All of lore.kernel.org
 help / color / mirror / Atom feed
From: Cristian Marussi <cristian.marussi@arm.com>
To: linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org
Cc: sudeep.holla@arm.com, cristian.marussi@arm.com
Subject: [PATCH 4/6] firmware: arm_scmi: Harden accesses to Reset domains
Date: Wed, 17 Aug 2022 18:27:29 +0100	[thread overview]
Message-ID: <20220817172731.1185305-5-cristian.marussi@arm.com> (raw)
In-Reply-To: <20220817172731.1185305-1-cristian.marussi@arm.com>

Accessing Reset domains descriptors by index upon SCMI drivers requests
through the SCMI reset operations interface can potentially lead to
out-of-bound violations if the SCMI driver misbehave.

Add an internal consistency check in front of such domains descriptors
accesses.

Fixes: 95a15d80aa0de ("firmware: arm_scmi: Add RESET protocol in SCMI v2.0")
Signed-off-by: Cristian Marussi <cristian.marussi@arm.com>
---
 drivers/firmware/arm_scmi/reset.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/firmware/arm_scmi/reset.c b/drivers/firmware/arm_scmi/reset.c
index 673f3eb498f4..b0494165b1cb 100644
--- a/drivers/firmware/arm_scmi/reset.c
+++ b/drivers/firmware/arm_scmi/reset.c
@@ -166,8 +166,12 @@ static int scmi_domain_reset(const struct scmi_protocol_handle *ph, u32 domain,
 	struct scmi_xfer *t;
 	struct scmi_msg_reset_domain_reset *dom;
 	struct scmi_reset_info *pi = ph->get_priv(ph);
-	struct reset_dom_info *rdom = pi->dom_info + domain;
+	struct reset_dom_info *rdom;
 
+	if (domain >= pi->num_domains)
+		return -EINVAL;
+
+	rdom = pi->dom_info + domain;
 	if (rdom->async_reset)
 		flags |= ASYNCHRONOUS_RESET;
 
-- 
2.32.0


WARNING: multiple messages have this Message-ID (diff)
From: Cristian Marussi <cristian.marussi@arm.com>
To: linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org
Cc: sudeep.holla@arm.com, cristian.marussi@arm.com
Subject: [PATCH 4/6] firmware: arm_scmi: Harden accesses to Reset domains
Date: Wed, 17 Aug 2022 18:27:29 +0100	[thread overview]
Message-ID: <20220817172731.1185305-5-cristian.marussi@arm.com> (raw)
In-Reply-To: <20220817172731.1185305-1-cristian.marussi@arm.com>

Accessing Reset domains descriptors by index upon SCMI drivers requests
through the SCMI reset operations interface can potentially lead to
out-of-bound violations if the SCMI driver misbehave.

Add an internal consistency check in front of such domains descriptors
accesses.

Fixes: 95a15d80aa0de ("firmware: arm_scmi: Add RESET protocol in SCMI v2.0")
Signed-off-by: Cristian Marussi <cristian.marussi@arm.com>
---
 drivers/firmware/arm_scmi/reset.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/firmware/arm_scmi/reset.c b/drivers/firmware/arm_scmi/reset.c
index 673f3eb498f4..b0494165b1cb 100644
--- a/drivers/firmware/arm_scmi/reset.c
+++ b/drivers/firmware/arm_scmi/reset.c
@@ -166,8 +166,12 @@ static int scmi_domain_reset(const struct scmi_protocol_handle *ph, u32 domain,
 	struct scmi_xfer *t;
 	struct scmi_msg_reset_domain_reset *dom;
 	struct scmi_reset_info *pi = ph->get_priv(ph);
-	struct reset_dom_info *rdom = pi->dom_info + domain;
+	struct reset_dom_info *rdom;
 
+	if (domain >= pi->num_domains)
+		return -EINVAL;
+
+	rdom = pi->dom_info + domain;
 	if (rdom->async_reset)
 		flags |= ASYNCHRONOUS_RESET;
 
-- 
2.32.0


_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

  parent reply	other threads:[~2022-08-17 17:28 UTC|newest]

Thread overview: 16+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-08-17 17:27 [PATCH 0/6] Misc fixes for v5.20 Cristian Marussi
2022-08-17 17:27 ` Cristian Marussi
2022-08-17 17:27 ` [PATCH 1/6] firmware: arm_scmi: Fix missing kernel-doc in optee Cristian Marussi
2022-08-17 17:27   ` Cristian Marussi
2022-08-17 17:27 ` [PATCH 2/6] firmware: arm_scmi: Improve checks on .info_get operations Cristian Marussi
2022-08-17 17:27   ` Cristian Marussi
2022-08-17 17:27 ` [PATCH 3/6] firmware: arm_scmi: Harden accesses to Sensor domains Cristian Marussi
2022-08-17 17:27   ` Cristian Marussi
2022-08-17 17:27 ` Cristian Marussi [this message]
2022-08-17 17:27   ` [PATCH 4/6] firmware: arm_scmi: Harden accesses to Reset domains Cristian Marussi
2022-08-17 17:27 ` [PATCH 5/6] firmware: arm_scmi: Fix asynchronous reset requests Cristian Marussi
2022-08-17 17:27   ` Cristian Marussi
2022-08-17 17:27 ` [PATCH 6/6] [RFC] firmware: arm_scmi: Add SCMI PM driver remove routine Cristian Marussi
2022-08-17 17:27   ` Cristian Marussi
2022-08-31 13:25 ` [PATCH 0/6] Misc fixes for v5.20 Sudeep Holla
2022-08-31 13:25   ` Sudeep Holla

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20220817172731.1185305-5-cristian.marussi@arm.com \
    --to=cristian.marussi@arm.com \
    --cc=linux-arm-kernel@lists.infradead.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=sudeep.holla@arm.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.