From nobody Sat Sep 26 03:55:50 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0D7A847FB19 for ; Thu, 24 Sep 2026 13:11:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790255473; cv=none; b=UWfUAOBU3cNO4kZMJgQN7bxMN3iejkJHv7dxwUL2IhxoqXthWfl8jPm7gmc8/WkHe5uGkZ46XVXnfbYdp9gZljCHAbxirftQNUog2fsMRc7cRzvvgJJxvoQy6RU646qoviHk3anzTNUejQPJawMJO5yab6ObIlgk9JyIu7EYsKg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790255473; c=relaxed/simple; bh=kHAokS9fDuLvwu1+K2sAsR4xaoLQ3P90JOQdGxXwI3Q=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=SJ9gai9uYD4bhevKHXYpnBKEsm7uyHy4CpugPVbhWpfk8PubUOGJKe2Cv2f2m34m9O3eFKhE5k8TmugtcCOyP2Sx6RgJD1iA5RvjbVVVFdzp1GnmsR61jjSEp10sX9dN+YfvGEQiOv3A6P+YyTSaoNG4ZNs7us7OBzw+aW/PA3s= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=fj3S4nw8; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="fj3S4nw8" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790255469; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=BKSceu/74WoCFK22feNIfxF464NqVJJHCaTrECoXAd4=; b=fj3S4nw8xA5Xy5+KUOuIGqD2CChz8PxW0V0OuNgx8cmRtopArsCh8t2ImLh5zsdr/zuJrG BxlQ7Aj/BJeJwEwuuOmDHlNBMHqTlz+0SfJ3BHCneDR2j0PZJJrqD37oNUhGslQ9zKf8UB t0R3uH6a9oJNLW6PoS2crqlV1pe75i8= Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-467-VFZfnszIOYeUOEML_6zYtQ-1; Thu, 24 Sep 2026 09:11:06 -0400 X-MC-Unique: VFZfnszIOYeUOEML_6zYtQ-1 X-Mimecast-MFC-AGG-ID: VFZfnszIOYeUOEML_6zYtQ_1790255465 Received: from mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.93]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 3B88618512C2; Thu, 24 Sep 2026 13:11:05 +0000 (UTC) Received: from aesteve-thinkpadp1gen8.rmtes.csb (headnet04.pony-001.prod.iad2.dc.redhat.com [10.2.32.116]) by mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 435BF1800370; Thu, 24 Sep 2026 13:11:03 +0000 (UTC) From: Albert Esteve Date: Thu, 24 Sep 2026 15:10:35 +0200 Subject: [PATCH v3 1/4] soc: qcom: smem: add IN_PARTITION_RANGE helper Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260924-port-smem-v3-1-fbc2ea81a654@redhat.com> References: <20260924-port-smem-v3-0-fbc2ea81a654@redhat.com> In-Reply-To: <20260924-port-smem-v3-0-fbc2ea81a654@redhat.com> To: Bjorn Andersson , Konrad Dybcio Cc: linux-arm-msm@vger.kernel.org, linux-kernel@vger.kernel.org, Albert Esteve , Sarannya S , Pranav Mahesh Phansalkar , Sudeepgoud Patil X-Developer-Signature: v=1; a=ed25519-sha256; t=1790255460; l=1678; i=aesteve@redhat.com; s=20260827; h=from:subject:message-id; bh=ZL5OqMFy04o5fpagEOrdmsCdEQK3KqDzDKFuhPnBefE=; b=IJeA3bDldXV3K9gifNiyfen/SFSiLpTGSf2QTzoJvVXJTlHAuULolv4NNVO9p3kFgTZaGnukS FPgB7zHRCzoCUsHWiZKsSPV1TphPrHorNt/NRoxjiBvoHsWRxuUoDzv X-Developer-Key: i=aesteve@redhat.com; a=ed25519; pk=zI2RBeZgocwYm3AkJW4CtjoJnKoDZrfBl1xe5Ed6h+U= X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.93 From: Sarannya S Add IN_PARTITION_RANGE() to test that a pointer lies in [start, end] and that pointer + size does not wrap. Signed-off-by: Sarannya S Signed-off-by: Pranav Mahesh Phansalkar Signed-off-by: Sudeepgoud Patil Signed-off-by: Albert Esteve --- drivers/soc/qcom/smem.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/drivers/soc/qcom/smem.c b/drivers/soc/qcom/smem.c index b5e7bd8c1512..6783a3c533f0 100644 --- a/drivers/soc/qcom/smem.c +++ b/drivers/soc/qcom/smem.c @@ -2,6 +2,7 @@ /* * Copyright (c) 2015, Sony Mobile Communications AB. * Copyright (c) 2012-2013, The Linux Foundation. All rights reserved. + * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. */ =20 #include @@ -88,6 +89,17 @@ /* Processor/host identifier for the global partition */ #define SMEM_GLOBAL_HOST 0xfffe =20 +/* Entry range check + * ptr >=3D start : Checks if ptr is greater than the start of access regi= on + * ptr + size >=3D ptr: Check for integer overflow (On 32bit system where = ptr + * and size are 32bits, ptr + size can wrap around to be a small integer) + * ptr + size <=3D end: Checks if ptr+size is less than the end of access = region + */ +#define IN_PARTITION_RANGE(ptr, size, start, end) \ + (((void *)(ptr) >=3D (void *)(start)) && \ + (((void *)(ptr) + (size)) >=3D (void *)(ptr)) && \ + (((void *)(ptr) + (size)) <=3D (void *)(end))) + /** * struct smem_proc_comm - proc_comm communication struct (legacy) * @command: current command to be executed --=20 2.55.0 From nobody Sat Sep 26 03:55:50 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2DD38481252 for ; Thu, 24 Sep 2026 13:11:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790255473; cv=none; b=W2UdxHKT8OlHDx4jP0a/PL1KRoqg9XEhl1zDEzuQ4SXQIfO04botYv/j7Xp12uMweaqm0eC3A2rqit1VmNDd5PtG8oA1dfvV9ytGyZethVHtPqb/wjsLyaW7Z7ZpaoxgE7Gr3BBvWyZgpBulJq7FDfF8xPdHIRNYNKOgmg/8MmM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790255473; c=relaxed/simple; bh=NdqHat4Xkj7B8ER5lMEyv8VmSOKg16jzX4AMZedIK80=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=DUqHTg6Wnk3Nq2A0kglvTSpk/1ozYcL5KFXOyE9rU+z2fbt878JpPVWyuk5B1v7Y0YzlH7dlrqrm2iI0Y6gRhi4BjP0LTx5QUN7bd9v/s7ezaLFrcBARIFRleKTkQJh4X0clmLFIrcOc4wxGY9r6RIwKQxo9OHfb5vAxCA05Rtc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=RSJMyumd; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="RSJMyumd" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790255470; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=fJQvlbToXIaXybyHi1bC0IWhHP8I5jdSfJh12RU+oeo=; b=RSJMyumd83EqSvTR/fAmQ5QezlHhkpMNRw60XQUCvPrEmCW1YfnRE37QrxrBFjX7YdRnbB DZtLPGRqsNs6tMDmhhwUKjaCgaEhnDX/3FihGqEIt22pS7VxBHy1kpDiEkXcN0Fct8PahS yzVnCj4pNQoit9bKTzObUY05ZmK3ruo= Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-611-Uyw4h6hgMB6DxGwbxvWhZg-1; Thu, 24 Sep 2026 09:11:08 -0400 X-MC-Unique: Uyw4h6hgMB6DxGwbxvWhZg-1 X-Mimecast-MFC-AGG-ID: Uyw4h6hgMB6DxGwbxvWhZg_1790255467 Received: from mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.93]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 5270A195C25C; Thu, 24 Sep 2026 13:11:07 +0000 (UTC) Received: from aesteve-thinkpadp1gen8.rmtes.csb (headnet04.pony-001.prod.iad2.dc.redhat.com [10.2.32.116]) by mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 8F97C180049F; Thu, 24 Sep 2026 13:11:05 +0000 (UTC) From: Albert Esteve Date: Thu, 24 Sep 2026 15:10:36 +0200 Subject: [PATCH v3 2/4] soc: qcom: smem: validate private entry list walks Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260924-port-smem-v3-2-fbc2ea81a654@redhat.com> References: <20260924-port-smem-v3-0-fbc2ea81a654@redhat.com> In-Reply-To: <20260924-port-smem-v3-0-fbc2ea81a654@redhat.com> To: Bjorn Andersson , Konrad Dybcio Cc: linux-arm-msm@vger.kernel.org, linux-kernel@vger.kernel.org, Albert Esteve , Sarannya S , Pranav Mahesh Phansalkar , Sudeepgoud Patil X-Developer-Signature: v=1; a=ed25519-sha256; t=1790255460; l=4205; i=aesteve@redhat.com; s=20260827; h=from:subject:message-id; bh=NFK/SMZm2DMaUW9Or9s4UQlovYwo2U2DNHeX8g+CclY=; b=qGSbHRpZUUtmXPYCgbqHNZVQ8y84CqrI9Qdhcbm7hiUg3DO8BAPoZSR+3SI2UUBMT620bheQJ OAaeCbWcTdGDfNO1Ir/eZxRuiAluNACoxb5VvrPSmopfIWtFJ0e6KDO X-Developer-Key: i=aesteve@redhat.com; a=ed25519; pk=zI2RBeZgocwYm3AkJW4CtjoJnKoDZrfBl1xe5Ed6h+U= X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.93 From: Sarannya S When walking private entries, use the uncached/cached free offsets as the list bounds, require room for a header before dereferencing, and reject a next pointer that does not advance. Skip the cached list when the cached free offset is at the partition end. Signed-off-by: Sarannya S Signed-off-by: Pranav Mahesh Phansalkar Signed-off-by: Sudeepgoud Patil Signed-off-by: Albert Esteve --- drivers/soc/qcom/smem.c | 50 ++++++++++++++++++++++++++++++++++++---------= ---- 1 file changed, 37 insertions(+), 13 deletions(-) diff --git a/drivers/soc/qcom/smem.c b/drivers/soc/qcom/smem.c index 6783a3c533f0..9bf0ec32c9f1 100644 --- a/drivers/soc/qcom/smem.c +++ b/drivers/soc/qcom/smem.c @@ -421,6 +421,7 @@ static int qcom_smem_alloc_private(struct qcom_smem *sm= em, size_t size) { struct smem_private_entry *hdr, *end; + struct smem_private_entry *next_hdr; struct smem_partition_header *phdr; size_t alloc_size; void *cached; @@ -433,19 +434,25 @@ static int qcom_smem_alloc_private(struct qcom_smem *= smem, end =3D phdr_to_last_uncached_entry(phdr); cached =3D phdr_to_last_cached_entry(phdr); =20 - if (WARN_ON((void *)end > p_end || cached > p_end)) + if (WARN_ON(!IN_PARTITION_RANGE(end, 0, phdr, cached) || + cached > p_end)) return -EINVAL; =20 - while (hdr < end) { + while ((hdr + 1) < end) { if (hdr->canary !=3D SMEM_PRIVATE_CANARY) goto bad_canary; if (le16_to_cpu(hdr->item) =3D=3D item) return -EEXIST; =20 - hdr =3D uncached_entry_next(hdr); + next_hdr =3D uncached_entry_next(hdr); + + if (WARN_ON(next_hdr <=3D hdr)) + return -EINVAL; + + hdr =3D next_hdr; } =20 - if (WARN_ON((void *)hdr > p_end)) + if (WARN_ON((void *)hdr > (void *)end)) return -EINVAL; =20 /* Check that we don't grow into the cached region */ @@ -604,7 +611,8 @@ static void *qcom_smem_get_private(struct qcom_smem *sm= em, unsigned int item, size_t *size) { - struct smem_private_entry *e, *end; + struct smem_private_entry *e, *uncached_end, *cached_end; + struct smem_private_entry *next_e; struct smem_partition_header *phdr; void *item_ptr, *p_end; u32 padding_data; @@ -614,9 +622,14 @@ static void *qcom_smem_get_private(struct qcom_smem *s= mem, p_end =3D (void *)phdr + part->size; =20 e =3D phdr_to_first_uncached_entry(phdr); - end =3D phdr_to_last_uncached_entry(phdr); + uncached_end =3D phdr_to_last_uncached_entry(phdr); + cached_end =3D phdr_to_last_cached_entry(phdr); + + if (WARN_ON(!IN_PARTITION_RANGE(uncached_end, 0, phdr, cached_end) || + (void *)cached_end > p_end)) + return ERR_PTR(-EINVAL); =20 - while (e < end) { + while ((e + 1) < uncached_end) { if (e->canary !=3D SMEM_PRIVATE_CANARY) goto invalid_canary; =20 @@ -638,21 +651,28 @@ static void *qcom_smem_get_private(struct qcom_smem *= smem, return item_ptr; } =20 - e =3D uncached_entry_next(e); + next_e =3D uncached_entry_next(e); + if (WARN_ON(next_e <=3D e)) + return ERR_PTR(-EINVAL); + + e =3D next_e; } =20 - if (WARN_ON((void *)e > p_end)) + if (WARN_ON((void *)e > (void *)uncached_end)) return ERR_PTR(-EINVAL); =20 /* Item was not found in the uncached list, search the cached list */ =20 + if (cached_end =3D=3D p_end) + return ERR_PTR(-ENOENT); + e =3D phdr_to_first_cached_entry(phdr, part->cacheline); - end =3D phdr_to_last_cached_entry(phdr); =20 - if (WARN_ON((void *)e < (void *)phdr || (void *)end > p_end)) + if (WARN_ON(!IN_PARTITION_RANGE(cached_end, 0, uncached_end, p_end) || + !IN_PARTITION_RANGE(e, sizeof(*e), cached_end, p_end))) return ERR_PTR(-EINVAL); =20 - while (e > end) { + while (e > cached_end) { if (e->canary !=3D SMEM_PRIVATE_CANARY) goto invalid_canary; =20 @@ -674,7 +694,11 @@ static void *qcom_smem_get_private(struct qcom_smem *s= mem, return item_ptr; } =20 - e =3D cached_entry_next(e, part->cacheline); + next_e =3D cached_entry_next(e, part->cacheline); + if (WARN_ON(next_e >=3D e)) + return ERR_PTR(-EINVAL); + + e =3D next_e; } =20 if (WARN_ON((void *)e < (void *)phdr)) --=20 2.55.0 From nobody Sat Sep 26 03:55:50 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4C8F047FAEB for ; Thu, 24 Sep 2026 13:11:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790255475; cv=none; b=biQVA5La3HoUafDW+oeQcPptz8Iz4gyP6lG+D4/7DULbRxlzrY+D3o9F9ahI38lGvfYX+Ktve3DaFEBNWT5WmXjMH2tl2KAcq5xkxrqzbvxkLuNUmrUKWh0THNB/JVdmEo3OtvXn4umSsFZX6vyhim9hiQo2A+49X147McZRsOA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790255475; c=relaxed/simple; bh=RRuuKHHJLAF/PoRx10jvHLLkvsKE07Hd450wrrtZcVg=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=qZw1cVj5rWPeR9FMp1avXnj3OJ6t29OMvH9ekRalcLE9u28FZdC+2bptAn4jBbAaM1WrCk5b2ueFUzRN/kMRVubocsSTQ1Yyb2iUpx6f131Hn189x5e+xBY7hyAuY+ZmrZym1Wh9dThSo6sSL+rvs6l7g23NPbyBLw6/jycq4NM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=ci/6p1Lg; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="ci/6p1Lg" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790255472; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=tCiVKvl0U5HyMcw8fr6y+kpfZgHxe06LcCi7XPoYPIY=; b=ci/6p1LgDCTHdWeqUVQznXb0d7NHIPbD+T8gKwULmEhA2HXNgldD5FPITJBtLfbmBXGkbF E3uw09u6GdEHspxHNqyPAKzCxImWcwKQQn9XgFw1LEZIBePtJ3RTTkQcTl+l3fio38k7uD EQQ4ldAiwtWIB6Jh4cZSGxgJofi7V/4= Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-359-ZBKyobHEPJKtAnTe87Pr6g-1; Thu, 24 Sep 2026 09:11:10 -0400 X-MC-Unique: ZBKyobHEPJKtAnTe87Pr6g-1 X-Mimecast-MFC-AGG-ID: ZBKyobHEPJKtAnTe87Pr6g_1790255469 Received: from mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.93]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 5C0BF1805A3A; Thu, 24 Sep 2026 13:11:09 +0000 (UTC) Received: from aesteve-thinkpadp1gen8.rmtes.csb (headnet04.pony-001.prod.iad2.dc.redhat.com [10.2.32.116]) by mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id AD145180049F; Thu, 24 Sep 2026 13:11:07 +0000 (UTC) From: Albert Esteve Date: Thu, 24 Sep 2026 15:10:37 +0200 Subject: [PATCH v3 3/4] soc: qcom: smem: validate private item payloads Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260924-port-smem-v3-3-fbc2ea81a654@redhat.com> References: <20260924-port-smem-v3-0-fbc2ea81a654@redhat.com> In-Reply-To: <20260924-port-smem-v3-0-fbc2ea81a654@redhat.com> To: Bjorn Andersson , Konrad Dybcio Cc: linux-arm-msm@vger.kernel.org, linux-kernel@vger.kernel.org, Albert Esteve , Sarannya S , Pranav Mahesh Phansalkar , Sudeepgoud Patil X-Developer-Signature: v=1; a=ed25519-sha256; t=1790255460; l=2810; i=aesteve@redhat.com; s=20260827; h=from:subject:message-id; bh=7Fy/nHJfs1KTdWXFuA9y7jW0peRcEf9rjNVfNfqFcvY=; b=G+TtHeSXw/sevpeYqU7g5oI+OZRIOEMr0zcNt8L+vhfopvEs1XtUny5X9rRSe3rvXSvIfvLoh c4B3tflg2mjCJbwmiWrYoNJoeLl1tTDUxp5RLBO41ISBGST9yl1uuJ/ X-Developer-Key: i=aesteve@redhat.com; a=ed25519; pk=zI2RBeZgocwYm3AkJW4CtjoJnKoDZrfBl1xe5Ed6h+U= X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.93 From: Sarannya S Validate a matching entry's size and padding even when the caller does not request the length, and check that the payload stays inside the same region as the header. Signed-off-by: Sarannya S Signed-off-by: Pranav Mahesh Phansalkar Signed-off-by: Sudeepgoud Patil Signed-off-by: Albert Esteve --- drivers/soc/qcom/smem.c | 39 +++++++++++++++++++++------------------ 1 file changed, 21 insertions(+), 18 deletions(-) diff --git a/drivers/soc/qcom/smem.c b/drivers/soc/qcom/smem.c index 9bf0ec32c9f1..393257cbe5e1 100644 --- a/drivers/soc/qcom/smem.c +++ b/drivers/soc/qcom/smem.c @@ -615,6 +615,7 @@ static void *qcom_smem_get_private(struct qcom_smem *sm= em, struct smem_private_entry *next_e; struct smem_partition_header *phdr; void *item_ptr, *p_end; + size_t entry_size =3D 0; u32 padding_data; u32 e_size; =20 @@ -634,20 +635,21 @@ static void *qcom_smem_get_private(struct qcom_smem *= smem, goto invalid_canary; =20 if (le16_to_cpu(e->item) =3D=3D item) { - if (size !=3D NULL) { - e_size =3D le32_to_cpu(e->size); - padding_data =3D le16_to_cpu(e->padding_data); + e_size =3D le32_to_cpu(e->size); + padding_data =3D le16_to_cpu(e->padding_data); =20 - if (WARN_ON(e_size > part->size || padding_data > e_size)) - return ERR_PTR(-EINVAL); - - *size =3D e_size - padding_data; - } + if (e_size < part->size && padding_data < e_size) + entry_size =3D e_size - padding_data; + else + return ERR_PTR(-EINVAL); =20 item_ptr =3D uncached_entry_to_item(e); - if (WARN_ON(item_ptr > p_end)) + if (WARN_ON(!IN_PARTITION_RANGE(item_ptr, entry_size, e, uncached_end))) return ERR_PTR(-EINVAL); =20 + if (size !=3D NULL) + *size =3D entry_size; + return item_ptr; } =20 @@ -677,20 +679,21 @@ static void *qcom_smem_get_private(struct qcom_smem *= smem, goto invalid_canary; =20 if (le16_to_cpu(e->item) =3D=3D item) { - if (size !=3D NULL) { - e_size =3D le32_to_cpu(e->size); - padding_data =3D le16_to_cpu(e->padding_data); + e_size =3D le32_to_cpu(e->size); + padding_data =3D le16_to_cpu(e->padding_data); =20 - if (WARN_ON(e_size > part->size || padding_data > e_size)) - return ERR_PTR(-EINVAL); - - *size =3D e_size - padding_data; - } + if (e_size < part->size && padding_data < e_size) + entry_size =3D e_size - padding_data; + else + return ERR_PTR(-EINVAL); =20 item_ptr =3D cached_entry_to_item(e); - if (WARN_ON(item_ptr < (void *)phdr)) + if (WARN_ON(!IN_PARTITION_RANGE(item_ptr, entry_size, cached_end, e))) return ERR_PTR(-EINVAL); =20 + if (size !=3D NULL) + *size =3D entry_size; + return item_ptr; } =20 --=20 2.55.0 From nobody Sat Sep 26 03:55:50 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 76C414825A8 for ; Thu, 24 Sep 2026 13:11:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790255478; cv=none; b=uIpfWanxYR+odgKPNtW5krURY5xjJ6xRlZs0cXWIBJNp1X1C5Ye4IwixsqlwaIcgrCMXdR67DAvVNtQyzBSwwh9prTgoQuvZdohaHpzb06258KAF+yrArbvBudKx0WuPbz/J/BPPgKZwjE963BiIZwUtA7NefmvIylmyPrN35LU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790255478; c=relaxed/simple; bh=me56oTO/TOBSqsm3f2x4P/XfTor+iq5IBnVYHVS2BVY=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=r4AZF8uQ7w6etbhpy16s/ajLHKIx/TZE6WI/Z13aSnk4yQBnRXajoV1yIFbRQCPC+WCkeLVimPNPDP+0iOE9OD9GY0e4jcpva1vpFlQjlB7MGbFHDqaS19J1HevGXq1Q5PSbLQH5VwRwmYL9Tt/OAHCL35hzfzfMJni3PUbe0s8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=S4Xu7sOI; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="S4Xu7sOI" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790255474; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=CK9h24tbKUqAp/U2G5VravT+5URHwmwyNjh2EclKSmQ=; b=S4Xu7sOIghXPkM6uYreyH81h1wQ6mwaCpIW1Qkyj1kYhiUM47fodRXAl3qMtsXZ5b6fao+ Ptz2rlTvjYD1AZnKlKyQbZsvHlAKMkkATpHbEA/ErD4beMiyvu3JtVkuhvRT9VJwl5h0Ca Vw6G32qd4M2RQLxeaSdb9LvjCwFd05A= Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-500-osQ3COd8PReZyKXmPefo_Q-1; Thu, 24 Sep 2026 09:11:12 -0400 X-MC-Unique: osQ3COd8PReZyKXmPefo_Q-1 X-Mimecast-MFC-AGG-ID: osQ3COd8PReZyKXmPefo_Q_1790255471 Received: from mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.93]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 3746C1828ABD; Thu, 24 Sep 2026 13:11:11 +0000 (UTC) Received: from aesteve-thinkpadp1gen8.rmtes.csb (headnet04.pony-001.prod.iad2.dc.redhat.com [10.2.32.116]) by mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id B03B31800586; Thu, 24 Sep 2026 13:11:09 +0000 (UTC) From: Albert Esteve Date: Thu, 24 Sep 2026 15:10:38 +0200 Subject: [PATCH v3 4/4] soc: qcom: smem: ignore multi remote host partitions Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260924-port-smem-v3-4-fbc2ea81a654@redhat.com> References: <20260924-port-smem-v3-0-fbc2ea81a654@redhat.com> In-Reply-To: <20260924-port-smem-v3-0-fbc2ea81a654@redhat.com> To: Bjorn Andersson , Konrad Dybcio Cc: linux-arm-msm@vger.kernel.org, linux-kernel@vger.kernel.org, Albert Esteve , Tony Truong , Konrad Dybcio X-Developer-Signature: v=1; a=ed25519-sha256; t=1790255460; l=1357; i=aesteve@redhat.com; s=20260827; h=from:subject:message-id; bh=3ju3KHFjQna22sHC5wqI6gfy3u13jdoSmHuNzJTX+nA=; b=0rZdUYJc1AZKljjzwEOoHoqIefdC1AodXci5myT0K27k7nn52im+FjER1xb1rjOIGlD+PkbXy mSB0YZZkv0NCRH64xwdAaaa2T0wJFHLzApFOuzhKhAH8h3z5kK5NOWE X-Developer-Key: i=aesteve@redhat.com; a=ed25519; pk=zI2RBeZgocwYm3AkJW4CtjoJnKoDZrfBl1xe5Ed6h+U= X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.93 From: Tony Truong SMEM now supports more than just 1-to-1 partitions. It is possible for a partition to have multiple remote host and the logic to handle that does not exist. For now, skip all partitions which has multiple remote hosts. Signed-off-by: Tony Truong Reviewed-by: Konrad Dybcio Signed-off-by: Albert Esteve --- drivers/soc/qcom/smem.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/soc/qcom/smem.c b/drivers/soc/qcom/smem.c index 393257cbe5e1..a7a1840b7ff7 100644 --- a/drivers/soc/qcom/smem.c +++ b/drivers/soc/qcom/smem.c @@ -89,6 +89,9 @@ /* Processor/host identifier for the global partition */ #define SMEM_GLOBAL_HOST 0xfffe =20 +/* Processor/host identifier for multi host partition */ +#define SMEM_MULTI_HOST 0xfffc + /* Entry range check * ptr >=3D start : Checks if ptr is greater than the start of access regi= on * ptr + size >=3D ptr: Check for integer overflow (On 32bit system where = ptr @@ -1091,6 +1094,9 @@ qcom_smem_enumerate_partitions(struct qcom_smem *smem= , u16 local_host) else continue; =20 + if (remote_host =3D=3D SMEM_MULTI_HOST) + continue; + if (xa_load(&smem->partitions, remote_host)) { dev_err(smem->dev, "duplicate host %u\n", remote_host); return -EINVAL; --=20 2.55.0