remoteproc: mtk_scp: Fix bounds checks in da_to_va callbacks
Status from this message: Applied.
Get series with b4
b4 am [email protected]Versions newest first
Patches in v1 Applied
| # | Subject and files | Size | Replies | Applied |
|---|---|---|---|---|
| 1/2 | remoteproc: mtk_scp: Fix bounds check in mt8183_scp_da_to_va()drivers/ | +5 | 0 replies | |
| 2/2 | remoteproc: mtk_scp: Fix bounds check in mt8192_scp_da_to_va()drivers/ | +12 | 0 replies |
Reviews trailers per patch
No Reviewed-by, Acked-by or Tested-by trailers for v1 yet.
Cover letter [PATCH 0/2] remoteproc: mtk_scp: Fix bounds checks in da_to_va callbacks
mt8183_scp_da_to_va() and mt8192_scp_da_to_va() validate the device address and length that the ELF loader passes in from the firmware's program headers. Both checks can be bypassed through integer truncation or wraparound. These two patches fix them with overflow-safe comparisons.
The fixes have different origin commits, so they are split for stable backporting.
Compile tested only (arm64 defconfig, W=1). Not tested on hardware.
Atul Akella (2):
remoteproc: mtk_scp: Fix bounds check in mt8183_scp_da_to_va()
remoteproc: mtk_scp: Fix bounds check in mt8192_scp_da_to_va()
drivers/remoteproc/mtk_scp.c | 32 +++++++++++++++++--------------- 1 file changed, 17 insertions(+), 15 deletions(-)
Signature · 1 line
2.43.0