Re: [PATCH] soc: qcom: socinfo: Avoid out of bounds read of serial number

[Dmitry Baryshkov]

On Mon, Dec 30, 2024 at 08:59:35PM +0100, Stephan Gerhold wrote:
> On MSM8916 devices, the serial number exposed in sysfs is constant and does
> not change across individual devices. It's always:
> 
>   db410c:/sys/devices/soc0$ cat serial_number
>   2644893864
> 
> The firmware used on MSM8916 exposes SOCINFO_VERSION(0, 8), which does not
> have support for the serial_num field in the socinfo struct. There is an
> existing check to avoid exposing the serial number in that case, but it's
> not correct: When checking the item_size returned by SMEM, we need to make
> sure the *end* of the serial_num is within bounds, instead of comparing
> with the *start* offset. The serial_number currently exposed on MSM8916
> devices is just an out of bounds read of whatever comes after the socinfo
> struct in SMEM.
> 
> Fix this by changing offsetof() to offsetofend(), so that the size of the
> field is also taken into account.
> 
> Cc: stable@xxxxxxxxxxxxxxx
> Fixes: efb448d0a3fc ("soc: qcom: Add socinfo driver")
> Signed-off-by: Stephan Gerhold <stephan.gerhold@xxxxxxxxxx>
> ---
>  drivers/soc/qcom/socinfo.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 

Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@xxxxxxxxxx>

-- 
With best wishes
Dmitry