]> git.baikalelectronics.ru Git - kernel.git/commit
bus: mhi: core: Sanity check values from remote device before use
authorJeffrey Hugo <jhugo@codeaurora.org>
Wed, 10 Mar 2021 21:30:55 +0000 (14:30 -0700)
committerManivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Thu, 8 Apr 2021 06:27:38 +0000 (11:57 +0530)
commitdd0590f66cb522f61a9c8a9822f5f8208bcdd715
treeb4e595d1681ab4560fc99b3dfb345bed0d88707e
parentc2decfb4b86b702386fa508919782e4237317c51
bus: mhi: core: Sanity check values from remote device before use

When parsing the structures in the shared memory, there are values which
come from the remote device.  For example, a transfer completion event
will have a pointer to the tre in the relevant channel's transfer ring.
As another example, event ring elements may specify a channel in which
the event occurred, however the specified channel value may not be valid
as no channel is defined at that index even though the index may be less
than the maximum allowed index.  Such values should be considered to be
untrusted, and validated before use.  If we blindly use such values, we
may access invalid data or crash if the values are corrupted.

If validation fails, drop the relevant event.

Signed-off-by: Jeffrey Hugo <jhugo@codeaurora.org>
Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Reviewed-by: Hemant Kumar <hemantk@codeaurora.org>
Link: https://lore.kernel.org/r/1615411855-15053-1-git-send-email-jhugo@codeaurora.org
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
drivers/bus/mhi/core/main.c