From nobody Mon Sep 28 10:47:10 2026 Received: from cstnet.cn (smtp81.cstnet.cn [159.226.251.81]) (using TLSv1.2 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 090C51A8F7B for ; Sun, 23 Aug 2026 06:11:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=159.226.251.81 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787465478; cv=none; b=BKtHDuwB4r3rg8vk/+BAcO3Eyrmy3k0sqh72rLsQAuAT3J9rnQkhe7h1W8JYbJyvXP2B6rBGz26oETO2qIsMNis6xKCl0cKtoSZqKSIuRmU+ztaNd98v/5S0wo6EZibfNQn22LuXvmeqJeuyGDv6WNlh7Sx9WdlkNeDMNK2Ub/U= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787465478; c=relaxed/simple; bh=maJEHrQP/Te4kOpjl/c5p/VLcnN/n0FC/k/7jIYbU6A=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=luU1cTVktKDPfOdrheHIFnVO+Ol9K/3lqu3tHGge8pP/MAVHpo6mHDybJ7ic/gCVamN1nk8QJyYYRk9y1J+cNTZKSvA8KN8adRWmcjkf/RkoRjS8gG/OD3VBlXHwyfDWa7iYLHKhTVswAXeUxu3sMyEUhPh4PIxfjDNY7vNzWdE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iscas.ac.cn; spf=pass smtp.mailfrom=iscas.ac.cn; arc=none smtp.client-ip=159.226.251.81 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iscas.ac.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=iscas.ac.cn Received: from f3f1baf57000.home.arpa (unknown [36.110.52.2]) by APP-03 (Coremail) with SMTP id rQCowADHzz32jopqLcoPBg--.62823S2; Sun, 23 Aug 2026 14:11:02 +0800 (CST) From: liutong To: Anup Patel Cc: Rahul Pathak , Jassi Brar , linux-riscv@lists.infradead.org, linux-kernel@vger.kernel.org, liutong Subject: [PATCH] mailbox: riscv-sbi-mpxy: Validate notification data length Date: Sun, 23 Aug 2026 06:10:53 +0000 Message-Id: <20260823061053.543415-1-liutong@iscas.ac.cn> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: rQCowADHzz32jopqLcoPBg--.62823S2 X-Coremail-Antispam: 1UD129KBjvdXoWrKw1UGFyfCrWDXF1DtFWDJwb_yoWkZrX_G3 Zaqr9rWr17Ca1Y9FnIy34rur4SvrW5ur9Ygr9xt395W3y09FnrXryxZrs5ZrsrZF1DZrs7 Cw4DZ34fZw1rKjkaLaAFLSUrUUUUjb8apTn2vfkv8UJUUUU8Yxn0WfASr-VFAUDa7-sFnT 9fnUUIcSsGvfJTRUUUbxxFF20E14v26r1j6r4UM7CY07I20VC2zVCF04k26cxKx2IYs7xG 6rWj6s0DM7CIcVAFz4kK6r1j6r18M28lY4IEw2IIxxk0rwA2F7IY1VAKz4vEj48ve4kI8w A2z4x0Y4vE2Ix0cI8IcVAFwI0_JFI_Gr1l84ACjcxK6xIIjxv20xvEc7CjxVAFwI0_Gr0_ Cr1l84ACjcxK6I8E87Iv67AKxVW8Jr0_Cr1UM28EF7xvwVC2z280aVCY1x0267AKxVW8Jr 0_Cr1UM2AIxVAIcxkEcVAq07x20xvEncxIr21l5I8CrVACY4xI64kE6c02F40Ex7xfMcIj 6xIIjxv20xvE14v26r126r1DMcIj6I8E87Iv67AKxVW8Jr0_Cr1UMcvjeVCFs4IE7xkEbV WUJVW8JwACjcxG0xvY0x0EwIxGrwACjI8F5VA0II8E6IAqYI8I648v4I1lc7CjxVAaw2AF wI0_JF0_Jw1l42xK82IYc2Ij64vIr41l4I8I3I0E4IkC6x0Yz7v_Jr0_Gr1lx2IqxVAqx4 xG67AKxVWUJVWUGwC20s026x8GjcxK67AKxVWUGVWUWwC2zVAF1VAY17CE14v26r126r1D MIIYrxkI7VAKI48JMIIF0xvE2Ix0cI8IcVAFwI0_Jr0_JF4lIxAIcVC0I7IYx2IY6xkF7I 0E14v26r1j6r4UMIIF0xvE42xK8VAvwI8IcIk0rVWUJVWUCwCI42IY6I8E87Iv67AKxVWU JVW8JwCI42IY6I8E87Iv6xkF7I0E14v26r4j6r4UJbIYCTnIWIevJa73UjIFyTuYvjfU5k u4UUUUU X-CM-SenderInfo: xolx301qj6x2xfdvhtffof0/ Content-Type: text/plain; charset="utf-8" mpxy_get_notifications() copies data from shared memory using a length derived from the SBI return value: memcpy(notif_data, mpxy->shmem, sret.value + 16); sret.value is not validated against the shared memory buffer size. A buggy firmware returning a value larger than mpxy_shmem_size - 16 would cause memcpy to read beyond the shared memory mapping. Add a bounds check before the memcpy. Fixes: bf3022a4eb11 ("mailbox: Add RISC-V SBI message proxy (MPXY) based ma= ilbox driver") Signed-off-by: liutong Reviewed-by: Anup Patel --- drivers/mailbox/riscv-sbi-mpxy-mbox.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/mailbox/riscv-sbi-mpxy-mbox.c b/drivers/mailbox/riscv-= sbi-mpxy-mbox.c index 18da9efcc..3a2d52bbc 100644 --- a/drivers/mailbox/riscv-sbi-mpxy-mbox.c +++ b/drivers/mailbox/riscv-sbi-mpxy-mbox.c @@ -315,6 +315,11 @@ static int mpxy_get_notifications(u32 channel_id, if (sret.error) goto err_put_cpu; =20 + if (sret.value + 16 > mpxy_shmem_size) { + put_cpu(); + return -EIO; + } + memcpy(notif_data, mpxy->shmem, sret.value + 16); *events_data_len =3D sret.value; =20 --=20 2.34.1