Re: [PATCH] soc: qcom: cmd-db: bound database walks to the mapped region

[Konrad Dybcio]

On 10/13/26 11:16 AM, Oleksandr Suvorov wrote:
> The command DB is read from a reserved memory region mapped with the
> size given in the device tree. The per-slave entry count and header
> offset, and each entry's data offset and length, are taken from the
> blob and used without checking them against the size of that mapping.
> 
> cmd_db_get_header() walks rsc_hdr->cnt entries for every slave when an
> ID is not found, and cmd_db_read_aux_data() and the debugfs dump return
> or print len bytes at a blob-supplied offset. A count or offset that
> reaches beyond the mapping makes these read outside it.
> 
> Keep the mapped size from probe and add cmd_db_in_bounds() to check a
> range against it. Skip a slave whose entry array is out of range,
> return -EINVAL from cmd_db_read_aux_data() for out-of-range data, and
> mark such entries in the debugfs dump. Warn once for the first two.
> 
> Also set the size before cmd_db_header becomes visible to callers, so
> a lookup never sees a header with a zero size.
> 
> Signed-off-by: Oleksandr Suvorov <cryosay@xxxxxxxxx>
> 
> ---

GPT also suggests this additional diff to block a smaller-than-the-header
cmd-db region:

 	rmem = of_reserved_mem_lookup(pdev->dev.of_node);
 	if (!rmem) {
 		dev_err(&pdev->dev, "failed to acquire memory region\n");
 		return -EINVAL;
 	}

+	if (rmem->size < offsetof(struct cmd_db_header, data)) {
+		dev_err(&pdev->dev, "Command DB region is too small\n");
+		return -EINVAL;
+	}
+
 	header = devm_memremap(&pdev->dev, rmem->base, rmem->size, MEMREMAP_WC);

Konrad