From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f46.google.com (mail-wr1-f46.google.com [209.85.221.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0295217C for ; Mon, 6 Jan 2025 00:06:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.46 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1736121978; cv=none; b=T+FamP9uTq66Nk0RKeQZ4ndndHSe3IpSa3xXUfDkUZEM8m2p0kRNPytnW/k0qw1jb+I9QuoYthK2qhdXH9jI01LD8mGAGvXJVn/YhmVgwPCmxsE512DJM/x7fAxe1G50xxOM7RU2xut+zgszn/PwtENZI7Zgz3TCyCbiOOuirXI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1736121978; c=relaxed/simple; bh=oA6J0g5TF/QPJwoe/r7VTCId1g0D4HuEHJU+6/4mICA=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=hK6JDqLp7/emcLFJ64BIzSrryLJ083YkdtU9f6B/L1FI1vRlL+YZTIk1ilhMosJfZG8QjymzivU4QIr9nHcVOvEWPsmXjo8HdYHWPnaZOsraaGtXPTKgxMdHqBcUvgmvwVROEzJ5sgZPERw+3S5OUyY4fG64jM4FtflfwSdX6fo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linaro.org; spf=pass smtp.mailfrom=linaro.org; dkim=pass (2048-bit key) header.d=linaro.org header.i=@linaro.org header.b=XAvn1XiM; arc=none smtp.client-ip=209.85.221.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linaro.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=linaro.org header.i=@linaro.org header.b="XAvn1XiM" Received: by mail-wr1-f46.google.com with SMTP id ffacd0b85a97d-3862d16b4f5so8534238f8f.0 for ; Sun, 05 Jan 2025 16:06:16 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1736121975; x=1736726775; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=rhwNhcGJukSSNRtJy+BQbZn/P7zCXQmPoIWo8g+FW7g=; b=XAvn1XiMS9hXscgzhMIH4YJKSL6zpQaBU5AF5Lez7osMnSb9QppzI0XtnhCNU8XXK5 EvKiSrvqLnypByfVLJO+QQaKLEbVaHiHNLkHjrGVY57Id9OTJeHVX9M1KZDIOw3mK51D Zmt+H2gxUwpaJULZsA4kNf98gc6efPgTbVx3y6pWQsZ5K8mOXCOrLjZj87OI9airnnQ5 txcb3m/EoJ7DUakm69MqoeX74errk9wm9TXiwBZrsVaN4XpCcIwD8OJlWnNtjNisiVOM ahfmGJi4HzOCfEy1qL28gyTeUi3DTRktmNoqO7drDYHN3YwaQxKGRzm6S42BMYXRiHx2 SZzQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1736121975; x=1736726775; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=rhwNhcGJukSSNRtJy+BQbZn/P7zCXQmPoIWo8g+FW7g=; b=AZhLquyqzqT5bWX1NIJUzmx1eOYJZV6LqxIlrtbZK57BpRc3Tp1XmddtrRzEL6KLWl 9Y897vywXB7U7v+20zABzRlGpNY3M5pYML+E3eFlmyt6d6XQ1e4HHJBPXG7RPGBE0d84 Xvh+rS5wdb8MFVocbjNV/mEViW1+CCLQNBPUzWZqyxAo9WgQ1OK1/cvegMkCBCnLIRE6 Ot6H95zCx26kivWmG50sbJ8ubUP5yKR98BiM4hn/u9+PY6Db1LZICO8XcPG+M0rtBua0 UrEZSpqirUBxX5+cDgC2kUXMz5NmUZI1bBeO9ThoZVv9nxVvi3XABo0q4XcNg+H+Aizh uQQw== X-Forwarded-Encrypted: i=1; AJvYcCVO3YQHlU36mXF6K4HQK2vIjw1vedzfPDGSUR2eCvvN0G234+ipTJ8O3FIMiIbbrgzkfOJeXfqtfpPv3tk=@vger.kernel.org X-Gm-Message-State: AOJu0Yzae62f3bNuQIQK4uyfnvllLhW0CCt10FsXFqpzZxsVpUy45yFP GJ4lXnlG2h3AEzKFLjMn+uy7IdVSFIvv5ah5g4UsEhMg68zfceIYuxRt/zOUQcg= X-Gm-Gg: ASbGnct6VQYFAhaRmsdAQQKpZyoAneFCqxB8w4tzqi1hddZNQU/tW64CCsk4jxHar1o R4ClZNSmmMs6MTmko9T6EBkt4xZXO8sOmON9HdcYwUThZg8SHjBu6qziT3DhNX9pVnzWK5g/Wtt Y23iVGJo1PVuASKwuGfkKf+LQlBKdzgaGSyWY8GR1z3i8gRhtN0KtBCLsbyUkXPia7AsiB4/9XP CRz0EKE6VHyabbJydLfOG4M2PD+z73eZahl7ZQLTaux8+6StIOYkzjJhhl81u3GddMy6A== X-Google-Smtp-Source: AGHT+IHtD0cPqmxdavlPwilipaLcchXkzdRzmlDpwxXuPTk+EK6FZYxYiqrnx+VfEI1fkKR9R0goAQ== X-Received: by 2002:a5d:5d09:0:b0:385:fa30:4f87 with SMTP id ffacd0b85a97d-38a2276a0a1mr54181265f8f.0.1736121975480; Sun, 05 Jan 2025 16:06:15 -0800 (PST) Received: from [192.168.0.43] ([176.61.106.227]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-38a1c8332absm45955003f8f.38.2025.01.05.16.06.14 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Sun, 05 Jan 2025 16:06:15 -0800 (PST) Message-ID: <2b0528f5-f9fa-4cfd-abda-a0e95ba4a2f1@linaro.org> Date: Mon, 6 Jan 2025 00:06:14 +0000 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH 2/2] media: venus: fix OOB access issue while reading sequence changed events To: Vedang Nagar , Stanimir Varbanov , Vikash Garodia , Mauro Carvalho Chehab Cc: linux-media@vger.kernel.org, linux-arm-msm@vger.kernel.org, linux-kernel@vger.kernel.org References: <20250104-venus-security-fixes-v1-0-9d0dd4594cb4@quicinc.com> <20250104-venus-security-fixes-v1-2-9d0dd4594cb4@quicinc.com> Content-Language: en-US From: Bryan O'Donoghue In-Reply-To: <20250104-venus-security-fixes-v1-2-9d0dd4594cb4@quicinc.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit On 04/01/2025 05:41, Vedang Nagar wrote: > num_properties_changed is being read from the message queue but is > not validated. Value can be corrupted from the firmware leading to > OOB read access issues. Add fix to read the size of the packets as > well and crosscheck before reading from the packet. > > Signed-off-by: Vedang Nagar Please see Vikash's series on this. https://lore.kernel.org/linux-arm-msm/20241128-venus_oob_2-v2-2-483ae0a464b8@quicinc.com/ it seems to have exactly the same patch title ? Is this patch supposed to be a follow-up to that patch ? https://lore.kernel.org/linux-arm-msm/20241128-venus_oob_2-v2-0-483ae0a464b8@quicinc.com/ Expecting to see a V3 of the above. If the intention is to supersede that patch or some of those patches you should make clear here. On the switch statement I'd have two comments. #1 is everything really a " -= sizeof(u32)" ? #2 if so then this ought to be factored out into a function => functional decomposition --- bod