From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7FE1724634F for ; Tue, 24 Mar 2026 09:42:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.168.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774345325; cv=none; b=CdajLr1j1cqGw6DbA4GGNgXFI2OL1Fej2Y9NmlLVIvNfUIpHWWHEdnBYmOjFc718r8wjHe1nKrdVHlgxsbEAdCc2l8nVOBneVSdBqvHUhxETajFsMXj01zI7mJXJIFuBgY2iU9NOeAoOXMZhqfmp115S1Hf9dIoEkUVBvbc5fyI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774345325; c=relaxed/simple; bh=yYfYa0Ulu8H+nopgk+n9awaeNsR1DO6zHOpNvvw9NXg=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=WsKmCZstYCjHRel52Yfm5jnCwn7TmpTM9GXKP+YY4xZ1PSj/b6Jbi1wo4U7irS7t5GL1fdubRdpfbW9qbdBOs/COBN3d2Cm35GrpllpC/l7WL4y8OSDJJnfYevWUIcnH2kyJuEy3MdfyjKw93RXZh0eXEuWHXSFP0YbYnSiJAl0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=GWzCjR/O; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=BQNVLEtH; arc=none smtp.client-ip=205.220.168.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="GWzCjR/O"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="BQNVLEtH" Received: from pps.filterd (m0279862.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 62O7REc52371532 for ; Tue, 24 Mar 2026 09:42:04 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= 5RZ4GYuvh+6bLS2CH+VBbgVN7UFKGCV6+Omn03Ufz8U=; b=GWzCjR/OrbINmbZJ 6MOknPUvnd1eshXqPPUnmcBfnG2WVZmSf7KcqyL/OX9L6HBJopkJKyox037aSvHT qKDp7TdaQ0yrC4hQnr+ok3/lFlWQlmcppcj2qMCqTbEakWkNWce8trglYrzAAJmJ MxZ4UvXAIWvw3AM6yRe7jkzYXJbpJNfWrENT4iM2ViwH6XAO4yoXyrqqh8Lo8XWU GFV4PlCvbFlodCFMUlGoDFbnOw1dzmVgvZxbNO9ANzme/OaBhFI4Ju5VIhFFOv0x NR59P3A9dwhAcRGJjGL+IPNF22Ac8qK+UJ+fsuc4x0QeLB7HXOqLWXbimmzqlys6 36yyYA== Received: from mail-qt1-f198.google.com (mail-qt1-f198.google.com [209.85.160.198]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4d3p830fae-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Tue, 24 Mar 2026 09:42:03 +0000 (GMT) Received: by mail-qt1-f198.google.com with SMTP id d75a77b69052e-50947db2e97so45134211cf.3 for ; Tue, 24 Mar 2026 02:42:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1774345323; x=1774950123; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=5RZ4GYuvh+6bLS2CH+VBbgVN7UFKGCV6+Omn03Ufz8U=; b=BQNVLEtHKBVDuiRHFI7FU++QSsy9+p2EWvDhLob8fKsnkq5PDrGzvLODlyLaNuxxRN Y0nrxXndL6cwCGSsGaq9l/3hzaIWSCeZo7hEEKTYHTGY65u+tAM6BOjzYy0Zq9gK3vDS dSZw4f0xQoFj8TuambOCK8oxI7lNBXHYNJwZ0f47t/erUyTat4vFit9W7unXbS8MjezL DiUjqE33L9KVG7xVgAv6cyIkWO1/qRG42jMEJVFAJfXw08xTkV1XdbN3ejsANRLmiUBq IfxybhEmmoEsD5sFjR2v3ps9IsB7ip+v/BBG4oCE9OvdQ2v9PQDd+RoVwsm93CO1Byd2 xs9A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1774345323; x=1774950123; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=5RZ4GYuvh+6bLS2CH+VBbgVN7UFKGCV6+Omn03Ufz8U=; b=GbufZey8cB0tnr4vhwzn78KfKkoDrlxoxmT/dXNIwFaxXahELl2O/984x6GacoLxfr 3dyQ1kkR0A3dF1eYwdDuDHIUtbNkvrooITPpiGT9Jqnzzmyr/ynM/aCH3kP4Ce98jS/T YGHJjJYnX58+PwfZ26G3+6x437gL3LIkVXAT7ox7SiCYFn61+pWvmAqmg3PofsNOkvan DYHxTjPuXdwPNPI2v2s9zYCBJyBBXzafgQGF2Bn4X3v/5qNpx06bsiz1M4gNjXvCB6kb 5Cdd8z+XGdmAxJOhnWraRJ2SJVvGhZMcgodbYh6p5K+VGGcVVrz3L93xPT5m7sTs7Otl OQmw== X-Forwarded-Encrypted: i=1; AJvYcCW7yRJ+3njR/GW+gRmMp5smC91iSaV+dnusB4s5rFmfYX2XYmq2EP9XP6l4Q6br0iDQKdCWSdPt5+9BZ7Q=@vger.kernel.org X-Gm-Message-State: AOJu0YzMZBhS5iX801u+TuOfzrQ835haawRWclOZmTZxkQo8TAa+9L3R UXyvy3pCZOqjW2mD2QCb0PFnYrIjrkkJ/7AWROT4mCtDP1YF+ful7LdZ8l/w4utVQHuGsHosDfs Vf8E7+AoLCwzi6YWC7UJKToTjNupTl73rmRT69Nh+RZZ/D97hlOup+mEpGsei79oIt9Y= X-Gm-Gg: ATEYQzyheGJ78hYp+KHu2g4FqqhplVAU609U5LgqWVg67Jq0TotOyWxQIfZzgD+GHWa qUVhX2ggXyt86pT6+X/i7057eLWesqFh+gu1b+RFtF+8KKd61xFdi4ReZeCjsSomVMkJtD2/zBK lfoO67bDswix/CIXx3MEri2tU3ClQWq42OJ4TLCMRJWbuPGDtmwYHtub2lKwsc2RspN56D9DK1G tNUYLKQaD1YFLbRRBZLHloocIXI52gt+V7xodKOjvnIWvO6PCS7UwUojdJaez9KtqRxpcTOJVJQ 5eH8WMVVuK227ihLv2el5ZbvAy8la2MmQlNssvvmaHWni2kUY/d7xtAFcuaK6dbqVYOPim7TdEG BKM2ioutuFCPUSxGO6NcrFKjsE88H1VBmM1BMfXkfAzYufwfhHgpkwHiM5nVpL1CEKj79HKR3Lo ERzt4= X-Received: by 2002:ac8:7fc4:0:b0:509:1057:4a67 with SMTP id d75a77b69052e-50b37425de9mr176705451cf.2.1774345322805; Tue, 24 Mar 2026 02:42:02 -0700 (PDT) X-Received: by 2002:ac8:7fc4:0:b0:509:1057:4a67 with SMTP id d75a77b69052e-50b37425de9mr176705261cf.2.1774345322306; Tue, 24 Mar 2026 02:42:02 -0700 (PDT) Received: from [192.168.119.254] (078088045245.garwolin.vectranet.pl. [78.88.45.245]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-b9832f43ae8sm616743066b.6.2026.03.24.02.41.57 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 24 Mar 2026 02:41:59 -0700 (PDT) Message-ID: <3df24e4f-afba-49c4-b9ff-62db725ff0a3@oss.qualcomm.com> Date: Tue, 24 Mar 2026 10:41:56 +0100 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] misc: fastrpc: keep copied arguments inside the invoke buffer To: Pengpeng Hou , srini@kernel.org, amahesh@qti.qualcomm.com, arnd@arndb.de, gregkh@linuxfoundation.org Cc: linux-arm-msm@vger.kernel.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org References: <20260324014459.93364-1-pengpeng@iscas.ac.cn> Content-Language: en-US From: Konrad Dybcio In-Reply-To: <20260324014459.93364-1-pengpeng@iscas.ac.cn> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwMzI0MDA3NiBTYWx0ZWRfXyZsSEkx/z71t WMcUeKqW3Tmt/Uy36T7NC47J6yZlK5XQOAeJ+nNt45nIDuxOgd9HciPvtDIUvWa6r2rZub3fUGA gQ5LkOAAcSFPeLFK26LF26DrIlSSeAts2ktxtbjd3vEFj3IrjBGkTYbu9Mbsbpq/bcG5Nn2i0l4 6LK+N8Usp0D/xZ03mNb2C7sARgRiWaMvgRw4pNjmM/iJT7wNZzTiINL60BRdfDfhyBBklJo4hGD hxcvaecckYgLBTXJ68agU7eJ1LhYn4je2KYn+2Xs7ZsNVqCU7i14Ff85WxtJKALeo1MvPaXZn/Z NosQEXa2kLI+nqdzTdYGqAW4q++Va2cw7+KzHT0Xw4RKB1Yp5pm6oUioj9B32velSRACKiZs0y8 x9EVf8qG9zv/AROnnHXVRPQKYgZFgSKe9IMHJzUQppvH4H1VabfUueFGxM6wr2NSrNaN1kIRHKb t19JpwQkhsCtRKx/4VQ== X-Proofpoint-ORIG-GUID: Tyj53sXiYf2R_D7_AVDV9WIzW-Rv4AoH X-Authority-Analysis: v=2.4 cv=F6hat6hN c=1 sm=1 tr=0 ts=69c25c6b cx=c_pps a=mPf7EqFMSY9/WdsSgAYMbA==:117 a=FpWmc02/iXfjRdCD7H54yg==:17 a=IkcTkHD0fZMA:10 a=Yq5XynenixoA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=_K5XuSEh1TEqbUxoQ0s3:22 a=VwQbUJbxAAAA:8 a=H0nZvlvcKp4VijHwmHEA:9 a=QEXdDO2ut3YA:10 a=zgiPjhLxNE0A:10 a=dawVfQjAaf238kedN5IG:22 X-Proofpoint-GUID: Tyj53sXiYf2R_D7_AVDV9WIzW-Rv4AoH X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.51,FMLib:17.12.100.49 definitions=2026-03-24_02,2026-03-23_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 phishscore=0 lowpriorityscore=0 impostorscore=0 bulkscore=0 spamscore=0 priorityscore=1501 malwarescore=0 adultscore=0 clxscore=1015 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2603050001 definitions=main-2603240076 On 3/24/26 2:44 AM, Pengpeng Hou wrote: > fastrpc_get_args() derives rpra[i].buf.pv from the overlap offset that > was computed from user-controlled argument pointers and lengths. The > resulting destination pointer is then used for copy_from_user() without > first checking that it still falls inside the allocated invoke buffer. > > Validate the overlap-derived destination range before storing it in > rpra[i].buf.pv and before copying inline arguments into the invoke > buffer. > --- Your contribution lacks a DCO: https://docs.kernel.org/process/submitting-patches.html#sign-your-work-the-developer-s-certificate-of-origin without which we can't accept it. Please run ./scripts/checkpatch.pl on the patch file Konrad