From patchwork Wed Oct 12 16:00:35 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Loic PALLARDY X-Patchwork-Id: 9373477 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 77EE960839 for ; Wed, 12 Oct 2016 16:05:46 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 6A0E9294EA for ; Wed, 12 Oct 2016 16:05:46 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 5F02F29646; Wed, 12 Oct 2016 16:05:46 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 24EA3294EA for ; Wed, 12 Oct 2016 16:05:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755570AbcJLQD6 (ORCPT ); Wed, 12 Oct 2016 12:03:58 -0400 Received: from mx08-00178001.pphosted.com ([91.207.212.93]:52079 "EHLO mx07-00178001.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1753680AbcJLQCy (ORCPT ); Wed, 12 Oct 2016 12:02:54 -0400 Received: from pps.filterd (m0046660.ppops.net [127.0.0.1]) by mx08-00178001.pphosted.com (8.16.0.11/8.16.0.11) with SMTP id u9CFuSgs029213; Wed, 12 Oct 2016 18:01:24 +0200 Received: from beta.dmz-eu.st.com (beta.dmz-eu.st.com [164.129.1.35]) by mx08-.pphosted.com with ESMTP id 2615cgwhy0-1 (version=TLSv1 cipher=ECDHE-RSA-AES256-SHA bits=256 verify=NOT); Wed, 12 Oct 2016 18:01:24 +0200 Received: from zeta.dmz-eu.st.com (zeta.dmz-eu.st.com [164.129.230.9]) by beta.dmz-eu.st.com (STMicroelectronics) with ESMTP id 085D93A; Wed, 12 Oct 2016 16:01:22 +0000 (GMT) Received: from Webmail-eu.st.com (Safex1hubcas22.st.com [10.75.90.92]) by zeta.dmz-eu.st.com (STMicroelectronics) with ESMTP id 9CE4B2AB7; Wed, 12 Oct 2016 16:01:22 +0000 (GMT) Received: from localhost (10.201.23.23) by Webmail-ga.st.com (10.75.90.48) with Microsoft SMTP Server (TLS) id 14.3.279.2; Wed, 12 Oct 2016 18:01:22 +0200 From: Loic Pallardy To: , , CC: , , , Subject: [PATCH v3 17/20] remoteproc: core: Add function to verify resource table consistency Date: Wed, 12 Oct 2016 18:00:35 +0200 Message-ID: <1476288038-24909-18-git-send-email-loic.pallardy@st.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1476288038-24909-1-git-send-email-loic.pallardy@st.com> References: <1476288038-24909-1-git-send-email-loic.pallardy@st.com> MIME-Version: 1.0 X-Originating-IP: [10.201.23.23] X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-10-12_09:, , signatures=0 Sender: linux-remoteproc-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-remoteproc@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP As resource table could be parsed several times, at different times, to avoid sanity check duplication, let's introduce a new function to verify the complete integrity of one resource table. This new function is called before copying it in cache and accessing it. Signed-off-by: Loic Pallardy --- drivers/remoteproc/remoteproc_core.c | 70 ++++++++++++++++++++++++++++++++++++ 1 file changed, 70 insertions(+) diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c index 559a63b..849460e 100644 --- a/drivers/remoteproc/remoteproc_core.c +++ b/drivers/remoteproc/remoteproc_core.c @@ -785,6 +785,69 @@ static void rproc_resource_cleanup(struct rproc *rproc) rproc_remove_virtio_dev(rvdev); } +static int rproc_resource_table_sanity_check(struct rproc *rproc, + struct resource_table *table_ptr, int len) +{ + struct device *dev = &rproc->dev; + int i; + + if (len < sizeof(*table_ptr)) + goto out; + + for (i = 0; i < table_ptr->num; i++) { + int offset = table_ptr->offset[i]; + struct fw_rsc_hdr *hdr = (void *)table_ptr + offset; + int avail = len - offset - sizeof(*hdr); + void *rsc = (void *)hdr + sizeof(*hdr); + struct fw_rsc_vdev *v; + + /* Make sure table isn't truncated */ + if (avail < 0) + goto out; + + if (offset == FW_RSC_ADDR_ANY || offset == 0) { + dev_err(dev, "Entry %d: bad offset value %x\n", i, offset); + return -EINVAL; + } + + dev_dbg(dev, "rsc: type %d\n", hdr->type); + + switch (hdr->type) { + case RSC_CARVEOUT: + avail -= sizeof(struct fw_rsc_carveout); + break; + case RSC_DEVMEM: + avail -= sizeof(struct fw_rsc_devmem); + break; + case RSC_TRACE: + avail -= sizeof(struct fw_rsc_trace); + break; + case RSC_VDEV: + v = rsc; + avail -= sizeof(struct fw_rsc_vdev); + if (avail < 0) + goto out; + + avail -= v->num_of_vrings * sizeof(struct fw_rsc_vdev_vring) + + v->config_len; + break; + default: + dev_err(&rproc->dev, "Unsupported resource type: %d\n", + hdr->type); + return -EINVAL; + } + if (avail < 0) + goto out; + } + + return 0; + +out: + dev_err(dev, "Invalid resource table format\n"); + dump_stack(); + return -EINVAL; +} + static void rproc_dump_resource_table(struct rproc *rproc, struct resource_table *table, int size) { @@ -1246,6 +1309,13 @@ static int rproc_fw_boot(struct rproc *rproc, const struct firmware *fw) goto clean_up; } + /* Verify resource table consistency */ + ret = rproc_resource_table_sanity_check(rproc, table, tablesz); + if (ret) { + dev_err(dev, "Failed to get valid resource table,%d\n", ret); + goto clean_up; + } + /* * Create a copy of the resource table. When a virtio device starts * and calls vring_new_virtqueue() the address of the allocated vring