From nobody Sat Aug 1 21:31:41 2026 Received: from mail-pg1-f175.google.com (mail-pg1-f175.google.com [209.85.215.175]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D4D87337105 for ; Sat, 1 Aug 2026 16:56:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.175 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785603418; cv=none; b=CSi3aZnyVyXFsVwcg3HH1L0JB9v/8xAHmcTlI7YZLiVMCQ+PZMWypgMa0DW7cC0sZOi7S7OllwUv2W6wwrm5kVlwOxL1SntWWIUtqAgKiSXPEzzst80cPDHVryOCHUPSTGZ283sCFPlJ/faEmjF4WfG6Lb+2ZcyWWL2uoPPIpbg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785603418; c=relaxed/simple; bh=55m4GcqtjjIlAZ04VJ0fFzT7ftTDxncElGf5Mjb0gD4=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=pAU9sD0/BCTy5hYxC3VD9yk57pb4eRh8kn23gIhQcektMzUrL2VAv5BUIb45BZ8r1u4ntYLpH/EqEGTpNQRv+bMQDVw8kyResgvBhyGwXxb/xwzr6Nv4PrXFC/pcnQ3lsmlkbJblSt68CNGmDCyU6bfEFOTb/8K9T0omFVEvsQo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=TW1YoL5t; arc=none smtp.client-ip=209.85.215.175 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="TW1YoL5t" Received: by mail-pg1-f175.google.com with SMTP id 41be03b00d2f7-c96c92c0980so1173875a12.3 for ; Sat, 01 Aug 2026 09:56:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785603416; x=1786208216; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=HjMWRfiVIu7TeYsuq/V8tfzJguz72HRc/qV1HUb8BFM=; b=TW1YoL5t1yONifloHnZvPrzVp62bjyifly4bqn6dPezp4PiUwwkvyfVc1PmKQ0Vw/4 Toz7WdBRXEFtT/RJ5ezAVGDlcE0UUMNOs/sxxMiIcUFFoTtAknJJ8pmyXWpLMGuGypn/ BnkYuhISAKfb0xMuP3Ghek+xEBv7vPxuq58vf2G7tGMFijr479AurIcT3+Z1aTXNXcWm WuMRYMx+CIZEIClZKhprer6vM1XvrBvwbV2tzeXL9/ZY59kpFaxx740yRDOeOsiK9nYl l/NCn8Pa6PKLYTUonfRl8j9/vn6+IdxBrw44XWRrGSm8l2A1N+EIiLUgCX7pzRirv+T0 Ejjg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785603416; x=1786208216; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=HjMWRfiVIu7TeYsuq/V8tfzJguz72HRc/qV1HUb8BFM=; b=XIEyNSigX6knBCcneSTGj59LbCx69NWimLLIUNVQ+xgQbVJKLgtGT/xM02qBezcDWG /lK6IqpXIwQwOmXEToZVgU3U6hVOm0X+qr1+RbEdJ3Kv6LSrsd0mjh6UpR8JVQRt0aFR JNUmOMXgM+F+K5ciJLtj7eg8m/3Ug86NscVgkRxUedD5z8yAB7TJ0gXJf2NA74dkexf/ +Hq59p4bSB8sF9OhQH/hZqWGGdwKP+WG/HmeVLp2gKLfG/cP4fHSX5K1aiz4a1T7rI84 Bs/KmLMYCqMATuUfEUvWpul4QGmYG39SKsY7rsfU1cQlL7eNJlmWA8xp9bGg56pWy44E VZDw== X-Forwarded-Encrypted: i=1; AHgh+Rp7Ws5VSmr6wXlhGphQAtQtBB8NV8CmsD6SSaUmjXBopAAarsCr3qewVdy0Pr5lUm78Fi8/ibdC4+FUq3M=@vger.kernel.org X-Gm-Message-State: AOJu0YwlBRrrbaLas9jfsrQmePH8OB6H2BW+4KFjG+oNWE03OwR0+w8w y5J362yg39UwBJyCYcVZ9PO9FQrkPUh6d8qM1Vbj3YhVsqnR9qY3jj1m X-Gm-Gg: AR+sD11HKBzq+LZkF7jFDQUecddAwo679Jz8jGS/oYnRRuL2baRoJZAocwFN4158wbO iah34Nb0cgD07wvJVCjuHzd30OkUKOxXCVx50fgedHQsrwJHC1XNHxjWaIN/kBPqAJBUSZExncm 5IbsB2VCxPFXAYPR2x5B/t54YM2XmwyzuLXvm+qMmFJQT3UwDlcUMxj5DHJSXPGTPmvLKJZsA7S DdTkUQ5Rt5V0YUB3bqwaIoCG7OJcOu0ke4F6mhzZINKK4qQc4pUBmKr9ragdOjAkFFGcO4BTTGI ouGO3zOynxR18+b0IsIG5rhpVTtfN6m3OuMgmEa0A3Uwh18hD2lnqjE4cOBIpmBo1q6K936Fs11 UKm4HMv5R0aZlWsEdK4BD4Xn5XS+TQs4Wf1UNO8ivshUXtBw3ZCcoKfJqaReh9HCcEa+bJuKN0h i2rJwOBWyd0qIoHARLH7zDhPaH2k9y74rgtWkWiCjACxUSB0ff8KBh/RylP3TEm2fTT76u6sYPN rUt6FKPtH6/gwdFH0YgSwgYMBsFTMr2PCfMciGMMLIZrYNWrgoLdDWYolOrf1bPG8JENIPeV6UG Gjqmxla2zCnHU2kVphQ= X-Received: by 2002:a05:6a21:9985:b0:3c1:657:4c95 with SMTP id adf61e73a8af0-3c92a75a3b5mr4272815637.15.1785603415998; Sat, 01 Aug 2026 09:56:55 -0700 (PDT) Received: from localhost.localdomain ([2405:acc0:1306:9d5b:7865:f907:f2bf:8664]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-13fab4cb51asm24110366c88.9.2026.08.01.09.56.53 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Sat, 01 Aug 2026 09:56:55 -0700 (PDT) From: Laxman Acharya Padhya To: Tzung-Bi Shih Cc: Thierry Escande , chrome-platform@lists.linux.dev, linux-kernel@vger.kernel.org Subject: [PATCH] firmware: google: coreboot: validate table bounds Date: Sat, 1 Aug 2026 22:41:51 +0545 Message-ID: <20260801165651.42172-1-acharyalaxman8848@gmail.com> X-Mailer: git-send-email 2.51.2 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The existing coreboot_table_populate() bounds checks limit individual entries to the mapped length. However, coreboot_table_probe() replaces the platform resource length with header and table sizes supplied by firmware before mapping the full table. A malformed table can overflow the 32-bit size addition or advertise an extent beyond the resource, causing the driver to map and parse memory outside the resource. A resource shorter than the fixed header is also mapped as though it contained a complete header. Reject resources shorter than the fixed header. After validating the signature, require a complete header, calculate the advertised extent with overflow checking, and reject extents beyond the resource before remapping the table. Fixes: d384d6f43d1e ("firmware: google memconsole: Add coreboot support") Signed-off-by: Laxman Acharya Padhya diff --git a/drivers/firmware/google/coreboot_table.c b/drivers/firmware/go= ogle/coreboot_table.c index e63933ff6..96e68ae3f 100644 --- a/drivers/firmware/google/coreboot_table.c +++ b/drivers/firmware/google/coreboot_table.c @@ -170,6 +170,7 @@ static int coreboot_table_populate(struct device *dev, = void *ptr, resource_size_ static int coreboot_table_probe(struct platform_device *pdev) { resource_size_t len; + resource_size_t table_span; struct coreboot_table_header *header; struct resource *res; struct device *dev =3D &pdev->dev; @@ -181,7 +182,7 @@ static int coreboot_table_probe(struct platform_device = *pdev) return -EINVAL; =20 len =3D resource_size(res); - if (!res->start || !len) + if (!res->start || len < sizeof(*header)) return -EINVAL; =20 /* Check just the header first to make sure things are sane */ @@ -189,19 +190,27 @@ static int coreboot_table_probe(struct platform_devic= e *pdev) if (!header) return -ENOMEM; =20 - len =3D header->header_bytes + header->table_bytes; ret =3D strncmp(header->signature, "LBIO", sizeof(header->signature)); + + if (!ret && + (header->header_bytes < sizeof(*header) || + check_add_overflow((resource_size_t)header->header_bytes, + (resource_size_t)header->table_bytes, + &table_span) || + table_span > len)) + ret =3D -EINVAL; + memunmap(header); if (ret) { dev_warn(dev, "coreboot table missing or corrupt!\n"); return -ENODEV; } =20 - ptr =3D memremap(res->start, len, MEMREMAP_WB); + ptr =3D memremap(res->start, table_span, MEMREMAP_WB); if (!ptr) return -ENOMEM; =20 - ret =3D coreboot_table_populate(dev, ptr, len); + ret =3D coreboot_table_populate(dev, ptr, table_span); =20 memunmap(ptr); =20 --=20 2.51.2