evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

qseecom: check buffer size when loading firmware images

Browse source 
Make change in __qseecom_load_fw() and qseecom_load_commonlib_image()
to check buffer size before copying img to buffer.

CRs-fixed: 1080290
Change-Id: I0f48666ac948a9571e249598ae7cc19df9036b1d
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
This commit is contained in:
Zhen Kong 2016-10-20 17:34:20 -07:00 • committed by Gerrit - the friendly Code Review server
parent 5b7da25887
commit ecd28536e3
1 changed files with 27 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

32
drivers/misc/qseecom.c
View file

@ -3591,7 +3591,7 @@ static bool __qseecom_is_fw_image_valid(const struct firmware *fw_entry)
return true; return true;
} }
static int __qseecom_get_fw_size(char *appname, uint32_t *fw_size, static int __qseecom_get_fw_size(const char *appname, uint32_t *fw_size,
uint32_t *app_arch) uint32_t *app_arch)
{ {
int ret = -1; int ret = -1;
@ -3629,14 +3629,21 @@ static int __qseecom_get_fw_size(char *appname, uint32_t *fw_size,
} }
pr_debug("QSEE %s app, arch %u\n", appname, *app_arch); pr_debug("QSEE %s app, arch %u\n", appname, *app_arch);
release_firmware(fw_entry); release_firmware(fw_entry);
fw_entry = NULL;
for (i = 0; i < num_images; i++) { for (i = 0; i < num_images; i++) {
memset(fw_name, 0, sizeof(fw_name)); memset(fw_name, 0, sizeof(fw_name));
snprintf(fw_name, ARRAY_SIZE(fw_name), "%s.b%02d", appname, i); snprintf(fw_name, ARRAY_SIZE(fw_name), "%s.b%02d", appname, i);
ret = request_firmware(&fw_entry, fw_name, qseecom.pdev); ret = request_firmware(&fw_entry, fw_name, qseecom.pdev);
if (ret) if (ret)
goto err; goto err;
if (*fw_size > U32_MAX - fw_entry->size) {
pr_err("QSEE %s app file size overflow\n", appname);
ret = -EINVAL;
goto err;
}
*fw_size += fw_entry->size; *fw_size += fw_entry->size;
release_firmware(fw_entry); release_firmware(fw_entry);
fw_entry = NULL;
} }
return ret; return ret;
@ -3647,8 +3654,9 @@ err:
return ret; return ret;
} }
static int __qseecom_get_fw_data(char *appname, u8 *img_data, static int __qseecom_get_fw_data(const char *appname, u8 *img_data,
struct qseecom_load_app_ireq *load_req) uint32_t fw_size,
struct qseecom_load_app_ireq *load_req)
{ {
int ret = -1; int ret = -1;
int i = 0, rc = 0; int i = 0, rc = 0;
@ -3668,6 +3676,12 @@ static int __qseecom_get_fw_data(char *appname, u8 *img_data,
} }
load_req->img_len = fw_entry->size; load_req->img_len = fw_entry->size;
if (load_req->img_len > fw_size) {
pr_err("app %s size %zu is larger than buf size %u\n",
appname, fw_entry->size, fw_size);
ret = -EINVAL;
goto err;
}
memcpy(img_data_ptr, fw_entry->data, fw_entry->size); memcpy(img_data_ptr, fw_entry->data, fw_entry->size);
img_data_ptr = img_data_ptr + fw_entry->size; img_data_ptr = img_data_ptr + fw_entry->size;
load_req->mdt_len = fw_entry->size; /*Get MDT LEN*/ load_req->mdt_len = fw_entry->size; /*Get MDT LEN*/
@ -3686,6 +3700,7 @@ static int __qseecom_get_fw_data(char *appname, u8 *img_data,
goto err; goto err;
} }
release_firmware(fw_entry); release_firmware(fw_entry);
fw_entry = NULL;
for (i = 0; i < num_images; i++) { for (i = 0; i < num_images; i++) {
snprintf(fw_name, ARRAY_SIZE(fw_name), "%s.b%02d", appname, i); snprintf(fw_name, ARRAY_SIZE(fw_name), "%s.b%02d", appname, i);
ret = request_firmware(&fw_entry, fw_name, qseecom.pdev); ret = request_firmware(&fw_entry, fw_name, qseecom.pdev);
@ -3693,10 +3708,17 @@ static int __qseecom_get_fw_data(char *appname, u8 *img_data,
pr_err("Failed to locate blob %s\n", fw_name); pr_err("Failed to locate blob %s\n", fw_name);
goto err; goto err;
} }
if ((fw_entry->size > U32_MAX - load_req->img_len) ||
(fw_entry->size + load_req->img_len > fw_size)) {
pr_err("Invalid file size for %s\n", fw_name);
ret = -EINVAL;
goto err;
}
memcpy(img_data_ptr, fw_entry->data, fw_entry->size); memcpy(img_data_ptr, fw_entry->data, fw_entry->size);
img_data_ptr = img_data_ptr + fw_entry->size; img_data_ptr = img_data_ptr + fw_entry->size;
load_req->img_len += fw_entry->size; load_req->img_len += fw_entry->size;
release_firmware(fw_entry); release_firmware(fw_entry);
fw_entry = NULL;
} }
return ret; return ret;
err: err:
@ -3801,7 +3823,7 @@ static int __qseecom_load_fw(struct qseecom_dev_handle *data, char *appname)
if (ret) if (ret)
return ret; return ret;
ret = __qseecom_get_fw_data(appname, img_data, &load_req); ret = __qseecom_get_fw_data(appname, img_data, fw_size, &load_req);
if (ret) { if (ret) {
ret = -EIO; ret = -EIO;
goto exit_free_img_data; goto exit_free_img_data;
@ -3922,7 +3944,7 @@ static int qseecom_load_commonlib_image(struct qseecom_dev_handle *data,
if (ret) if (ret)
return -EIO; return -EIO;
ret = __qseecom_get_fw_data(cmnlib_name, img_data, &load_req); ret = __qseecom_get_fw_data(cmnlib_name, img_data, fw_size, &load_req);
if (ret) { if (ret) {
ret = -EIO; ret = -EIO;
goto exit_free_img_data; goto exit_free_img_data;