[PATCH v3 0/5] remoteproc: Misc. RSC table changes

[PATCH v3 0/5] remoteproc: Misc. RSC table changes

[Mukesh Ojha]

This series contains a mix of header hygiene and a security fix for
rsc_table_for_each_entry().

Patch 1 adds rsc_table.h to the REMOTEPROC MAINTAINERS entry, which was
missing since the header was split out from remoteproc.h.

Patches 2-4 clean up remoteproc.h and rsc_table.h: a checkpatch style
fix for function pointer alignment and two SPDX-License-Identifier
conversions replacing the verbose BSD-3-Clause blurb.

Patch 5 fixes an out-of-bounds read in rsc_table_for_each_entry().
table->offset[i] is a u32 from firmware, but was stored as a signed int.
A crafted offset like 0xFFFFFFF0 interpreted as -16 placed hdr 16 bytes
before the table, and the subsequent avail check was silently bypassed
because the negative int promoted to a large size_t.  The fix stores the
offset as u32 and validates it with unsigned comparisons before any
pointer arithmetic.

Changes in v3:
- Patches 3, 4: Per Bjorn's review, replace the BSD blurb
  entirely rather than adding the SPDX tag alongside it; preserve the
  copyright lines in a separate comment block.
- Patches 1, 2, 5: unchanged from v2.
- Link to v2: https://lore.kernel.org/lkml/20260724184132.1878077-1-mukesh.ojha@oss.qualcomm.com/

Changes in v2:
 - Rebased it on next-20260723
 - Integrated multiple singleton into this series.
    1/5 was part of https://lore.kernel.org/lkml/20260506050107.1985033-6-mukesh.ojha@oss.qualcomm.com/
    2/5 to 4/5 was here https://lore.kernel.org/lkml/20260611180550.2442641-1-mukesh.ojha@oss.qualcomm.com/
    5/5 was reported as a part of https://lore.kernel.org/lkml/tencent_53F3322FDEB2E45D6412C427B8D1C6081407@qq.com/


Mukesh Ojha (5):
  MAINTAINERS: add rsc_table.h to remoteproc entry
  remoteproc: fix coding style issues in remoteproc.h
  remoteproc: replace BSD blurb with SPDX identifier in remoteproc.h
  remoteproc: replace BSD blurb with SPDX identifier in rsc_table.h
  remoteproc: fix OOB read via signed offset in
    rsc_table_for_each_entry()

 MAINTAINERS                |  1 +
 include/linux/remoteproc.h | 38 +++++--------------------------
 include/linux/rsc_table.h  | 46 ++++++++++----------------------------
 3 files changed, 18 insertions(+), 67 deletions(-)

-- 
2.53.0

[PATCH v3 1/5] MAINTAINERS: add rsc_table.h to remoteproc entry

[Mukesh Ojha]

include/linux/rsc_table.h was split out from include/linux/remoteproc.h
to hold the resource table wire-format definitions. Add it to the
REMOTEPROC entry so it is covered by the same maintainers.

Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
---
 MAINTAINERS | 1 +
 1 file changed, 1 insertion(+)

diff --git a/MAINTAINERS b/MAINTAINERS
index 56b337a06447..433d737dc595 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -22957,6 +22957,7 @@ F:	Documentation/devicetree/bindings/remoteproc/
 F:	Documentation/staging/remoteproc.rst
 F:	drivers/remoteproc/
 F:	include/linux/remoteproc.h
+F:	include/linux/rsc_table.h
 F:	include/linux/remoteproc/
 
 REMOTE PROCESSOR MESSAGING (RPMSG) SUBSYSTEM
-- 
2.53.0

[PATCH v3 2/5] remoteproc: fix coding style issues in remoteproc.h

[Mukesh Ojha]

The function pointer declarations for find_loaded_rsc_table() and
get_loaded_rsc_table() had their opening parenthesis at the end of
the line. Move the first argument onto the same line as the opening
parenthesis to fix the checkpatch warning.

Also remove a spurious blank line after the opening brace in
struct rproc_vdev.

Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
---
 include/linux/remoteproc.h | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/include/linux/remoteproc.h b/include/linux/remoteproc.h
index ef711a5b1a7f..fe77436677f9 100644
--- a/include/linux/remoteproc.h
+++ b/include/linux/remoteproc.h
@@ -128,10 +128,10 @@ struct rproc_ops {
 	int (*parse_fw)(struct rproc *rproc, const struct firmware *fw);
 	int (*handle_rsc)(struct rproc *rproc, u32 rsc_type, void *rsc,
 			  int offset, int avail);
-	struct resource_table *(*find_loaded_rsc_table)(
-				struct rproc *rproc, const struct firmware *fw);
-	struct resource_table *(*get_loaded_rsc_table)(
-				struct rproc *rproc, size_t *size);
+	struct resource_table *(*find_loaded_rsc_table)(struct rproc *rproc,
+							const struct firmware *fw);
+	struct resource_table *(*get_loaded_rsc_table)(struct rproc *rproc,
+						       size_t *size);
 	int (*load)(struct rproc *rproc, const struct firmware *fw);
 	int (*sanity_check)(struct rproc *rproc, const struct firmware *fw);
 	u64 (*get_boot_addr)(struct rproc *rproc, const struct firmware *fw);
@@ -382,7 +382,6 @@ struct rproc_vring {
  * @index: vdev position versus other vdev declared in resource table
  */
 struct rproc_vdev {
-
 	struct rproc_subdev subdev;
 	struct platform_device *pdev;
 
-- 
2.53.0

[PATCH v3 3/5] remoteproc: replace BSD blurb with SPDX identifier in remoteproc.h

[Mukesh Ojha]

remoteproc.h contains the full BSD-3-Clause license blurb but is missing
an SPDX-License-Identifier tag.

Replace the BSD-3-Clause license blurb with the SPDX-License-Identifier
tag, the standard kernel representation, avoiding duplicate license text.

Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
---
 include/linux/remoteproc.h | 29 +----------------------------
 1 file changed, 1 insertion(+), 28 deletions(-)

diff --git a/include/linux/remoteproc.h b/include/linux/remoteproc.h
index fe77436677f9..a44368737b39 100644
--- a/include/linux/remoteproc.h
+++ b/include/linux/remoteproc.h
@@ -1,35 +1,8 @@
+/* SPDX-License-Identifier: BSD-3-Clause */
 /*
- * Remote Processor Framework
- *
  * Copyright(c) 2011 Texas Instruments, Inc.
  * Copyright(c) 2011 Google, Inc.
  * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * * Redistributions of source code must retain the above copyright
- *   notice, this list of conditions and the following disclaimer.
- * * Redistributions in binary form must reproduce the above copyright
- *   notice, this list of conditions and the following disclaimer in
- *   the documentation and/or other materials provided with the
- *   distribution.
- * * Neither the name Texas Instruments nor the names of its
- *   contributors may be used to endorse or promote products derived
- *   from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef REMOTEPROC_H
-- 
2.53.0

[PATCH v3 4/5] remoteproc: replace BSD blurb with SPDX identifier in rsc_table.h

[Mukesh Ojha]

rsc_table.h contains the full BSD-3-Clause license blurb but is missing
an SPDX-License-Identifier tag.

Replace the BSD-3-Clause license blurb with the SPDX-License-Identifier
tag, the standard kernel representation, avoiding duplicate license text.

Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
---
 include/linux/rsc_table.h | 29 +----------------------------
 1 file changed, 1 insertion(+), 28 deletions(-)

diff --git a/include/linux/rsc_table.h b/include/linux/rsc_table.h
index c6d6d553d8f1..0ad9122c22af 100644
--- a/include/linux/rsc_table.h
+++ b/include/linux/rsc_table.h
@@ -1,35 +1,8 @@
+/* SPDX-License-Identifier: BSD-3-Clause */
 /*
- * Resource table and its types data structure
- *
  * Copyright(c) 2011 Texas Instruments, Inc.
  * Copyright(c) 2011 Google, Inc.
  * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * * Redistributions of source code must retain the above copyright
- *   notice, this list of conditions and the following disclaimer.
- * * Redistributions in binary form must reproduce the above copyright
- *   notice, this list of conditions and the following disclaimer in
- *   the documentation and/or other materials provided with the
- *   distribution.
- * * Neither the name Texas Instruments nor the names of its
- *   contributors may be used to endorse or promote products derived
- *   from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef RSC_TABLE_H
-- 
2.53.0

[PATCH v3 5/5] remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry()

[Mukesh Ojha]

table->offset[i] is a u32 from firmware, but was stored into a signed
int.  A crafted offset like 0xFFFFFFF0 becomes -16, placing hdr 16 bytes
before the table buffer.  The subsequent avail check was bypassed
because the negative int was promoted to a large size_t in the
expression "table_sz - offset - sizeof(*hdr)", yielding a large positive
avail and letting the out-of-bounds hdr->type read proceed undetected.

Store the offset as u32 and validate it with unsigned comparisons before
any pointer arithmetic.

Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
---
 include/linux/rsc_table.h | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/include/linux/rsc_table.h b/include/linux/rsc_table.h
index 0ad9122c22af..71b60125310e 100644
--- a/include/linux/rsc_table.h
+++ b/include/linux/rsc_table.h
@@ -310,17 +310,22 @@ static inline int rsc_table_for_each_entry(struct resource_table *table,
 	int i, ret;
 
 	for (i = 0; i < table->num; i++) {
-		int offset = table->offset[i];
-		struct fw_rsc_hdr *hdr = (void *)table + offset;
-		int avail = table_sz - offset - sizeof(*hdr);
-		int rsc_offset = offset + sizeof(*hdr);
-		void *rsc = (void *)hdr + sizeof(*hdr);
+		u32 offset = table->offset[i];
+		struct fw_rsc_hdr *hdr;
+		int avail, rsc_offset;
+		void *rsc;
 
-		if (avail < 0) {
+		if (offset < sizeof(*table) || offset >= table_sz ||
+		    table_sz - offset < sizeof(*hdr)) {
 			dev_err(dev, "rsc table is truncated\n");
 			return -EINVAL;
 		}
 
+		hdr = (void *)table + offset;
+		avail = table_sz - offset - sizeof(*hdr);
+		rsc_offset = offset + sizeof(*hdr);
+		rsc = (void *)hdr + sizeof(*hdr);
+
 		ret = cb(hdr->type, rsc, rsc_offset, avail, data);
 		if (ret)
 			return ret;
-- 
2.53.0

Re: [PATCH v3 5/5] remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry()

[Bjorn Andersson]

On Mon, Aug 03, 2026 at 05:13:31PM +0530, Mukesh Ojha wrote:
> table->offset[i] is a u32 from firmware, but was stored into a signed
> int.  A crafted offset like 0xFFFFFFF0 becomes -16, placing hdr 16 bytes
> before the table buffer.  The subsequent avail check was bypassed
> because the negative int was promoted to a large size_t in the
> expression "table_sz - offset - sizeof(*hdr)", yielding a large positive
> avail and letting the out-of-bounds hdr->type read proceed undetected.
> 
> Store the offset as u32 and validate it with unsigned comparisons before
> any pointer arithmetic.
> 

Fixes: fd2c15ec1dd3 ("remoteproc: resource table overhaul")

Regards,
Bjorn

> Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
> ---
>  include/linux/rsc_table.h | 17 +++++++++++------
>  1 file changed, 11 insertions(+), 6 deletions(-)
> 
> diff --git a/include/linux/rsc_table.h b/include/linux/rsc_table.h
> index 0ad9122c22af..71b60125310e 100644
> --- a/include/linux/rsc_table.h
> +++ b/include/linux/rsc_table.h
> @@ -310,17 +310,22 @@ static inline int rsc_table_for_each_entry(struct resource_table *table,
>  	int i, ret;
>  
>  	for (i = 0; i < table->num; i++) {
> -		int offset = table->offset[i];
> -		struct fw_rsc_hdr *hdr = (void *)table + offset;
> -		int avail = table_sz - offset - sizeof(*hdr);
> -		int rsc_offset = offset + sizeof(*hdr);
> -		void *rsc = (void *)hdr + sizeof(*hdr);
> +		u32 offset = table->offset[i];
> +		struct fw_rsc_hdr *hdr;
> +		int avail, rsc_offset;
> +		void *rsc;
>  
> -		if (avail < 0) {
> +		if (offset < sizeof(*table) || offset >= table_sz ||
> +		    table_sz - offset < sizeof(*hdr)) {
>  			dev_err(dev, "rsc table is truncated\n");
>  			return -EINVAL;
>  		}
>  
> +		hdr = (void *)table + offset;
> +		avail = table_sz - offset - sizeof(*hdr);
> +		rsc_offset = offset + sizeof(*hdr);
> +		rsc = (void *)hdr + sizeof(*hdr);
> +
>  		ret = cb(hdr->type, rsc, rsc_offset, avail, data);
>  		if (ret)
>  			return ret;
> -- 
> 2.53.0
> 

Re: [PATCH v3 0/5] remoteproc: Misc. RSC table changes

[Bjorn Andersson]

On Mon, 03 Aug 2026 17:13:26 +0530, Mukesh Ojha wrote:
> This series contains a mix of header hygiene and a security fix for
> rsc_table_for_each_entry().
> 
> Patch 1 adds rsc_table.h to the REMOTEPROC MAINTAINERS entry, which was
> missing since the header was split out from remoteproc.h.
> 
> Patches 2-4 clean up remoteproc.h and rsc_table.h: a checkpatch style
> fix for function pointer alignment and two SPDX-License-Identifier
> conversions replacing the verbose BSD-3-Clause blurb.
> 
> [...]

Applied, thanks!

[1/5] MAINTAINERS: add rsc_table.h to remoteproc entry
      commit: b08aeb36957e7a6bd1afc3802a82c3be52066aba
[2/5] remoteproc: fix coding style issues in remoteproc.h
      commit: bcacae90e8c1a2be0716895dda663fb5fdf9f85e
[3/5] remoteproc: replace BSD blurb with SPDX identifier in remoteproc.h
      commit: 7c1f35380d22971572856be8642fb46de6229d94
[4/5] remoteproc: replace BSD blurb with SPDX identifier in rsc_table.h
      commit: bf9053b22ccbb4d481135d0000fac7302d060af0
[5/5] remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry()
      commit: bb840ea69347aff7bde5a208e7b5b180669a7656

Best regards,
-- 
Bjorn Andersson <andersson@kernel.org>