KOwSMMExvSKf6NgEyIzuUg8rU1pOBjGDyjqVnrnC j+rdqQW74RHJ07+IQyLSrUni05hWjzsAM1HNorlc4rGSDaRMVZz9+8uFFAIuOjALd/Xf tqNQ== X-Forwarded-Encrypted: i=1; AHgh+RpE8xs5gp0Oy/cySDDjBAR3yAiAw3iXFdmIFYiuj+Jm3EnoyGhEI+wsGkjhSKZHIHwAqOlQt4kn5chjSNY=@vger.kernel.org X-Gm-Message-State: AOJu0YzlBl3jnW2/sumkmTqRwJUWWl7JVcE+EWHGLYhX6dlJwpYkClvO U7jEWq6U+h/NqPJJeb3Y0+SuGTG7osxX//fL3OhBhqY0GICvXyON+Mipc1J2bg== X-Gm-Gg: AR+sD12VFIVpcOG+IcivwSTVgYH9JzDcXOmPTBLu/yWEFPx+oC7KfmimXHcTxKDApgN qK9rXOxzgFpAVNcmMYovfR6VcFJF/Nt0mO9Kji+LXZT/EUQvhm0tchsWhR9Xrs7to2TJqRo46/D mB4oXEcl8XuEuZqZavnmh+JAgfRSc7AyDlSD0HqV6PC5NBbBcHrI2qJZ+Ej23EEDa0qKQfVLTG1 31Y7FKb6srOSKjX8v0qT34zbyYnp8omLFyZo51FY/QN3Q7TZVAqW03vqyU+YFbhP1y9BETBKQfo wuolFGoJZRr7F2FS2QVjoCgpwY7bcRr4bz0ZPOSNvytKaWigEmYWBCJJn832PpDarw430U2Ma+v Nhc3dCi16/ZY5DPta23dLPrONSl3DhKPguWDNSJ9VC3d47JxFva/a4DgsxloR0xn3Qx9pq61tCn UACGlb4fT2TH0yXD/Jf6jpSM/oyiU5cUynFNySjdX1cYj+nIKqvatc7lWqawzJFxQZytvUB1lWH VTOOu+T2CwBSkRShtV3RWOD3Ljdx+uofsQqAIXvA0HjJtvuoVKel1ZiOzXGW4T8D4c3L+PYxcgu 5VgQGQ3RjX+u+upsue1KigyYjUZQkw== X-Received: by 2002:a05:6a21:6cc4:b0:3c9:e7d:b302 with SMTP id adf61e73a8af0-3c92a8f32c2mr4075343637.59.1785603195442; Sat, 01 Aug 2026 09:53:15 -0700 (PDT) Received: from localhost.localdomain ([2405:acc0:1306:9d5b:7865:f907:f2bf:8664]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3153dd4f0f0sm18124736eec.2.2026.08.01.09.53.13 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Sat, 01 Aug 2026 09:53:15 -0700 (PDT) From: Laxman Acharya Padhya To: Eddie James Cc: Ninad Palsule , linux-fsi@lists.ozlabs.org, linux-kernel@vger.kernel.org Subject: [PATCH] fsi: master-ast-cf: validate firmware image bounds Date: Sat, 1 Aug 2026 22:38:09 +0545 Message-ID: <20260801165309.41495-1-acharyalaxman8848@gmail.com> X-Mailer: git-send-email 2.51.2 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" load_copro_firmware() reads the image signature and size from a fixed offset before checking that the firmware contains the corresponding header. A truncated firmware file can therefore cause an out-of-bounds read. The image size is also used to advance through the blob and to copy the selected image to the coprocessor without checking that it is non-zero, large enough for the header, or contained in the firmware buffer. Validate the header and image range before reading or copying any image. This also prevents a zero image size from making the image scan loop never advance. Signed-off-by: Laxman Acharya Padhya --- drivers/fsi/fsi-master-ast-cf.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/drivers/fsi/fsi-master-ast-cf.c b/drivers/fsi/fsi-master-ast-c= f.c index c3ac76bf7e9..410bd600cd7 100644 --- a/drivers/fsi/fsi-master-ast-cf.c +++ b/drivers/fsi/fsi-master-ast-cf.c @@ -831,6 +831,8 @@ static int load_copro_firmware(struct fsi_master_acf *m= aster) const struct firmware *fw; uint16_t sig =3D 0, wanted_sig; const u8 *data; + const u8 *end; + const size_t image_hdr_size =3D HDR_OFFSET + HDR_FW_SIZE + sizeof(__be32); size_t size =3D 0; int rc; =20 @@ -851,9 +853,23 @@ static int load_copro_firmware(struct fsi_master_acf *= master) dev_dbg(master->dev, "Looking for image sig %04x\n", wanted_sig); =20 /* Try to find it */ - for (data =3D fw->data; data < (fw->data + fw->size);) { + end =3D fw->data + fw->size; + for (data =3D fw->data; data < end;) { + if (end - data < image_hdr_size) { + dev_err(master->dev, "Truncated firmware image header\n"); + rc =3D -EINVAL; + goto release_fw; + } + sig =3D be16_to_cpup((__be16 *)(data + HDR_OFFSET + HDR_SYS_SIG)); size =3D be32_to_cpup((__be32 *)(data + HDR_OFFSET + HDR_FW_SIZE)); + if (size < image_hdr_size || + size > end - data) { + dev_err(master->dev, "Invalid firmware image size %zu\n", size); + rc =3D -EINVAL; + goto release_fw; + } + if (sig =3D=3D wanted_sig) break; data +=3D size; --=20 2.51.2