From nobody Mon Sep 28 08:45:47 2026 Received: from mail-pj1-f50.google.com (mail-pj1-f50.google.com [209.85.216.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 05B75396D15 for ; Mon, 24 Aug 2026 08:26:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.50 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787560017; cv=none; b=lwFf925P5ucW8zXhKh3Q/W37UOaVjR6ku4TPQ2rMBEQ0BHGCnkdkh2ZBlDPLzPH78baUQhTLYUMzl7GslcK4/7JLGKOeQ5T6YAdBKdHW0fUGNZgkYS5jVSwNrYPMPmK6ACyrgMCVw3Qwob/vxC7GI2zWevmsEEUFE7W8IX1uBt0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787560017; c=relaxed/simple; bh=lYyIoNF3fWmkhnHE9fSVPTTMtQXhuZGIpVAThKlsbYc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=haV0451R+4cQZCbM4WfnKsz+dVQjMnwhLWy6XdraNeMOEBrPmtA0LYeWrAF5K+eRcQqP/vVPhl7KdP2mGVyc06bLpObf36brPCr5N8OysTm623UMGDYIWXusVt408jQ/x+gVie7JExN3pVRRtrNfM18Xd95D3xh7ZXFb4fPI7x0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=ONptO+Hk; arc=none smtp.client-ip=209.85.216.50 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="ONptO+Hk" Received: by mail-pj1-f50.google.com with SMTP id 98e67ed59e1d1-38a0c7e841fso4424376a91.2 for ; Mon, 24 Aug 2026 01:26:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787560014; x=1788164814; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=rvwvU2fx//eAu2LlByDRKWPs/wkyAhNxSDJe0aj8Fuk=; b=ONptO+HkIkqGtGSA9j3czxC5mMrrqnApH5l0HQrqyrf9WC9uCN2PT+MtTAVlSK/Z2y 8grdFUZbfIDZLU5oeNIjxLP33oAJs3XfFjDAIRoYqUzVN+EizqfUTfICuprm8WjJ36Lu kn7vdJ9tqTJVOXsjnoD30J3GaAmLGZBXGYLHUVqzYiMnfmF7GI0WJTXrbC+lpx4pcsfE d7j+TlrNui9IMmS05KhuPYOwjrcp0MvKyJ2CqLnKu4Nve/sd+oMwtMT+uP1S2H8wflpy yi0HmleX0PGooYySZd1QVx5FPkyZsPZfcWjEqcpNj8wgUvcjBcGy77VkeTxTeu/iHCMx BCLg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787560014; x=1788164814; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=rvwvU2fx//eAu2LlByDRKWPs/wkyAhNxSDJe0aj8Fuk=; b=LYWsu8H98TVkSAkX8K8bY6z1FI4Vlm0tmu0kPUAtGBDtdDj+GUkaR7UiPTRBQ5oO62 mKVaiKQCU5n8vVAPk/9LJcRRjRQQkmLvQ5eGuzBw7WDoy2HTrOqUIUAq5pnDxsj9Wgjp WR7QmVZiDWazQ6A7cfALsixFVo3gLJJ/v7hD+oQRW9dnedL0BqD4DKRgBlHfncai6c9+ LPozYt0eIZX1IviqO6tBcsKX8kJ3QgNxONvBfdD5z9SQdn1w5P0dGMAkridRwEooAEhu m6F/lztWKLOCN3VecPgY0xNZkPJEdL4eT4i4emGG0Ylz+VmOz6nwffmqr5Dvb1n9H5e0 RX3g== X-Forwarded-Encrypted: i=1; AHgh+RrhCi4bB4+kdU+3FcKDoc0wU5Qt3Ii9tfW/fopbuBnYaSqndHwbttAAlclemUQcH8Tv3oO3uikm9kPlzok=@vger.kernel.org X-Gm-Message-State: AFuF++kpETC8z0CVOECDWG2p1wINpELrJFBDsCms4LbJaSTV8yftMl4u xvophpDMYtudejOs9ND/Pmqpi9UN+juRVfP9ELY/OoWsZboSxXE+vt8u X-Gm-Gg: AR+sD13JNAvxRwWc1sX71348NNTObGXANDmB/0zsbsLYShp5kgiju2z8+KP36Eu/C1K hHLhrOXIDxjeSecNL95fIBsXii/lPRBW/jSvRSJa9B13e1+uQZ5TWWE2mzk8Rxvn8POsI6+JVCq nd0qMu4HKbdIkV/rQHQXJeO0uVul0g4VlLh+1PJNZfW+5JR/4fOsLYDa0m+yqrm9uUryyuY6UUJ Z7T1UsrSyY15qF5+okjPlIC17jD+wQknJ650A0lozEvBgm07elFqfkMK1SdZoXXyVmTcERUFr6V DECfWJxRMgxHmwKqagEmJ5hFYqha/IUXYzj6phjVjpvthyqmAazwpD9GqDOMfHmFPufC+ICnMzV OvoaZR8X7BWoBhSmMlRWFhBlhfK8Qf1Hu27z05C/pkVJDry3E2VeHUiKr9I1sYo+ubpwhV+s/II 9rzAHns3e3H1Ad5nW9Rgo3OB/2Rh0wWKik0lf/nOmZpzvOdx/oAtOcgW6WmEAnvkz0aPE7OfFC6 zPJVfw+OXCDrivcnvtVdaiMVp4MUnX8mYjBaBKp6MhCKqYGdkIx7V9gDS0qHrGtpkMcomkhHUtp vRFaWyxl20SJlFbgYItM7z7c9GlCeSCfzSEOCW0BY+V1oPP/s/s1/VGzz0VnH1EYvo8JorqLEw7 uVFXy0iIbL60WYVt4giTF45RFCkLqvlWYnZfn3kMn6mmWjUU= X-Received: by 2002:a17:90b:5347:b0:395:a7eb:a4d8 with SMTP id 98e67ed59e1d1-395c3a4bd22mr48059051a91.14.1787560013592; Mon, 24 Aug 2026 01:26:53 -0700 (PDT) Received: from localhost.localdomain ([101.251.7.10]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-327f90c0dd3sm25994595eec.7.2026.08.24.01.26.49 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Mon, 24 Aug 2026 01:26:53 -0700 (PDT) From: Laxman Acharya Padhya To: Sven Peter , Janne Grunau Cc: Neal Gompa , Arnd Bergmann , asahi@lists.linux.dev, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH v2 1/4] soc: apple: rtkit: free syslog buffer before reinitializing Date: Mon, 24 Aug 2026 14:11:37 +0545 Message-ID: X-Mailer: git-send-email 2.51.2 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" A second SYSLOG_INIT message overwrites syslog_msg_buffer without freeing the previous allocation. Free the old buffer before allocating its replacement. Fixes: 9bd1d9a0d8bb ("soc: apple: Add RTKit IPC library") Cc: stable@vger.kernel.org Signed-off-by: Laxman Acharya Padhya --- drivers/soc/apple/rtkit.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/soc/apple/rtkit.c b/drivers/soc/apple/rtkit.c index a3fdac8f6f06..1886f7eba77d 100644 --- a/drivers/soc/apple/rtkit.c +++ b/drivers/soc/apple/rtkit.c @@ -422,6 +422,9 @@ static void apple_rtkit_ioreport_rx(struct apple_rtkit = *rtk, u64 msg) =20 static void apple_rtkit_syslog_rx_init(struct apple_rtkit *rtk, u64 msg) { + kfree(rtk->syslog_msg_buffer); + rtk->syslog_msg_buffer =3D NULL; + rtk->syslog_n_entries =3D FIELD_GET(APPLE_RTKIT_SYSLOG_N_ENTRIES, msg); rtk->syslog_msg_size =3D FIELD_GET(APPLE_RTKIT_SYSLOG_MSG_SIZE, msg); =20 --=20 2.51.2 From nobody Mon Sep 28 08:45:47 2026 Received: from mail-pg1-f169.google.com (mail-pg1-f169.google.com [209.85.215.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 65CF625B0AB for ; Mon, 24 Aug 2026 08:26:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.169 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787560021; cv=none; b=NeWSV3uDHpQyQP2ZZ61WROCfgop24hmbunc4N/h+HRq+PxIDsZJnhJv/vOhWpZ/cnVpx8xvFpYMHzPLDCfOWrWWf9bXUOievH57JOKrTy+MKP6qgii1VRZnP5PiB6y0Yxanv/WpTcD985Ii6RALMYxPHfhdHNk5P1WXBZOeZvPc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787560021; c=relaxed/simple; bh=G5npMlrFjOUjpVZGNazAfzz0eB67gPJfe4NVy6Mo/0w=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Rp3gRNVsCmwnA4xGoAXzExXQXHGfGLOMBgYygvepm5n7330g4+L9+iAhkXMnvWhilj+w1yrCsCl5y2V9JrQxdBz3J6FRVXqApgsZTC0PAl6w0ujs592MpsOeFR9v5ov0xM0J2v6Y9jb/k0fic3TtvK8f9pCazyhDVhr4cGv9kUU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=m7ZD7u/a; arc=none smtp.client-ip=209.85.215.169 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="m7ZD7u/a" Received: by mail-pg1-f169.google.com with SMTP id 41be03b00d2f7-c9cf07d2df6so1978690a12.2 for ; Mon, 24 Aug 2026 01:26:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787560018; x=1788164818; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=fPN5BIwUDTeW7sBnIZ7PXhoHkYcvuxUpMJtfpBrosOg=; b=m7ZD7u/adNXlMIkTf13jgsVAwGFAnTNXsY75X7R7aWyjFI5YWJ47bqH0moxLqxN1gn R2bWPST6li6nBOhPUVzkWY+iBMW6D958JPpp62yjgWDSTzR57Wbs9TufEyqHzZc0PH/F nxx425GkKjWQJVq6vvTe7CBpgfqW7a14DjhA+ngh4crI+a8RUwl9DVG5Y/Uxi4Jddqfp sUe02dwbGrcEP4h3EL03H0bFMjFT1Mq1xvQQ/JRbGHlObfWAhLbT+q8G87HjRtHgg8WF Lg11in6P9oFGIEqpb1098017fSz7d4SKjdCrdc3A3a5llyVfKaVyzP2GAXalJN60/JQZ 3l/A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787560018; x=1788164818; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=fPN5BIwUDTeW7sBnIZ7PXhoHkYcvuxUpMJtfpBrosOg=; b=N3t9Aa+fJpYA69Lv74yfw5AMv/RLllabJiBqER4H+5Bp6PtVPXj2RGd2RpiE3sBPGD e/UEFwhF0eS+4RVlxQeCW4xbOIoxyWQ4/yEvyeNijuW3cF/hxqRXOPz1dTVNFaXjQ+5J DryANUltgyuA4QN/GycjGVQm+UYroVFmKS01pBre6kIfBZBUZVGdg6d2RrG9N3SKgs0x 8h0IJ+j8ZoeTb2bdovJLOAA4gGEScmi85jXhNhJBWKKo1YRHfBc3iofOR5Cg5jlseFyB ObkEqRqxycH4yDRBCsRMJxOSPoXOk/zpZbgJVXu67BwP8HRsJdGDLSLiDYBilSr7cdw1 Cmzg== X-Forwarded-Encrypted: i=1; AHgh+RomkLsyh/wBB0FNVHrbJx6NcDB8C/8NAotsk9hHm6CHpi/wXwFE2QdH92BZ4LRxCkKXTeZj+TCRXmmZT0A=@vger.kernel.org X-Gm-Message-State: AFuF++lAKpbY5XL4LYbHKJqRO0TKXFaG9aEjuFXmYncAAdubejYCf3Xo dZl7D4V8Y7J4/OMRpYYsCCLE4icgy+VlR3F7yT+uoQwEAqdFunQKYdom X-Gm-Gg: AR+sD11PSrwOR4t6yUn3XPohOd0dGDTRMPYVfiMnKmcFk09nTUgGoBn7XyFhb5/CsCV bjlMjn/5dTcv7yGnlF7DFmtDbgpzthZaH1Yc0Hlwns2RVLfIJNOP+X07p79DQZGStN2a9un7+SB x7SWcjNgRV0GLVryAEAqfJCbaJIVfkBRiwImBcZIk2gKAlyO3CBsYdceXRz6MxhVTGuXaLF/rDV Gu6nonBFs/4ILArOH1Zpa0hWofiEnE+5e94/hRdHqX5F8m34XB4DiBronMdTb1djMJVVgQe9V0u Sx1MqSOBYTiDEyRXhs3Qi15z+8WeHfhoCFwhlDBpNsMyeHw5fHw6gixvNSnM7gr66V3n8LglycH tY2dIwM7Fp7adtzQi5heCy9FejJF8Bx7Onu1amUaCQekMF4DuoZvzK6ZMJ4GmJf8/hWPKEkLCBu jY7Y63xl/PygeLj3Sm1f1e8JckL6V+I7JgIFh7MtZ7GAlr9etvFJ4jsy+JlFr9MOK5jgi5LufUY iGsiE1e4e3h1dJtBbSILjeImWfrw29Tmv50XEYJvd5JUjGjF4NFBRBWV8FwCSNOOBhBSdLERzxT BgCNpDLYb7wzViD5ha5z63u3X1LccfI9MmAzXsR7ZQIqcUrw7DFEvB4+KteFXTPCNIJOEVSf7/y 2R5FFWbRGWaIKKmwEMMV+d0jzrl0GnadSDknNlynOUcZou9s= X-Received: by 2002:a05:6a20:d70f:b0:3c4:2b8b:e88f with SMTP id adf61e73a8af0-3cd2fea6574mr50727838637.5.1787560018294; Mon, 24 Aug 2026 01:26:58 -0700 (PDT) Received: from localhost.localdomain ([101.251.7.10]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-327f90c0dd3sm25994595eec.7.2026.08.24.01.26.54 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Mon, 24 Aug 2026 01:26:57 -0700 (PDT) From: Laxman Acharya Padhya To: Sven Peter , Janne Grunau Cc: Neal Gompa , Arnd Bergmann , asahi@lists.linux.dev, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH v2 2/4] soc: apple: rtkit: bound syslog copies to the shared buffer Date: Mon, 24 Aug 2026 14:11:38 +0545 Message-ID: <5575a09569af52fa7d8d66a217ca846824ef2745.1787559303.git.acharyalaxman8848@gmail.com> X-Mailer: git-send-email 2.51.2 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" apple_rtkit_syslog_rx_log() copies a log entry out of the coprocessor shared-memory ring using an index and layout chosen by the coprocessor. These values are not checked against syslog_buffer.size, so buggy firmware can make memcpy_fromio() or memcpy() read past the DMA mapping. SYSLOG_INIT also accepts a zero message size. kzalloc(0) returns ZERO_SIZE_PTR, which is non-NULL, and the later strnlen() size wraps from zero to SIZE_MAX. Reject zero-sized messages and make apple_rtkit_memcpy() refuse copies that do not fit in the shared buffer. Rate limit the bounds warning so the coprocessor cannot flood the kernel log. Fixes: 9bd1d9a0d8bb ("soc: apple: Add RTKit IPC library") Cc: stable@vger.kernel.org Signed-off-by: Laxman Acharya Padhya --- drivers/soc/apple/rtkit.c | 49 ++++++++++++++++++++++++++++----------- 1 file changed, 35 insertions(+), 14 deletions(-) diff --git a/drivers/soc/apple/rtkit.c b/drivers/soc/apple/rtkit.c index 1886f7eba77d..2e62f9b3c948 100644 --- a/drivers/soc/apple/rtkit.c +++ b/drivers/soc/apple/rtkit.c @@ -348,14 +348,23 @@ static void apple_rtkit_free_buffer(struct apple_rtki= t *rtk, bfr->is_mapped =3D false; } =20 -static void apple_rtkit_memcpy(struct apple_rtkit *rtk, void *dst, - struct apple_rtkit_shmem *bfr, size_t offset, - size_t len) -{ +static int apple_rtkit_memcpy(struct apple_rtkit *rtk, void *dst, + struct apple_rtkit_shmem *bfr, size_t offset, + size_t len) +{ + if (offset > bfr->size || len > bfr->size - offset) { + dev_warn_ratelimited(rtk->dev, + "RTKit: shared-memory copy out of bounds (off 0x%zx len 0x%zx siz= e 0x%zx)\n", + offset, len, bfr->size); + return -EINVAL; + } + if (bfr->iomem) memcpy_fromio(dst, bfr->iomem + offset, len); else memcpy(dst, bfr->buffer + offset, len); + + return 0; } =20 static void apple_rtkit_crashlog_rx(struct apple_rtkit *rtk, u64 msg) @@ -384,9 +393,10 @@ static void apple_rtkit_crashlog_rx(struct apple_rtkit= *rtk, u64 msg) */ bfr =3D kzalloc(rtk->crashlog_buffer.size, GFP_KERNEL); if (bfr) { - apple_rtkit_memcpy(rtk, bfr, &rtk->crashlog_buffer, 0, - rtk->crashlog_buffer.size); - apple_rtkit_crashlog_dump(rtk, bfr, rtk->crashlog_buffer.size); + if (apple_rtkit_memcpy(rtk, bfr, &rtk->crashlog_buffer, 0, + rtk->crashlog_buffer.size) =3D=3D 0) + apple_rtkit_crashlog_dump(rtk, bfr, + rtk->crashlog_buffer.size); } else { dev_err(rtk->dev, "RTKit: Couldn't allocate crashlog shadow buffer\n"); @@ -428,6 +438,11 @@ static void apple_rtkit_syslog_rx_init(struct apple_rt= kit *rtk, u64 msg) rtk->syslog_n_entries =3D FIELD_GET(APPLE_RTKIT_SYSLOG_N_ENTRIES, msg); rtk->syslog_msg_size =3D FIELD_GET(APPLE_RTKIT_SYSLOG_MSG_SIZE, msg); =20 + if (rtk->syslog_msg_size =3D=3D 0) { + dev_warn(rtk->dev, "RTKit: syslog msg_size is zero\n"); + return; + } + rtk->syslog_msg_buffer =3D kzalloc(rtk->syslog_msg_size, GFP_KERNEL); =20 dev_dbg(rtk->dev, @@ -444,10 +459,11 @@ static void apple_rtkit_syslog_rx_log(struct apple_rt= kit *rtk, u64 msg) { u8 idx =3D msg & 0xff; char log_context[24]; - size_t entry_size =3D 0x20 + rtk->syslog_msg_size; + size_t entry_size; + size_t offset; int msglen; =20 - if (!rtk->syslog_msg_buffer) { + if (!rtk->syslog_msg_buffer || rtk->syslog_msg_size =3D=3D 0) { dev_warn( rtk->dev, "RTKit: received syslog message but no syslog_msg_buffer\n"); @@ -471,11 +487,16 @@ static void apple_rtkit_syslog_rx_log(struct apple_rt= kit *rtk, u64 msg) goto done; } =20 - apple_rtkit_memcpy(rtk, log_context, &rtk->syslog_buffer, - idx * entry_size + 8, sizeof(log_context)); - apple_rtkit_memcpy(rtk, rtk->syslog_msg_buffer, &rtk->syslog_buffer, - idx * entry_size + 8 + sizeof(log_context), - rtk->syslog_msg_size); + entry_size =3D 0x20 + rtk->syslog_msg_size; + offset =3D (size_t)idx * entry_size + 8; + if (apple_rtkit_memcpy(rtk, log_context, &rtk->syslog_buffer, offset, + sizeof(log_context)) < 0) + goto done; + if (apple_rtkit_memcpy(rtk, rtk->syslog_msg_buffer, + &rtk->syslog_buffer, + offset + sizeof(log_context), + rtk->syslog_msg_size) < 0) + goto done; =20 log_context[sizeof(log_context) - 1] =3D 0; =20 --=20 2.51.2 From nobody Mon Sep 28 08:45:47 2026 Received: from mail-pj1-f53.google.com (mail-pj1-f53.google.com [209.85.216.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1E308396D15 for ; Mon, 24 Aug 2026 08:27:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.53 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787560025; cv=none; b=oUbpqLKWt2HNAVETk/UDzgSL3SPgG0bT7uY1fR313IGLYgxc5uMk41bTCl/E89NQwZEQSS10WLRwEjBJbWWHeeH58bLi7vrVWKY/m2sNZDfV4JmBzfPDtGRIOxAiPvB3i4TfL931I2KQrVUjZrdnrjSJ+NeUVGdgqMeUSgx99Ec= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787560025; c=relaxed/simple; bh=b2dLsDV6tovfS12A2h3XWlDcuFM60nmNNktagNvfK6o=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=j7l0UXzq/dvP9yhpT6n9I4S+pWH4/f5yTEqvRy6fMoPueVKBmmDMnxl3TizOp+Tefvmuw63bJupa2OhO0rzosgSx6oOWyrYPDBBEmbZQZPwGTvN3yEU9jkkZo/k2hr80ULpub1G9eu60LClplTMPV4EjNZAQpxzbXwT0oWwltQ0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=NbkLa+nD; arc=none smtp.client-ip=209.85.216.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="NbkLa+nD" Received: by mail-pj1-f53.google.com with SMTP id 98e67ed59e1d1-38ec1402b05so2369385a91.2 for ; Mon, 24 Aug 2026 01:27:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787560023; x=1788164823; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=v4P4xEM9InT1ACkFaSbk9oo50Oi4Re2PcJ8ZK5DAW0k=; b=NbkLa+nD7jhGc3SU6p6HcxoMaeOegN/mK4yVUykzSQT7CdphMwwQzjFmM099TGD9w+ tbvpXsNzTYqNHDEZDZ7Np/nqO0V8bz+7BiozBDWRKJ7z4UwW/BYXf5MaheYQVq+rzaUi 5WsW9ArwvKnWe6yPVc9LDquK00M7jjPLoBdE6cv7cIcOz5d3vs1w9OkW0tadEju6S+15 lvvftesqsFpcnlbk59bKDIIDA+kPncTyWyzBcV1FNAwbm6QfXwdoEZmK1laODk8QT1YG mi8Zh7CP/3S2lhfHtYhUtm0DI10VbDm50ptATG4ILh5wnQ9FwaIA26FhP2ruMoEFg1+s QBqQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787560023; x=1788164823; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=v4P4xEM9InT1ACkFaSbk9oo50Oi4Re2PcJ8ZK5DAW0k=; b=qVjDVJFN/3c3/wvWe8KIFJXJJ6CPhP4ZE8/aQvg9AoG92j5vDAkjLFqoCDRiZ/iA9U S8EB/PgzdYJXhbWt2pFO/8L1JMRGfx/GNKscwKc/ev4FDYXQ0a4zZ5LvzwzIl0dqm7kB iVLI+BVzH78JU8lmYSnyR5h8+MFczbNvvesiB5zcJWp3BBdSOLxd2qSPksmOkgxzT8Eh 3gRDyTBuH0OlvutAJKsHihOAeWsxO4rr4puEWe5ptC8h5X28gwFRAUeEmbhMbUrARVhL le5OLFduFyVWCngEmXjZn3SJAdHDZiCRBiEdbzCLedxTMpPRPJmoNKrpW2kQPvFuL6LU wo2Q== X-Forwarded-Encrypted: i=1; AHgh+RrIe1WPHaW+HFHW2bfEtpKpdcIruz5Amw7Jq0Y/TydeusS9hln2Y6ZldpPiToQ2U5WqeZRZQL2xSA45JWI=@vger.kernel.org X-Gm-Message-State: AFuF++mDjzVRbSX6F5mVdjcTKzlx1eb2Ak0V9GrXj+IEk5axQc2BMhKc MmEdqHaQAZZQmaEp6OlLSD4b2DjIqE9QwbQTAjjKEaM721hWPIMIJfpY X-Gm-Gg: AR+sD13SyCqo+uBqz1LMD8RvdKTOAxwTbuxcjzqYuIjkxG/Z8Q4CKhuhlSjIi7iN/lx TYbg+Hv1qoIa5Jfg3rLK8ScQugKxgbmYL1A6k18S2jCKAyOYREuUlPkYjyymKXH+OvrFQKcc0P9 lxgmBTfcF9hawsJxfjuKsTC25xd0tnG7FT2FCPgXrmsms7W5dPTG05pPc7iPC+g+xz6wdzjKvr3 BUyrdo+1crUfOOQPGGg6I30zCTIsEKYH6IMZ3jQKlqNcmHMKFpTzttXvf0ov83s/yJfY9GoNGvJ U8DFopci1AyDbn/rPEpZz32j44YPCtPwwuyykzmVdsKhCsXxawR+JyPKkpaJsa1E2n+fJajfirs q6fmRytwhhca2FScfiSkABf8SnK2Br2/G873luBoZKr4jQ+HyloVuwYazoUYjbNZy6SeNY9+efx 7MrqU1Ry4vdmLAnBi2AvugCjrYcvRf6C1EzxM4aDSDBkpvfFuXtsP8bnhbkj4o8aYY5WdhNzmSn ayJypAKcV6Tyi1gXGjHUBTMLcLpUCLfH3XAZtJNul5Ozp8kGm6HJglV92pTOBwgv8nnnCJN90MI s/QVIQ30+bbJPjlpnvc9EKepiUmc184F0MsX+7uT2MqgxbrTY5yKEKcbFihKF1U2bJuzArGlZNc Q93EJWaXyv13r8LrF1Cz3KsvF/WSjix/l/VFCi38+7H9lYKU= X-Received: by 2002:a17:90b:3d8a:b0:395:4de9:b30 with SMTP id 98e67ed59e1d1-395c353e28dmr45053163a91.5.1787560023127; Mon, 24 Aug 2026 01:27:03 -0700 (PDT) Received: from localhost.localdomain ([101.251.7.10]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-327f90c0dd3sm25994595eec.7.2026.08.24.01.26.58 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Mon, 24 Aug 2026 01:27:02 -0700 (PDT) From: Laxman Acharya Padhya To: Sven Peter , Janne Grunau Cc: Neal Gompa , Arnd Bergmann , asahi@lists.linux.dev, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH v2 3/4] soc: apple: rtkit: reject syslog indices outside the entry count Date: Mon, 24 Aug 2026 14:11:39 +0545 Message-ID: <930eb129c35cdffb877b8fd16662a3250a0e2ecf.1787559303.git.acharyalaxman8848@gmail.com> X-Mailer: git-send-email 2.51.2 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" syslog_n_entries is a count, so valid indices range from zero through syslog_n_entries - 1. The current check also accepts syslog_n_entries itself. Reject that index before deriving the shared-buffer offset. The shared copy bounds check remains the final protection against inconsistent firmware-provided layouts. Fixes: 9bd1d9a0d8bb ("soc: apple: Add RTKit IPC library") Cc: stable@vger.kernel.org Signed-off-by: Laxman Acharya Padhya --- drivers/soc/apple/rtkit.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/soc/apple/rtkit.c b/drivers/soc/apple/rtkit.c index 2e62f9b3c948..da766df5a6d7 100644 --- a/drivers/soc/apple/rtkit.c +++ b/drivers/soc/apple/rtkit.c @@ -481,7 +481,7 @@ static void apple_rtkit_syslog_rx_log(struct apple_rtki= t *rtk, u64 msg) "RTKit: received syslog message but no syslog_buffer.buffer or syslog_b= uffer.iomem\n"); goto done; } - if (idx > rtk->syslog_n_entries) { + if (idx >=3D rtk->syslog_n_entries) { dev_warn(rtk->dev, "RTKit: syslog index %d out of range\n", idx); goto done; --=20 2.51.2 From nobody Mon Sep 28 08:45:47 2026 Received: from mail-pj1-f47.google.com (mail-pj1-f47.google.com [209.85.216.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 160A43AAF57 for ; Mon, 24 Aug 2026 08:27:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.47 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787560030; cv=none; b=Og6SPRQqXkQF+m6iN+MHBOJ81EgL/Jo0OuFOlswLyAB17sXKj9lAjtjBhWAou59uS8Zy5FPWWjd4uEiWZJLr64IzPiPIkXTDYMIpM2jRw5oc1TysIJ0Wzo2KzsWUNTfnobkSHXmzgTAjDTqn//5+qA6Had3dqnrhdEYAURAgwnI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787560030; c=relaxed/simple; bh=iO0WOKLJYHeCiXQSmFOX5WJAULuW7dOAGV7QorpsBUk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=s1b2NYrMKINykNRt33GSp8IMBf4wIs6+BFqAAt4/Cf8UnIUwrPuA3pIAoqyAqYRK8aH+1amQsj+T3n2wyLQD5uwnKonPKjuFpSW3prBqvX7erhhpcgrMahN5UOi6lDxdgQsKRgMAcJke/XTTc0S9kXCuSm9KOpCPq1fOW3Oa+QM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Li6i+my+; arc=none smtp.client-ip=209.85.216.47 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Li6i+my+" Received: by mail-pj1-f47.google.com with SMTP id 98e67ed59e1d1-383b4a3755fso3409256a91.3 for ; Mon, 24 Aug 2026 01:27:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787560028; x=1788164828; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=HSkAieVQa1JTe8qhVM2kCKaOCfjEKvx10b2NLcrDjss=; b=Li6i+my+RObq+pYRpLSpe5E4RzyT3+WAmEFguA7HVF2EZR2kwAVTT4XmNxwF/PdVXK hnOnp7zD0wKktcXB1Ubn1Hit4FESUEQnrXwisjlRXib5gytmLxWg5enilp/TLQw71Grp 69Qq8Bi9IKkuxyNCsMwLXthMU/8X8J440a81n13paNuJWwlIn+CZRUaL/bvaPzekmoMd o3CH8fmbieZHPMEAHMr90IJyPbmujjfttEz8gqgEOJ4BNry/A7s3Yh7GClKO3l6lVrVS k1eKSChCY5+BW1DmVzxXqnNMiwWz/rEC2rag+NXL/7r+7/oVNlAR3MB6zr6qPZmjL9pO 2BJg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787560028; x=1788164828; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=HSkAieVQa1JTe8qhVM2kCKaOCfjEKvx10b2NLcrDjss=; b=Okw44BvBiuN3p/M2XHHXh7HOj2MaOGjqQdc+I++rGxUrAWbZ0r0Ofx7PiaZ63x9ZMN uMgPW2uq3RgUExI2ItJ9rzwdzDIlQExgsD7ZH5IHnLIL7HxSYALuKwYFR6gOcUzzRW8q kWoLhJq5kBfXVPgn7AqC5kvh1udeyo87uxtw+B/T0nxT225lOibO777VYYst4dBCIoO+ UNB+qnTl0CuvcjYtKM12oZbv6gU0diuTC3qdUB2A7oOWQSk1i74jutDCylu/tr2tDTqC oJntfx4tRxHicosMGyE6ncg0AzMXw1bytgnwdwtuhQoXWLc0/iZ+1C6wBruZc0sKnQ6H Hrlw== X-Forwarded-Encrypted: i=1; AHgh+RpgrhqaUaJGts0eu+ywT/j9tJoqIkPnTI2uCTngDvbFeCmqxiMQadC5iQonuVRyvdLUXFvOxiyPGt9yLIM=@vger.kernel.org X-Gm-Message-State: AFuF++nCaP/FfhMgEBuYwHtOSZhiDxjMxkjxP8JGpNakw5XtscTa4NfQ nYnVN+NLPHwoSHtuCGnPIlDBWb0ffJG5SKnpddy3eMVlIqZLGzCBYx/JbAUi3XM6 X-Gm-Gg: AR+sD10BziK9qdgYSYOnYhlKc6cyfHnH9Ttzj0cxPExmwNvnq9FGSjj7mCtSJDxWjts yDXVT+TYxv2DvKjuGPAdQzeQR7jsrRZZv5sZTVVPiBZtbh1G4JdBHXA78tndMpLeifubdNdcvvU BQIyi0eFrHlrrNrYNk7S+O4teoZnpLrKH68fVMqv4suRhx2gcz0vrBVa/s3FFjL+5HRTwnwDr3C +XB5b8o9+2SefC5kg13Zk/B2kjLXmhzv66RQ9QKdbxmN46zMbDKV+4SrXJXEgmLrOcNeIhgqIEK EQKXvJsC4Wav4AGOx3YidWyzNFfJM61uQvLN2km0XCpX0ztiwjz64CvKIz25OhEkVcSEbFOJIUf pR3ZTo7hkTswPIcTZnNWEFDC9qkmJxMtQu0bZdjNHnYwA3LiTTDYNUo/VJ5U4qEv8Cv/Xxj0fro i+GCbxhO8mCOAsq0+O1lLUfXzB8ry7lWafyAXLMRwbTgExg6JQ4aStO3P3olifGuI2TiOovDVk3 4mFuY9dLW4YcdvD0cUuQ8MuhkwT2uv3PZHA6Pb53GDXhTwHu1Iu225Xi9scR0+72KMZrDvHIxGr O2w+L/mFjo2UaUdO6sXvdIsIyF7h3oNr33i/kKY4nftQ6U6U5zIfHSRTmvaGZm/O7Na5RQfdOwu rh9qbuQFy6h1ez9XkRqg50ijnWYAG2rnsYTEa+31S0ftbLoE= X-Received: by 2002:a17:90b:50c3:b0:395:5eec:b932 with SMTP id 98e67ed59e1d1-395c39e6433mr48365891a91.11.1787560027941; Mon, 24 Aug 2026 01:27:07 -0700 (PDT) Received: from localhost.localdomain ([101.251.7.10]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-327f90c0dd3sm25994595eec.7.2026.08.24.01.27.03 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Mon, 24 Aug 2026 01:27:07 -0700 (PDT) From: Laxman Acharya Padhya To: Sven Peter , Janne Grunau Cc: Neal Gompa , Arnd Bergmann , asahi@lists.linux.dev, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH v2 4/4] soc: apple: rtkit: rate limit malformed syslog warnings Date: Mon, 24 Aug 2026 14:11:40 +0545 Message-ID: X-Mailer: git-send-email 2.51.2 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The coprocessor can repeatedly send malformed syslog messages and flood the kernel log with warnings. Use the rate-limited warning helper for the validation failures in the syslog receive path. Fixes: 9bd1d9a0d8bb ("soc: apple: Add RTKit IPC library") Cc: stable@vger.kernel.org Signed-off-by: Laxman Acharya Padhya --- drivers/soc/apple/rtkit.c | 23 +++++++++++------------ 1 file changed, 11 insertions(+), 12 deletions(-) diff --git a/drivers/soc/apple/rtkit.c b/drivers/soc/apple/rtkit.c index da766df5a6d7..e70e3d2cfa08 100644 --- a/drivers/soc/apple/rtkit.c +++ b/drivers/soc/apple/rtkit.c @@ -439,7 +439,8 @@ static void apple_rtkit_syslog_rx_init(struct apple_rtk= it *rtk, u64 msg) rtk->syslog_msg_size =3D FIELD_GET(APPLE_RTKIT_SYSLOG_MSG_SIZE, msg); =20 if (rtk->syslog_msg_size =3D=3D 0) { - dev_warn(rtk->dev, "RTKit: syslog msg_size is zero\n"); + dev_warn_ratelimited(rtk->dev, + "RTKit: syslog msg_size is zero\n"); return; } =20 @@ -464,26 +465,24 @@ static void apple_rtkit_syslog_rx_log(struct apple_rt= kit *rtk, u64 msg) int msglen; =20 if (!rtk->syslog_msg_buffer || rtk->syslog_msg_size =3D=3D 0) { - dev_warn( - rtk->dev, - "RTKit: received syslog message but no syslog_msg_buffer\n"); + dev_warn_ratelimited(rtk->dev, + "RTKit: received syslog message but no syslog_msg_buffer\n"); goto done; } if (!rtk->syslog_buffer.size) { - dev_warn( - rtk->dev, - "RTKit: received syslog message but syslog_buffer.size is zero\n"); + dev_warn_ratelimited(rtk->dev, + "RTKit: received syslog message but syslog_buffer.size is zero\n"= ); goto done; } if (!rtk->syslog_buffer.buffer && !rtk->syslog_buffer.iomem) { - dev_warn( - rtk->dev, - "RTKit: received syslog message but no syslog_buffer.buffer or syslog_b= uffer.iomem\n"); + dev_warn_ratelimited(rtk->dev, + "RTKit: received syslog message but no syslog_buffer.buffer or sy= slog_buffer.iomem\n"); goto done; } if (idx >=3D rtk->syslog_n_entries) { - dev_warn(rtk->dev, "RTKit: syslog index %d out of range\n", - idx); + dev_warn_ratelimited(rtk->dev, + "RTKit: syslog index %d out of range\n", + idx); goto done; } =20 --=20 2.51.2