From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1E279423EB6 for ; Mon, 20 Jul 2026 13:29:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784554145; cv=none; b=gw4XhmN1s7GJ2abxZeC7SK+/U/AbWPKdZJXRb97b78uyhskKNZixy7uLjHuqEtjTf78LOCP6RDdt4bEAToBPvTI0mSkZFOyn0PgxsaX2jtssxUH87tKSPFJ9Gl3aq+fYG2o9bGdoezk9zAPSwy3ZQhAW+SteMFG2RWyXHm7AKBU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784554145; c=relaxed/simple; bh=f1RJ74a76PW53KK+1xdt52Qum59vHAAPDpQ+wyRWZLE=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=omVpzHmCthI1cvaoZzQLddObZBWQTmkKsa2Y7SrzE2mokRutftBxPZrcXeOvpULfPH3hWrjQWO7rPxJnOORcjEgwmz8GQWJMOq3fYjiDq9VZ8hyA8PHaUIpTNv6w6cHs1cCvULbi5gzintjxIA/7qJmDT49VhjR3Dnikv9MmHKA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=hxH3DvR/; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=LmzIRkB9; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="hxH3DvR/"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="LmzIRkB9" Received: from pps.filterd (m0279873.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66KAvmUx2277812 for ; Mon, 20 Jul 2026 13:29:03 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= tSAwREJ9fN+/n5hiVtWkjLEHl1v3XArrjXhPEVMyZvw=; b=hxH3DvR/TKs7tSd3 LCfkDOwqsZppI/Wivpx2IqG3PwpCwSCdunjlAiuH+hH31zlkzMezp9u9/BClSVLc 7ZeE+WEaqPgAdQzqWQdkbCSQPA8XD8GT6mYBeQjR3fnKaLu+eGUTRZJ+t/X39RCv w6+3iWSq36F72kwE3CNPU0PfqsLdhFDcMeRFfPl+nN/KeDI/3VVC+oCraDxBe17k DNFXTQDtatXmyEWswDTq5Pg3BYiq/WlVxkk1M6Nd1/OaedPRDYjc2VX2E4371sm1 A31o2yYBO4mvach4I2CKTwaPbOiE9N7KVsDL47ojmSmY9cP1DXz3xq1eq9buzlwr xlQ0Ew== Received: from mail-pf1-f197.google.com (mail-pf1-f197.google.com [209.85.210.197]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4fhf0c1nd9-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Mon, 20 Jul 2026 13:29:02 +0000 (GMT) Received: by mail-pf1-f197.google.com with SMTP id d2e1a72fcca58-84a651759a2so12639150b3a.3 for ; Mon, 20 Jul 2026 06:29:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1784554142; x=1785158942; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=tSAwREJ9fN+/n5hiVtWkjLEHl1v3XArrjXhPEVMyZvw=; b=LmzIRkB9QEhhYVolTZyA0BoO1e/KxyoaBHH6O0PfftbHX7PpVLST5I4edMIXWNDs40 PGn+NT5fCSk6daAiEgOh0nuHfmWtQFYWEmltzDxngKw0J+q2fI8b2LZtIZ5k+WdltYJL CBTbkbY2JJabKtUltXYe+jkJquEeRKTFxlXFtfdOmlFuVf/SKNGNLmoi2sCuYqPfwPSG eMkkF4NZpYkJKZdaZ/mcc89zJHQOY7Nl1cODefU8z7R3k+esy87Hlafl6SVa5TpGvNj1 lP1lalpBH1XTxQL4y0/GBxHf+98YqAWmDv3cu0NGIq4YopmAt/pOT1HyLZB/iF2VNsvY o1YA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784554142; x=1785158942; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=tSAwREJ9fN+/n5hiVtWkjLEHl1v3XArrjXhPEVMyZvw=; b=Q15PWk8i9MVMCrsQoneVFMWHpTfHLgSa+PA8RX8htLAaWK7iWHuYJPMrC/qexX1Jd7 CzhccJJFRqZ1ojcVLLNC5YScrOvrfWBNAI2UpxzVXiFl07+bE89RXrjgiJHeGWWWuOA/ bgl1ztVmToyWpHMIduttqeVFESaFdqUOkCAJWe/ym7ZzouLJmy0X1c3CGIYM4cawh7yR nYyOs2SygT0IGvotYhyp3HRcnRLx5uKfvEPgmvy3kqZNUOUoG5H6Lv2Ja2bPOaa7UIQ1 flHRfIASA9mizDw5cwKiG1RklBdqmn6orW93N9TjuH1sm1gYsru2EPy5WzCBS4nA+ry3 HHGw== X-Forwarded-Encrypted: i=1; AHgh+Rr0K99wqtSdDD40C9h9son4RFFzzyL0pSlPj9nzNvSyo03i4Ct1OT+7cGFmLMxFbjz0FKRaRTJMQaiwZwY=@vger.kernel.org X-Gm-Message-State: AOJu0YxEueCLohtxs1xIZXQOCiQSw0NxOvkUiuHzxyXX9ALrpEtLWe+A V/RQXifrtQmweBCHjybFPfd9FPlpWbDMOfCLxUWxWtkpDV9yrheNwXlSoigxUrl3NNxf8HZtB10 zSpr/M5dIACjuyV8qvA1KjtqlZFstwVqsK5seQn1OryOnt8c3+uWmdgZ3klvFWOXAqAE= X-Gm-Gg: AfdE7clrdoEQmzsW/SrvL0R8uTiNOJH3E2moa8gN/m8QHf6gDDIfqLRoDB9k9JXskhw bwXEl3mUTKX2+xcQknqHyAizfBaSME3FU+5M4UOWtjOJOc4rKUcVOSbnKN0MeV4hk1NxSwxea+e HUg8PMhtm4DTgoj62VnT6PdBGFTwa+Tk/IswQMwmW+tralG38qPJGHJ85+4sFIi7tWjPGARt+v8 tI0xdsjKmiSr9riw0KytJcfMMLsHwZ1Paf18ZaC2c8WAFJFs68/eeF7Tp1JQePMHIDCkEQ+JC/J lMoo4rt/Hlu9kMv7dnlQpl0znuO6+pO9USKw1hTlQkInCpTOLy/6OWAWHDrSnBBEUuwBogyhitg BtxDNqfZim2ylAvB47BBb7IsBaD7b8LxfS1nTre4RzDMReFDqdKVtvt1X3PwLCeeJBUFrUuo= X-Received: by 2002:a05:6a00:3cd3:b0:848:788a:e7f9 with SMTP id d2e1a72fcca58-84c292b4922mr14094472b3a.18.1784554141888; Mon, 20 Jul 2026 06:29:01 -0700 (PDT) X-Received: by 2002:a05:6a00:3cd3:b0:848:788a:e7f9 with SMTP id d2e1a72fcca58-84c292b4922mr14094431b3a.18.1784554141294; Mon, 20 Jul 2026 06:29:01 -0700 (PDT) Received: from CHUNKAID2.ap.qualcomm.com (tpe-colo-wan-fw-bordernet.qualcomm.com. [103.229.16.4]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-84c2af6e3e0sm5628822b3a.43.2026.07.20.06.28.58 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 20 Jul 2026 06:29:01 -0700 (PDT) From: Chunkai Deng Date: Mon, 20 Jul 2026 21:25:53 +0800 Subject: [PATCH v3 2/2] rpmsg: glink: smem: Validate FIFO indices before use Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20260720-rpmsg-improvements-v3-2-e7b6070186bd@oss.qualcomm.com> References: <20260720-rpmsg-improvements-v3-0-e7b6070186bd@oss.qualcomm.com> In-Reply-To: <20260720-rpmsg-improvements-v3-0-e7b6070186bd@oss.qualcomm.com> To: Bjorn Andersson , Mathieu Poirier Cc: linux-arm-msm@vger.kernel.org, linux-remoteproc@vger.kernel.org, linux-kernel@vger.kernel.org, chris.lew@oss.qualcomm.com, tony.truong@oss.qualcomm.com, dmitry.baryshkov@oss.qualcomm.com, Chunkai Deng , stable@vger.kernel.org X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1784554132; l=3666; i=chunkai.deng@oss.qualcomm.com; s=20260512; h=from:subject:message-id; bh=f1RJ74a76PW53KK+1xdt52Qum59vHAAPDpQ+wyRWZLE=; b=nCxSZFKsWJ+VWDLc/mo34bGZi2uJ8GrpAYX2ilml05yN9poLI9eKKjCiD1aUKcHmNoyq6aMFx jpA14otxz5/DOcou81CLBHLzFm1o1aw9YWc7aFX2UoKnXwWxBeN1Jxk X-Developer-Key: i=chunkai.deng@oss.qualcomm.com; a=ed25519; pk=NfifEElkZxgJ0ghUBxNu1RTaEqtoCGYDb0k5UzIRXOY= X-Authority-Analysis: v=2.4 cv=HeYkiCE8 c=1 sm=1 tr=0 ts=6a5e229e cx=c_pps a=rEQLjTOiSrHUhVqRoksmgQ==:117 a=nuhDOHQX5FNHPW3J6Bj6AA==:17 a=IkcTkHD0fZMA:10 a=RAioF0-LDSMA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=rJkE3RaqiGZ5pbrm-msn:22 a=VwQbUJbxAAAA:8 a=EUspDBNiAAAA:8 a=q5iom6PKYtt-AqbUL74A:9 a=QEXdDO2ut3YA:10 a=2VI0MkxyNR6bbpdq8BZq:22 X-Proofpoint-GUID: FFxzyuR2FVdTJq4h6GsTA_FUrQrxIShW X-Proofpoint-ORIG-GUID: FFxzyuR2FVdTJq4h6GsTA_FUrQrxIShW X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIwMDE1MCBTYWx0ZWRfX2G2N3DKusyQQ folpDBSF5ATwYkZs+l/bWiW6df6/1lxM4VEHDQUb39foVESN7sqnheSagrb1ggfQrXquOQ6/bcc n9WKWHNJBN/DMoLRci2Uej7W2zXfiuM= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIwMDE1MCBTYWx0ZWRfX3nOuHjP6mlJ2 pcgtWoWwgi5wOKrHYTw4J8thqWMp2Ta8MbjZ6lQKJFa73DOLkMpChOPyXg7RJDHv7GpgJJ7Bwdv T2PIimvMh1tCdTIr+IOFU53Bbb+X5D9bCaFcFf7xnzX+dkEcQ/5qOJyx55kaMAHXiWTyKOp394A pRJ6cnerxdiqzGU3GrxCppKaJH/BFbCVGoYbNYS4OPSbtqAWpwE23/GZRoNFsO1xAzeTWjAsGtd Hj4nE8nwnKkzPlAxJTFqwkSa98y0ZNe08rw+eOBwbDTqbmdijf+qsI1iyhd1IGCXXXdBgVBQ0pJ 8O+fJrijWkY8XM6jZ8bNczzVN3Ah32139WQIYLbbo+aqxyTFwy7t88i4UnvOzKmp5g9hOWE7FGr zpvJ8nzoGS8EPbL122uA5zIzH3FY8EoIuHJrHSUAoJMiVBKVIV/o0d3Jm2xcBANdLZ/kU41R9P7 tTuPaUCYeZ1DGa0xNaA== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-20_02,2026-07-20_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 lowpriorityscore=0 impostorscore=0 malwarescore=0 suspectscore=0 phishscore=0 clxscore=1015 adultscore=0 bulkscore=0 priorityscore=1501 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607200150 The FIFO read/write helpers assume the head and tail indices stay within [0, pipe->native.length) and use them directly as offsets into the mapped FIFO region. If that invariant is ever broken, the subsequent memcpy or memcpy_fromio would access memory outside the FIFO. Validate the raw head and tail values (and, where applicable, the caller-supplied offset/count) against pipe->native.length in the avail/peek/write helpers. Checking the derived length or the post-normalized index is not sufficient: two out-of-range indices can still produce an in-range difference, and reducing a bad index modulo the FIFO length hides the original invariant violation. Fixes: caf989c350e8 ("rpmsg: glink: Introduce glink smem based transport") Cc: stable@vger.kernel.org Signed-off-by: Chunkai Deng --- drivers/rpmsg/qcom_glink_smem.c | 39 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) diff --git a/drivers/rpmsg/qcom_glink_smem.c b/drivers/rpmsg/qcom_glink_smem.c index edab912557ac..df3081855b02 100644 --- a/drivers/rpmsg/qcom_glink_smem.c +++ b/drivers/rpmsg/qcom_glink_smem.c @@ -85,6 +85,22 @@ static size_t glink_smem_rx_avail(struct qcom_glink_pipe *np) head = le32_to_cpu(*pipe->head); tail = le32_to_cpu(*pipe->tail); + /* + * head is written by the remote peer via SMEM; tail is written + * locally. Check the raw values, not a derived length: two + * out-of-range indices can still produce an in-range difference, + * and reducing a bad index modulo the FIFO length would hide the + * invariant violation. + */ + if (unlikely(head >= pipe->native.length)) { + dev_warn_ratelimited(&smem->dev, + "rx head out of range: head=%u length=%zu\n", + head, pipe->native.length); + return 0; + } + if (WARN_ON_ONCE(tail >= pipe->native.length)) + return 0; + if (head < tail) return pipe->native.length - tail + head; else @@ -99,6 +115,11 @@ static void glink_smem_rx_peek(struct qcom_glink_pipe *np, u32 tail; tail = le32_to_cpu(*pipe->tail); + if (WARN_ON_ONCE(tail >= pipe->native.length)) + return; + if (WARN_ON_ONCE(offset + count > pipe->native.length)) + return; + tail += offset; if (tail >= pipe->native.length) tail -= pipe->native.length; @@ -129,6 +150,7 @@ static void glink_smem_rx_advance(struct qcom_glink_pipe *np, static size_t glink_smem_tx_avail(struct qcom_glink_pipe *np) { struct glink_smem_pipe *pipe = to_smem_pipe(np); + struct qcom_glink_smem *smem = pipe->smem; u32 head; u32 tail; u32 avail; @@ -136,6 +158,19 @@ static size_t glink_smem_tx_avail(struct qcom_glink_pipe *np) head = le32_to_cpu(*pipe->head); tail = le32_to_cpu(*pipe->tail); + /* + * head is written locally; tail is written by the remote peer via + * SMEM. Check the raw values, not a derived length. + */ + if (WARN_ON_ONCE(head >= pipe->native.length)) + return 0; + if (unlikely(tail >= pipe->native.length)) { + dev_warn_ratelimited(&smem->dev, + "tx tail out of range: tail=%u length=%zu\n", + tail, pipe->native.length); + return 0; + } + if (tail <= head) avail = pipe->native.length - head + tail; else @@ -177,6 +212,10 @@ static void glink_smem_tx_write(struct qcom_glink_pipe *glink_pipe, unsigned int head; head = le32_to_cpu(*pipe->head); + if (WARN_ON_ONCE(head >= pipe->native.length)) + return; + if (WARN_ON_ONCE(hlen + dlen > pipe->native.length)) + return; head = glink_smem_tx_write_one(pipe, head, hdr, hlen); head = glink_smem_tx_write_one(pipe, head, data, dlen); -- 2.34.1