Re: [PATCH 2/2] memory: brcmstb_dpfe: Bounds check DCPU-supplied MSG_ARG_COUNT

[Florian Fainelli]

On 8/26/26 13:14, Danesh Petigara wrote:
> From: Justin Chen <justin.chen@xxxxxxxxxxxx>
>
> A compromised or buggy DCPU coprocessor can make any user who reads
> world-readable /sys/devices/.../dpfe_info|dpfe_dram trigger a kernel
> stack out-of-bounds read of arbitrary extent. This bounds checks
> chksum_idx against MSG_FIELD_MAX after reading the response from DCPU
> message RAM.
>
> Fixes: 5d06f53d9509 ("memory: brcmstb: dpfe: Compute checksum at __send_command() time")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Justin Chen <justin.chen@xxxxxxxxxxxx>
> Assisted-by: Gemini:gemini-3.1-pro-preview cursor
> Signed-off-by: Danesh Petigara <danesh.petigara@xxxxxxxxxxxx>

Reviewed-by: Florian Fainelli <florian.fainelli@xxxxxxxxxxxx>
--
Florian