From: Jeffrey Hugo <jhugo@codeaurora.org>
To: Bhaumik Bhatt <bbhatt@codeaurora.org>, mani@kernel.org
Cc: linux-arm-msm@vger.kernel.org, linux-kernel@vger.kernel.org,
hemantk@codeaurora.org
Subject: Re: [PATCH v3 4/9] bus: mhi: core: Read transfer length from an event properly
Date: Thu, 30 Apr 2020 08:28:14 -0600 [thread overview]
Message-ID: <05f6a503-3639-b55d-3c22-1c6d1617093c@codeaurora.org> (raw)
In-Reply-To: <1588193551-31439-5-git-send-email-bbhatt@codeaurora.org>
On 4/29/2020 2:52 PM, Bhaumik Bhatt wrote:
> From: Hemant Kumar <hemantk@codeaurora.org>
>
> When MHI Driver receives an EOT event, it reads xfer_len from the
> event in the last TRE. The value is under control of the MHI device
> and never validated by Host MHI driver. The value should never be
> larger than the real size of the buffer but a malicious device can
> set the value 0xFFFF as maximum. This causes driver to memory
> overflow (both read or write). Fix this issue by reading minimum of
> transfer length from event and the buffer length provided.
>
> Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
> Signed-off-by: Bhaumik Bhatt <bbhatt@codeaurora.org>
> ---
Reviewed-by: Jeffrey Hugo <jhugo@codeaurora.org>
--
Jeffrey Hugo
Qualcomm Technologies, Inc. is a member of the
Code Aurora Forum, a Linux Foundation Collaborative Project.
next prev parent reply other threads:[~2020-04-30 14:28 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-04-29 20:52 [PATCH v3 0/9] Bug fixes and improved logging in MHI Bhaumik Bhatt
2020-04-29 20:52 ` [PATCH v3 1/9] bus: mhi: core: Refactor mhi queue APIs Bhaumik Bhatt
2020-04-30 14:22 ` Jeffrey Hugo
2020-04-29 20:52 ` [PATCH v3 2/9] bus: mhi: core: Cache intmod from mhi event to mhi channel Bhaumik Bhatt
2020-04-30 14:23 ` Jeffrey Hugo
2020-04-29 20:52 ` [PATCH v3 3/9] bus: mhi: core: Add range check for channel id received in event ring Bhaumik Bhatt
2020-04-30 14:26 ` Jeffrey Hugo
2020-04-29 20:52 ` [PATCH v3 4/9] bus: mhi: core: Read transfer length from an event properly Bhaumik Bhatt
2020-04-30 14:28 ` Jeffrey Hugo [this message]
2020-04-29 20:52 ` [PATCH v3 5/9] bus: mhi: core: Handle firmware load using state worker Bhaumik Bhatt
2020-04-30 14:50 ` Jeffrey Hugo
2020-04-29 20:52 ` [PATCH v3 6/9] bus: mhi: core: WARN_ON for malformed vector table Bhaumik Bhatt
2020-04-30 15:02 ` Jeffrey Hugo
2020-05-02 2:38 ` bbhatt
2020-04-29 20:52 ` [PATCH v3 7/9] bus: mhi: core: Return appropriate error codes for AMSS load failure Bhaumik Bhatt
2020-04-30 15:03 ` Jeffrey Hugo
2020-04-29 20:52 ` [PATCH v3 8/9] bus: mhi: core: Improve debug logs for loading firmware Bhaumik Bhatt
2020-04-30 15:06 ` Jeffrey Hugo
2020-04-29 20:52 ` [PATCH v3 9/9] bus: mhi: core: Ensure non-zero session or sequence ID values Bhaumik Bhatt
2020-04-30 15:12 ` Jeffrey Hugo
2020-05-02 2:33 ` bbhatt
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=05f6a503-3639-b55d-3c22-1c6d1617093c@codeaurora.org \
--to=jhugo@codeaurora.org \
--cc=bbhatt@codeaurora.org \
--cc=hemantk@codeaurora.org \
--cc=linux-arm-msm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mani@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.