From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pg1-f169.google.com (mail-pg1-f169.google.com [209.85.215.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 65CF625B0AB for ; Mon, 24 Aug 2026 08:26:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.169 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787560021; cv=none; b=NeWSV3uDHpQyQP2ZZ61WROCfgop24hmbunc4N/h+HRq+PxIDsZJnhJv/vOhWpZ/cnVpx8xvFpYMHzPLDCfOWrWWf9bXUOievH57JOKrTy+MKP6qgii1VRZnP5PiB6y0Yxanv/WpTcD985Ii6RALMYxPHfhdHNk5P1WXBZOeZvPc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787560021; c=relaxed/simple; bh=G5npMlrFjOUjpVZGNazAfzz0eB67gPJfe4NVy6Mo/0w=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Rp3gRNVsCmwnA4xGoAXzExXQXHGfGLOMBgYygvepm5n7330g4+L9+iAhkXMnvWhilj+w1yrCsCl5y2V9JrQxdBz3J6FRVXqApgsZTC0PAl6w0ujs592MpsOeFR9v5ov0xM0J2v6Y9jb/k0fic3TtvK8f9pCazyhDVhr4cGv9kUU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=m7ZD7u/a; arc=none smtp.client-ip=209.85.215.169 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="m7ZD7u/a" Received: by mail-pg1-f169.google.com with SMTP id 41be03b00d2f7-c9cf07d2df6so1978690a12.2 for ; Mon, 24 Aug 2026 01:26:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787560018; x=1788164818; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=fPN5BIwUDTeW7sBnIZ7PXhoHkYcvuxUpMJtfpBrosOg=; b=m7ZD7u/adNXlMIkTf13jgsVAwGFAnTNXsY75X7R7aWyjFI5YWJ47bqH0moxLqxN1gn R2bWPST6li6nBOhPUVzkWY+iBMW6D958JPpp62yjgWDSTzR57Wbs9TufEyqHzZc0PH/F nxx425GkKjWQJVq6vvTe7CBpgfqW7a14DjhA+ngh4crI+a8RUwl9DVG5Y/Uxi4Jddqfp sUe02dwbGrcEP4h3EL03H0bFMjFT1Mq1xvQQ/JRbGHlObfWAhLbT+q8G87HjRtHgg8WF Lg11in6P9oFGIEqpb1098017fSz7d4SKjdCrdc3A3a5llyVfKaVyzP2GAXalJN60/JQZ 3l/A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787560018; x=1788164818; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=fPN5BIwUDTeW7sBnIZ7PXhoHkYcvuxUpMJtfpBrosOg=; b=N3t9Aa+fJpYA69Lv74yfw5AMv/RLllabJiBqER4H+5Bp6PtVPXj2RGd2RpiE3sBPGD e/UEFwhF0eS+4RVlxQeCW4xbOIoxyWQ4/yEvyeNijuW3cF/hxqRXOPz1dTVNFaXjQ+5J DryANUltgyuA4QN/GycjGVQm+UYroVFmKS01pBre6kIfBZBUZVGdg6d2RrG9N3SKgs0x 8h0IJ+j8ZoeTb2bdovJLOAA4gGEScmi85jXhNhJBWKKo1YRHfBc3iofOR5Cg5jlseFyB ObkEqRqxycH4yDRBCsRMJxOSPoXOk/zpZbgJVXu67BwP8HRsJdGDLSLiDYBilSr7cdw1 Cmzg== X-Forwarded-Encrypted: i=1; AHgh+RomkLsyh/wBB0FNVHrbJx6NcDB8C/8NAotsk9hHm6CHpi/wXwFE2QdH92BZ4LRxCkKXTeZj+TCRXmmZT0A=@vger.kernel.org X-Gm-Message-State: AFuF++lAKpbY5XL4LYbHKJqRO0TKXFaG9aEjuFXmYncAAdubejYCf3Xo dZl7D4V8Y7J4/OMRpYYsCCLE4icgy+VlR3F7yT+uoQwEAqdFunQKYdom X-Gm-Gg: AR+sD11PSrwOR4t6yUn3XPohOd0dGDTRMPYVfiMnKmcFk09nTUgGoBn7XyFhb5/CsCV bjlMjn/5dTcv7yGnlF7DFmtDbgpzthZaH1Yc0Hlwns2RVLfIJNOP+X07p79DQZGStN2a9un7+SB x7SWcjNgRV0GLVryAEAqfJCbaJIVfkBRiwImBcZIk2gKAlyO3CBsYdceXRz6MxhVTGuXaLF/rDV Gu6nonBFs/4ILArOH1Zpa0hWofiEnE+5e94/hRdHqX5F8m34XB4DiBronMdTb1djMJVVgQe9V0u Sx1MqSOBYTiDEyRXhs3Qi15z+8WeHfhoCFwhlDBpNsMyeHw5fHw6gixvNSnM7gr66V3n8LglycH tY2dIwM7Fp7adtzQi5heCy9FejJF8Bx7Onu1amUaCQekMF4DuoZvzK6ZMJ4GmJf8/hWPKEkLCBu jY7Y63xl/PygeLj3Sm1f1e8JckL6V+I7JgIFh7MtZ7GAlr9etvFJ4jsy+JlFr9MOK5jgi5LufUY iGsiE1e4e3h1dJtBbSILjeImWfrw29Tmv50XEYJvd5JUjGjF4NFBRBWV8FwCSNOOBhBSdLERzxT BgCNpDLYb7wzViD5ha5z63u3X1LccfI9MmAzXsR7ZQIqcUrw7DFEvB4+KteFXTPCNIJOEVSf7/y 2R5FFWbRGWaIKKmwEMMV+d0jzrl0GnadSDknNlynOUcZou9s= X-Received: by 2002:a05:6a20:d70f:b0:3c4:2b8b:e88f with SMTP id adf61e73a8af0-3cd2fea6574mr50727838637.5.1787560018294; Mon, 24 Aug 2026 01:26:58 -0700 (PDT) Received: from localhost.localdomain ([101.251.7.10]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-327f90c0dd3sm25994595eec.7.2026.08.24.01.26.54 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Mon, 24 Aug 2026 01:26:57 -0700 (PDT) From: Laxman Acharya Padhya To: Sven Peter , Janne Grunau Cc: Neal Gompa , Arnd Bergmann , asahi@lists.linux.dev, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH v2 2/4] soc: apple: rtkit: bound syslog copies to the shared buffer Date: Mon, 24 Aug 2026 14:11:38 +0545 Message-ID: <5575a09569af52fa7d8d66a217ca846824ef2745.1787559303.git.acharyalaxman8848@gmail.com> X-Mailer: git-send-email 2.51.2 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit apple_rtkit_syslog_rx_log() copies a log entry out of the coprocessor shared-memory ring using an index and layout chosen by the coprocessor. These values are not checked against syslog_buffer.size, so buggy firmware can make memcpy_fromio() or memcpy() read past the DMA mapping. SYSLOG_INIT also accepts a zero message size. kzalloc(0) returns ZERO_SIZE_PTR, which is non-NULL, and the later strnlen() size wraps from zero to SIZE_MAX. Reject zero-sized messages and make apple_rtkit_memcpy() refuse copies that do not fit in the shared buffer. Rate limit the bounds warning so the coprocessor cannot flood the kernel log. Fixes: 9bd1d9a0d8bb ("soc: apple: Add RTKit IPC library") Cc: stable@vger.kernel.org Signed-off-by: Laxman Acharya Padhya --- drivers/soc/apple/rtkit.c | 49 ++++++++++++++++++++++++++++----------- 1 file changed, 35 insertions(+), 14 deletions(-) diff --git a/drivers/soc/apple/rtkit.c b/drivers/soc/apple/rtkit.c index 1886f7eba77d..2e62f9b3c948 100644 --- a/drivers/soc/apple/rtkit.c +++ b/drivers/soc/apple/rtkit.c @@ -348,14 +348,23 @@ static void apple_rtkit_free_buffer(struct apple_rtkit *rtk, bfr->is_mapped = false; } -static void apple_rtkit_memcpy(struct apple_rtkit *rtk, void *dst, - struct apple_rtkit_shmem *bfr, size_t offset, - size_t len) -{ +static int apple_rtkit_memcpy(struct apple_rtkit *rtk, void *dst, + struct apple_rtkit_shmem *bfr, size_t offset, + size_t len) +{ + if (offset > bfr->size || len > bfr->size - offset) { + dev_warn_ratelimited(rtk->dev, + "RTKit: shared-memory copy out of bounds (off 0x%zx len 0x%zx size 0x%zx)\n", + offset, len, bfr->size); + return -EINVAL; + } + if (bfr->iomem) memcpy_fromio(dst, bfr->iomem + offset, len); else memcpy(dst, bfr->buffer + offset, len); + + return 0; } static void apple_rtkit_crashlog_rx(struct apple_rtkit *rtk, u64 msg) @@ -384,9 +393,10 @@ static void apple_rtkit_crashlog_rx(struct apple_rtkit *rtk, u64 msg) */ bfr = kzalloc(rtk->crashlog_buffer.size, GFP_KERNEL); if (bfr) { - apple_rtkit_memcpy(rtk, bfr, &rtk->crashlog_buffer, 0, - rtk->crashlog_buffer.size); - apple_rtkit_crashlog_dump(rtk, bfr, rtk->crashlog_buffer.size); + if (apple_rtkit_memcpy(rtk, bfr, &rtk->crashlog_buffer, 0, + rtk->crashlog_buffer.size) == 0) + apple_rtkit_crashlog_dump(rtk, bfr, + rtk->crashlog_buffer.size); } else { dev_err(rtk->dev, "RTKit: Couldn't allocate crashlog shadow buffer\n"); @@ -428,6 +438,11 @@ static void apple_rtkit_syslog_rx_init(struct apple_rtkit *rtk, u64 msg) rtk->syslog_n_entries = FIELD_GET(APPLE_RTKIT_SYSLOG_N_ENTRIES, msg); rtk->syslog_msg_size = FIELD_GET(APPLE_RTKIT_SYSLOG_MSG_SIZE, msg); + if (rtk->syslog_msg_size == 0) { + dev_warn(rtk->dev, "RTKit: syslog msg_size is zero\n"); + return; + } + rtk->syslog_msg_buffer = kzalloc(rtk->syslog_msg_size, GFP_KERNEL); dev_dbg(rtk->dev, @@ -444,10 +459,11 @@ static void apple_rtkit_syslog_rx_log(struct apple_rtkit *rtk, u64 msg) { u8 idx = msg & 0xff; char log_context[24]; - size_t entry_size = 0x20 + rtk->syslog_msg_size; + size_t entry_size; + size_t offset; int msglen; - if (!rtk->syslog_msg_buffer) { + if (!rtk->syslog_msg_buffer || rtk->syslog_msg_size == 0) { dev_warn( rtk->dev, "RTKit: received syslog message but no syslog_msg_buffer\n"); @@ -471,11 +487,16 @@ static void apple_rtkit_syslog_rx_log(struct apple_rtkit *rtk, u64 msg) goto done; } - apple_rtkit_memcpy(rtk, log_context, &rtk->syslog_buffer, - idx * entry_size + 8, sizeof(log_context)); - apple_rtkit_memcpy(rtk, rtk->syslog_msg_buffer, &rtk->syslog_buffer, - idx * entry_size + 8 + sizeof(log_context), - rtk->syslog_msg_size); + entry_size = 0x20 + rtk->syslog_msg_size; + offset = (size_t)idx * entry_size + 8; + if (apple_rtkit_memcpy(rtk, log_context, &rtk->syslog_buffer, offset, + sizeof(log_context)) < 0) + goto done; + if (apple_rtkit_memcpy(rtk, rtk->syslog_msg_buffer, + &rtk->syslog_buffer, + offset + sizeof(log_context), + rtk->syslog_msg_size) < 0) + goto done; log_context[sizeof(log_context) - 1] = 0; -- 2.51.2