This patch series hardens the Broadcom STB DPFE driver against potential
exploitation through a buggy or compromised DCPU coprocessor.
The DPFE driver exchanges messages with the DCPU over shared memory-mapped
regions and currently trusts DCPU supplied values without bounds checking
them before use.
A compromised or malfunctioning DCPU could:
- On API v1/v2 boards, provide an arbitrary MMIO read/write primitive
through the offset supplied in get_msg_ptr(), combined with
root-writable and world-readable sysfs files.
- Make a user who reads world-readable sysfs files trigger an out-of-bounds
stack read of arbitrary extent via an unvalidated checksum index.
Patch 1 addresses the MMIO read/write issue by rejecting an offset that,
along with the largest field accessed (DRAM_VENDOR_ERROR + sizeof(u32)),
exceeds the recorded mapping size.
Patch 2 addresses the stack over-read via the checksum index by checking
it against MSG_FIELD_MAX after reading the response from the DCPU message
RAM.
Justin Chen (2):
memory: brcmstb_dpfe: Fix out-of-bounds access due to DCPU offset
memory: brcmstb_dpfe: Bounds check DCPU-supplied MSG_ARG_COUNT
drivers/memory/brcmstb_dpfe.c | 24 ++++++++++++++++++++++--
1 file changed, 22 insertions(+), 2 deletions(-)
--
2.54.0