From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-yx1-f49.google.com (mail-yx1-f49.google.com [74.125.224.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7338B390205 for ; Mon, 18 May 2026 19:08:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.224.49 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779131283; cv=none; b=Az6e6y4FKDWEZL0zAqPlNkl9rXi2K2xC0X9pNN4jxrs2thMqymO2oklZI8ClKZCQiRAIAJ0nzatRhGC68CPjuoMNVCLfikyBKED+vPYCl11DUmEEfwXIIbQZPNKrOn5Fcrb9y2/PXGufmb9ipije/h/bJNYe4m2aOYIZPqlGoQA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779131283; c=relaxed/simple; bh=lr/Il1RBfm+qfe8Cae/ztCEpMom3cE9zLIvaGjdLVQc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=PpSSEZUAnkHmj0Tvl47CGF6F1pGvJjWD3vcPx4U2XLGv/rJjfGHzZSyrw7T8MKCnQW/1k79/LSIzxp9kgrkFvwIsKIyYnUGnrzeO0jzwQrsUJRHbjjNExDp0Md9KmXEv19wkwy9MhZ7fCDMuvuBh+EnHH2p7v/r8O4/mhjKsX+k= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=ZQLMv2vJ; arc=none smtp.client-ip=74.125.224.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="ZQLMv2vJ" Received: by mail-yx1-f49.google.com with SMTP id 956f58d0204a3-651c5d525f6so2747693d50.3 for ; Mon, 18 May 2026 12:08:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1779131281; x=1779736081; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=EBDXdrLaiJs5mJCkZrMnLOovecApXs5qp8DhmlH8DV4=; b=ZQLMv2vJV6e7TEn0C29mqs3kXyWUO0kZyvS5woroyiWejXY7rUwIRpMUE4mf2tG0lC NUcPY/TkBxe9B5qfOUKCwniQBnPlXuOu0fuM8GeDf1gIPF9RsHe62uR42OiU1RCC3EfM ZpafBQC+AARdBj+gIJmP9dOJ7j+1ESfoa/khA99ZD3w6boT+jZxaxrIiM4Zhqw88wcLL 4RkmWqMDCYKP3cdEfoRnaxDcuM8pC1GMZHSROtk2ipSLYfEWLp9Fw6tWvZf2r0YcpYwr TjwdkQoyPFCtZANxiQ30pIBaYhtneedlJvYfqNf1ia2+oDL7FwWnQrBSueJzbH70Wlnx Sgsg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779131281; x=1779736081; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=EBDXdrLaiJs5mJCkZrMnLOovecApXs5qp8DhmlH8DV4=; b=TOaAhCsXjF58bLVGaj7Wynfyb5KEEVdeCREj6l5/ZNSHPNpt6R765bVzmzIoa2efXo BIEhl6OFV6pBsKrI/x8UwhBTKidviRmVSXnmFhJWB4S7LsYrAzC4TQIEK4OLDge4o1/+ NHUg4baQpfJ5GiXE14jZToqFCL542U7f7QNfcUcGGJ7jBVIWP2XQmQLZAauzTsU/p2zE zyl9BFGKHghxZi6JxQgYsCXSCkYwrqi1gSUjt0SgZfZqK5QZwqNvVmHtXhElg6Ruq8a7 lZSk+UbK0zXNXCUF3QZ5G1dyKmEKK1eytcHZcvDm7P0J844Z2sHnkqQ6jRcTJr5h5vTf bNTg== X-Forwarded-Encrypted: i=1; AFNElJ8RJGdaNBWbSnVp9A+xjQ/plVFcVeAdQX4hxrU7MwftdNxahlkv47VuSpNbVC7YyvCTuQsPqYZSLFiDKnw=@vger.kernel.org X-Gm-Message-State: AOJu0YxIS6Iy+9SztdGd/Px4rFk27Ghs3QnYdMoH1aiNEecNSX7XgEVn VDi13ii27W+98zh1SVEbVgHst6f95pMezF5zly+806UipppZ37rcHZOH X-Gm-Gg: Acq92OF9KQstCglvK6SXbLOa7ut3wan19wXMNahl0UfToC7TGfEuvOkYp8+oCg9s1Fj rn9P2o/JjCn1gg/HQ0HnJ390FirwQ965sHj29s0bMMoiYGtHOyGZBcKiedASSZ3odiYt5Zpx8GY D3oqI96Dngn53KbsPzdJ/zuOZuPlPE7dl4CLvc40fh+ozg1WJHbrrWf9Cc0qE7jQVr2OdFYRI5e Y4P1/A83g/IlfxWzd4GKZoQuRVhvuVMpwndruJ+NAcywcuGJly1/TxhgVgYbvN5RZ9PLozf9wEV Z/EwWMiE7cPeBCrZrvwWlVRyHCFsTgEfvLwksbWPawP1/fL/bg5j74SeTVWtL3ESF8s44vqVSAY VfPNpL5gZGEzs/YIFIsrZDZBNDIyHH6q8j8O7hw7WLg2Ur4sx0r1FwtvNuWZXuAiS2fg0ZzWbVc m2dbvvxuththhfg6jOMz956wMLx8kqqvX49VMFTmLDzUJvrJr1u/Am8XSrwYKlHOdJzhW7VcfKj /SIK2+tYJq1AdwKidpuShDUyTw= X-Received: by 2002:a53:d045:0:10b0:651:c734:ed4b with SMTP id 956f58d0204a3-65e22686be3mr13638970d50.2.1779131281317; Mon, 18 May 2026 12:08:01 -0700 (PDT) Received: from localhost.localdomain ([186.151.100.108]) by smtp.gmail.com with ESMTPSA id 956f58d0204a3-65e0db0b11esm6766160d50.11.2026.05.18.12.07.59 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 18 May 2026 12:08:00 -0700 (PDT) From: Sebastian Alba Vives To: yilun.xu@linux.intel.com, gregkh@linuxfoundation.org Cc: linux-fpga@vger.kernel.org, conor.dooley@microchip.com, mdf@kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Sebastian Alba Vives Subject: [PATCH v8 1/3] fpga: dfl: add bounds check in dfh_get_param_size() Date: Mon, 18 May 2026 13:07:40 -0600 Message-ID: <20260518190742.61426-2-sebasjosue84@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260518190742.61426-1-sebasjosue84@gmail.com> References: <20260518190742.61426-1-sebasjosue84@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit dfh_get_param_size() can return a parameter size larger than the feature region because the loop bounds check is evaluated before incrementing size. If the EOP (End of Parameters) bit is set in the same iteration, the inflated size is returned without re-validation against max. This can cause create_feature_instance() to call memcpy_fromio() with a size exceeding the ioremap'd region when a malicious FPGA device provides crafted DFHv1 parameter headers. Add a bounds check after the size increment to ensure the accumulated size never exceeds the feature boundary. Fixes: 4747ab89b4a6 ("fpga: dfl: add basic support for DFHv1") Cc: stable@vger.kernel.org Signed-off-by: Sebastian Alba Vives --- Changes in v8: - Add Cc: stable tag. Reported by Greg Kroah-Hartman. Changes in v7: - Correct the Fixes: tag commit hash (checkpatch). Reported by Xu Yilun. Changes in v6: - Rebase onto linux-next. Add cover letter. Suggested by Xu Yilun. Changes in v5: - Add blank line after the new bounds check. Suggested by Xu Yilun. --- drivers/fpga/dfl.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/fpga/dfl.c b/drivers/fpga/dfl.c index 4087a36a0..4c63c7c85 100644 --- a/drivers/fpga/dfl.c +++ b/drivers/fpga/dfl.c @@ -1132,6 +1132,8 @@ static int dfh_get_param_size(void __iomem *dfh_base, resource_size_t max) return -EINVAL; size += next * sizeof(u64); + if (size > max) + return -EINVAL; if (FIELD_GET(DFHv1_PARAM_HDR_NEXT_EOP, v)) return size; -- 2.43.0